Carrier Grade NAT
Carrier Grade Network Address Translation (CGNAT), often shortened to Carrier Grade NAT, lets a broadband provider or mobile carrier share public IPv4 addresses across many customers and devices. These companies supply Internet access and are called Internet Service Providers (ISPs). The provider translates their connections through a shared public gateway.
A public server sees the CGNAT gateway's address instead of an address dedicated to one subscriber. The visible public IP can therefore represent many unrelated people at the same time. Unlike ordinary Network Address Translation on a home or office router, the provider controls the mapping.
How does CGNAT differ from NAT?
| Characteristic | NAT | CGNAT |
|---|---|---|
| Operator | Home router, office firewall, hotel, or local network. | Broadband provider or mobile carrier. |
| Who shares | Devices inside one local network. | Many unrelated customers and their devices. |
| Internal space | Commonly the private IPv4 ranges. | Commonly 100.64.0.0/10. |
| Public evidence | Usually identifies one Internet connection, site, or local gateway, which may still serve many users. | Can identify a provider gateway shared by many subscribers. |
How does CGNAT work on mobile and provider networks?
A customer router can translate the private addresses at one site. The provider then adds another translation layer that places many subscriber connections, phones, or unrelated devices behind the same public IPv4 address. The intermediate 100.64.0.0/10 block is reserved for this provider-side shared address space.
Mobile CGNAT is common because phones attach through carrier gateways and move between cells, regions, and roaming partners. A web server sees the carrier gateway's public IP rather than a public address dedicated to one phone. Two unrelated mobile users can appear under the same public IP at the same time.
For the address blocks involved, see Special-purpose IP blocks. For timing and reassignment issues, see Static vs dynamic IP addresses.
How can I tell whether I am behind CGNAT?
Compare your router's Internet-facing IPv4 address, often labeled WAN IPv4 or Internet IPv4, with the public IPv4 address observed by IP Lens through that same router. Both values must be IPv4 addresses. An IPv6 result or a VPN or proxy exit address is not a valid comparison. If IP Lens shows only an IPv6 address, you need a public IPv4 check through that router before comparing. If the router's WAN IPv4 address is in 100.64.0.0/10, it is using the shared block reserved for CGNAT.
Different router and public addresses are a clue, not proof by themselves. A provider can use other internal address designs, and another router can add a separate NAT layer. Ask the provider for a definitive answer. CGNAT can also explain why ordinary inbound port forwarding does not reach your router. A port is a number that helps direct traffic to the right application at an IP address. Port forwarding sends incoming traffic for a chosen port to a device inside your network, but the provider controls the outer translation.
Why does port forwarding fail behind CGNAT?
A forwarding rule on a customer router controls only that router's translation. The provider owns the outer public mapping, so the customer normally cannot direct unsolicited inbound connections from the shared public IP to their router. Changing the home router alone is therefore insufficient.
Ask the provider whether it offers a dedicated public address, inbound mapping, or IPv6 service. Any reachable service still needs an appropriate firewall rule, authentication, updates, and monitoring. Read how ordinary NAT port forwarding works for the customer-side mapping.
What does a shared CGNAT address tell me?
CGNAT is configured by the ISP or mobile carrier, not selected by the user like a VPN or proxy. A shared public IP should not be treated as evidence that a user deliberately hid behind an anonymizing service.
If a blocklist, rate limit, bot rule, or fraud check treats one public IP as one user, one noisy device can affect many unrelated people behind the same CGNAT gateway. Combine the IP address with account, request, device, and behavior signals before responding.
How can I match an event to CGNAT records?
A protocol, such as TCP or UDP, defines how traffic is exchanged. To distinguish customers sharing one public IP, the provider must match the event to its records. These can be records of individual translations (NAT mappings), or records of port ranges assigned to customers under a fixed rule (deterministic port allocation). Preserve an exact Coordinated Universal Time (UTC) timestamp, public source IP, public source port, and transport protocol. Preserve the destination IP and port as well when available because they identify the exact flow and may be required by some NAT or investigative designs. A source port captured only on a backend connection through a proxy may not be the client's public source port.
First confirm the real client IP behind any proxy. Then follow the logging best practices so the evidence can be matched to provider records.