What Is CGNAT? Carrier-Grade NAT Explained

CGNAT (carrier-grade NAT, also written CGN or NAT444) is address translation performed by your internet provider rather than by your router. Hundreds or thousands of subscribers share a single public IPv4 address, and each subscriber gets an address from a private-use range instead of a routable one. It exists because IPv4 addresses ran out, and it is standard practice on consumer mobile networks.

How CGNAT works

Ordinary home NAT translates once: private LAN addresses (192.168.x.x) to the one public address your ISP gave your router. CGNAT adds a second translation upstream.

1. Your device gets a LAN address from the router.
2. The router's WAN interface gets a shared address space address, typically from 100.64.0.0/10, reserved for exactly this purpose in RFC 6598.
3. The carrier's CGNAT box translates that to a public IPv4 address it shares among many subscribers, tracking each flow by source port.

The result: the IP a website sees is not assigned to you. It is a port range on an address that other subscribers are using at the same moment.

Why carriers use it

IPv4 has roughly 4.3 billion addresses and the regional registries exhausted their free pools years ago. A mobile operator with tens of millions of active data subscribers cannot give each one a routable IPv4 address, so it buys or reuses a block and multiplexes subscribers behind it. IPv6 solves the shortage, but as long as parts of the internet stay IPv4-only, carriers keep a translation layer in place (dual-stack, or NAT64 for IPv6-only handsets reaching IPv4 hosts).

What CGNAT breaks

• Inbound connections. No port forwarding, so self-hosted servers, game hosts, cameras and NAS remote access do not work without a relay or tunnel.
• Protocols that need a stable public endpoint. Some peer-to-peer traffic, older VoIP setups and IPsec VPN endpoints degrade or fail.
• Shared reputation. One abusive subscriber can get the shared address rate-limited, captcha-gated or blocklisted for everyone on it. This is the CGNAT symptom people meet most often, and it looks identical to a proxy flag: see what "proxy detected" actually means and how to fix it for the full diagnosis path.
• Geolocation drift. The public address is registered to the carrier's aggregate, not your tower, so IP geolocation can place you in another city or region.
• Logging and attribution. Carriers keep port-mapping logs (RFC 6888 lists logging among the CGN requirements) so a flow can be tied back to a subscriber, which is also why an address alone identifies nothing.

CGNAT vs a public IP

How to tell if you are behind CGNAT

Four checks, cheapest first:

1. Read the WAN IP in your router status page or, on mobile, the interface address the carrier assigned. If it starts with 100.64 through 100.127, that is CGNAT shared address space. 10.x, 172.16-31.x and 192.168.x on a WAN interface also mean upstream translation.
2. Compare it to your external IP. If your WAN address and the address the internet sees are different, something upstream is translating.
3. Run a traceroute. A private or shared-space hop between your router and the first public carrier hop is the CGNAT device.
4. Try a port forward. Map a port, then test it from outside your network. If the router shows the rule active but nothing reaches it, you are behind CGNAT.

If step 2 shows a mismatch, that is the whole answer. Nothing else in the list changes the diagnosis, it only locates the box.

CGNAT and mobile proxies

A mobile proxy on a consumer data plan is, in practice, a CGNAT proxy. The exit is a real handset or modem, so its public address is a carrier NAT egress shared with ordinary subscribers on that operator. That is the property that makes mobile IPs behave differently from datacenter ranges: a platform that hard-bans the address takes real customers down with you, so mobile ASNs get graded on behavior rather than on address reputation alone. A residential proxy sits closer to one-user-per-address, which cuts both ways.

Two consequences worth designing around:

• Rotation is a NAT reassignment, not a new device. When a mobile exit rotates, the carrier hands the device a different public mapping. Sessions that were keyed to the old address drop. If your flow has a login, a cart or a multi-step form, hold a sticky session for the length of it rather than letting the address move mid-flow.
• Per-IP rate limits are shared. Your requests land in the same bucket as whatever else is on that egress. Sudden 429s or captchas after a clean run usually mean the shared address hit a limit, not that your fingerprint changed.

The collision rule nobody writes down

CGNAT means an IP is not an identity, but it does not mean an IP is invisible. Platforms weigh IP alongside device and behavior signals, and the case they catch reliably is two accounts you control appearing on one egress inside one session window. Strangers sharing a carrier NAT address is normal traffic. Two logins to the same platform from the same address minutes apart, with matching device signals, is one operator. The practical rule: one account per session ID at a time, and never run two of your own accounts through the same sticky pin in the same window. The address being shared does not launder that pattern.

If you are choosing between IPv6 addressing and CGNAT-backed IPv4 for automation, IPv6 proxies vs CGNAT walks through which of the two platforms actually score, and why a /64 of fresh IPv6 does not buy what a shared carrier address does.