CGNAT
What is CGNAT?
CGNAT (Carrier-Grade NAT) is how an ISP shares one public IPv4 address across many customers at once, common on mobile networks, instead of giving each subscriber its own address. AdminKit's My IP tool shows whether your visible address sits in RFC 6598's 100.64.0.0/10 CGNAT range, which affects blacklist status and inbound port forwarding for everyone sharing it.
By AdminKit team, Netbase JSC · Updated
This entry is the short definition. For the full explanation — why CGNAT gets you blacklisted, flooded with CAPTCHAs or blamed for someone else’s traffic, how to check whether your connection is behind it, and what to ask your ISP — read AdminKit’s guide What is CGNAT, and why do websites think I’m someone else?
CGNAT (Carrier-Grade NAT) is a technique ISPs use to share one public IPv4 address across many customers at the same time, instead of giving each household or mobile subscriber its own address. It exists because the global supply of IPv4 addresses ran out faster than IPv6 rolled out everywhere, and it is especially common on mobile networks. In ARIN’s service region, for example, ARIN’s free pool of IPv4 address space was depleted on 24 September 2015, and new IPv4 space there now comes only through specific policy cases, a waiting list or transfers. The tradeoff is that anything tied to “your IP” — blacklist status, inbound port forwarding, geolocation — is really tied to everyone sharing that address with you. RFC 6598 reserves the 100.64.0.0/10 block specifically so CGNAT traffic can be told apart from ordinary private addressing, a reservation also listed in IANA’s IPv4 Special-Purpose Address Registry. A mobile operator running an IPv6-only network instead faces the mirror-image scarcity problem, and solves it with NAT64/DNS64 or 464XLAT rather than CGNAT, since there is no shared IPv4 pool to begin with on the subscriber side. DS-Lite, defined in RFC 6333, takes a related but distinct approach: instead of running NAT on an IPv4 access network the way CGNAT does, it removes IPv4 from the access network entirely and tunnels customer IPv4 traffic over IPv6 to a shared carrier-side NAT.
To check whether one specific address falls in the 100.64.0.0/10 CGNAT range offline, without relying on your own connection’s current public IP, paste it into AdminKit’s IP info tool.
CGNAT is part of AdminKit’s IP & network cluster; the full AdminKit glossary lists other related terms.
Frequently asked questions
Is CGNAT the same as a VPN?
No. CGNAT is address-sharing done by your ISP so multiple customers use one public IP at once; it provides no encryption or privacy, and the ISP still sees all your traffic, unlike a VPN.
Does CGNAT break port forwarding for gaming or self-hosting?
Yes, in practice -- because many customers share the same public IP under CGNAT, a router behind it typically can't forward an inbound port to just one subscriber's device, since the ISP's shared NAT, not your own router, controls that address.
How do I know if I'm behind CGNAT?
Compare the address your router reports as its WAN IP with the public address AdminKit's My IP tool shows; if they differ, or if your public address falls in the 100.64.0.0/10 range RFC 6598 reserves for carrier-grade NAT, you're behind CGNAT.
Is CGNAT only used on mobile networks?
No -- it's especially common on mobile networks, but many fixed-line ISPs use it too now that IPv4 addresses have run out globally.