What is CGNAT (Carrier-Grade NAT)?
Carrier-Grade NAT (CGNAT), specified in IETF RFC 6598, is a large-scale Network Address Translation technology deployed by ISPs (including Starlink, mobile 5G networks, and fiber providers) to share a single public IPv4 address among thousands of home subscribers.
Unlike standard home routers where you control port forwarding rules, CGNAT places an additional layer of NAT at the ISP data center level. This means your home router does not receive a true public IP address, making direct inbound port forwarding impossible through standard router settings.
How to Identify If You Are Behind CGNAT
You can verify whether your ISP uses CGNAT by comparing the WAN IP in your router's status page with your outward-facing IP on our public IP lookup tool:
- RFC 6598 Subnet Range: If your router's WAN IP falls between `100.64.0.0` and `100.127.255.255`, you are definitely behind CGNAT.
- IP Mismatch: If your router WAN IP does not match the public IP displayed on DCIPCHECK, an ISP NAT layer is active.
3 Proven Methods to Bypass CGNAT for Port Forwarding
- Request a Static Public IP from Your ISP: Most fiber and cable ISPs offer a dedicated static IP add-on for a small monthly fee, which completely removes CGNAT.
- Use Mesh VPN Tunnels (Tailscale / ZeroTier): Mesh VPN protocols use UDP hole-punching (STUN/ICE) to create secure direct peer-to-peer connections through CGNAT firewalls without opening router ports.
- Deploy a Reverse Proxy VPS (Cloudflare Tunnels): Route inbound traffic through an encrypted Cloudflare Tunnel or lightweight VPS instance directly to your internal network host.
Check your public IP and inspect your connection routing layer right now on our free IP scanner tool.