What is CGNAT, and why do websites think I'm someone else?

What CGNAT is, in plain terms

Carrier-Grade NAT (CGNAT) is a technique ISPs use to stretch a limited pool of public IPv4 addresses across far more customers than they have addresses for. Instead of giving each household or mobile subscriber its own public IP, the ISP assigns everyone a private address and routes their traffic through a shared public IP at the network edge — the same core idea as the NAT your home router already does for your own devices, just run one layer up by the carrier. RFC 6888 defines the behavioral requirements carrier-grade NAT devices are expected to follow, and RFC 6598 reserves a specific address block, 100.64.0.0/10, for exactly this purpose, so CGNAT traffic can be told apart from ordinary private (RFC 1918) addressing.

ISPs adopted CGNAT mainly because the global supply of IPv4 addresses ran out faster than IPv6 was deployed everywhere; it’s especially common on mobile data networks, where a single carrier routes an enormous number of devices through a comparatively small number of public IPs.

Why it causes confusing problems

Because a public IP under CGNAT is shared, anything tied to “your IP address” is really tied to everyone sharing it with you at that moment:

• Blacklisting by association. If another customer behind the same shared IP sends spam or abusive traffic, the IP can get blacklisted — affecting your mail deliverability or triggering CAPTCHAs on websites, even though you did nothing wrong. See our IP blacklist guide for what to do if this happens to you.
• Inbound connections don’t reach you. Port forwarding, hosting a small server, or some peer-to-peer game connections rely on the internet being able to reach a specific port on your specific IP. Under CGNAT, that port belongs to the shared IP, not uniquely to you, so your ISP generally can’t forward it to your router the way it would with a dedicated IP.
• Rate limits and CAPTCHAs feel unfair. A website that limits requests “per IP” sees combined traffic from everyone behind your CGNAT pool, which can trip rate limits or trigger extra verification steps based on behavior that wasn’t yours.
• Geolocation looks wrong. The IP’s registered location is often the carrier’s regional gateway, not your actual location, which is why some sites guess your city incorrectly.

How to check if you’re behind CGNAT

1. Compare your router’s reported IP to what the internet sees. Log into your router’s status page and note the WAN IP it shows. Then run AdminKit’s what is my IP tool from a device on that network — if the two addresses don’t match, something between your router and the internet is translating your address, which is a strong CGNAT signal.
2. Check for the shared address space range directly. If your router’s WAN IP falls inside 100.64.0.0 to 100.127.255.255 (the 100.64.0.0/10 block from RFC 6598), you are behind CGNAT. AdminKit’s subnet calculator can confirm whether a given address falls inside that range.
3. Test inbound connectivity directly. Use port check with your own consent against your own IP; if a port you’ve explicitly forwarded on your router still doesn’t show as reachable from outside, CGNAT (or a second NAT layer at your ISP) is a likely explanation.
4. Ask your ISP. Many ISPs will confirm directly whether your plan uses CGNAT and whether a dedicated IP is available, usually as a paid option.

What you can do about it

If CGNAT is only causing minor annoyances (occasional CAPTCHAs), there often isn’t much to “fix” — it’s a normal, intentional part of how many ISPs allocate IPv4 addresses today. If you specifically need inbound connectivity — hosting a server, reliable port forwarding, certain security cameras, or remote access to home equipment — the practical options are:

• Request a dedicated (static or public) IP from your ISP, often available for an extra monthly fee on both home and business plans.
• Use IPv6 if your ISP and the service you’re connecting to both support it. IPv6 was designed with enough address space that carrier-grade NAT generally isn’t needed, so many ISPs assign IPv6 addresses directly — see our IPv6 and home devices guide for what that means for your home network’s exposure.
• Use a tunnel or relay service that maintains an outbound connection from inside your network, avoiding the need for anything to connect inbound to you at all — this is the same principle AdminKit’s planned Protective DNS and future remote-access products are built around, though they are still in early access.

CGNAT on mobile data versus home broadband

CGNAT shows up differently depending on the connection type. Mobile carriers adopted it earliest and most widely, since a single cell tower serves far more simultaneous devices than a typical neighborhood’s home broadband does, and mobile IPv4 addresses were scarce well before fixed-line addresses were. If you compare my-ip results on WiFi versus mobile data from the same phone, it’s common to see CGNAT indicators only on the mobile connection. Home broadband providers adopted CGNAT later and less universally — many still assign a dedicated public IP per household by default, with CGNAT reserved for budget tiers or newer deployments where address scarcity bites hardest. Business-grade connections are the least likely to use CGNAT at all, since business customers more often need the reliable inbound connectivity a dedicated address provides.

Why this matters for the rest of AdminKit’s checks

Several of AdminKit’s checks explicitly account for CGNAT because it changes what a result means. A blacklist hit, an open-port finding, or a geolocation result tied to a shared IP may describe your neighbor’s traffic as much as your own — which is why what is my IP flags CGNAT when it’s detected, instead of presenting every result as if the IP were exclusively yours. Keeping this distinction in mind also saves time when something looks wrong: before assuming a device on your own network caused a blacklist hit or a strange geolocation result, checking whether your connection is shared in the first place is a faster way to rule out causes that were never under your control to begin with.