What Is CGNAT? Why Your Public IP Is Shared With Others

If the city on your IP lookup is wrong, you keep getting CAPTCHAs, or a security camera refuses to be reachable from outside no matter how you configure the router, the cause is often the same thing: CGNAT. It is one of the most common reasons "my IP is not really mine" — and it is becoming more common every year. This article explains what it is, how to check whether you are behind it, and what you can do about it.

Why CGNAT exists: IPv4 ran out

IPv4 has only about 4.3 billion addresses (2³²) — far fewer than the number of phones, laptops, TVs and cameras online. Since 2011 the regional internet registries have been running out of free IPv4 blocks. Providers could not give every customer a public address any more, so they started sharing: Carrier-Grade NAT (CGNAT, also called Large-Scale NAT) puts hundreds or thousands of subscribers behind one small pool of public IP addresses.

How it differs from the NAT in your router

Your home router already performs NAT: all your devices share the router's single public address (see private vs public IP). With CGNAT there is a second layer. Your router's "WAN" address is itself not public — it is a private or shared address, and the provider's equipment translates it again before traffic reaches the internet:

Your device  192.168.1.20
   -> your router   WAN 100.72.14.9      (shared range, not public)
      -> ISP CGNAT  203.0.113.45         (the public IP websites see)
         -> internet

The range 100.64.0.0/10 (that is, 100.64.0.0 to 100.127.255.255) is reserved specifically for this purpose by RFC 6598.

How to tell if you are behind CGNAT

1. Open the Show-IP.ir home page and note your public IP.
2. Log in to your router (here is how to log in to the router) and find the WAN IP address on the status page.
3. Compare the two.
   • Same address: you have a real public IP. No CGNAT.
   • Different address: you are behind NAT at your provider. A WAN address starting with 100.64–100.127 is a clear sign of CGNAT; a 10.x, 172.16–31.x or 192.168.x WAN address means the provider is using ordinary private space for the same purpose.

As a rule of thumb, mobile data is almost always CGNAT, and many fixed-line providers use it too.

What CGNAT changes for you

• Wrong location. The public address belongs to the provider's gateway, which may be in another city. See why the IP map shows the wrong city.
• Shared reputation. Hundreds of strangers use the same public IP. If one of them abuses a service, everyone sharing the address may get CAPTCHAs or blocks (checking IP blacklists).
• No inbound connections. You cannot forward a port on a connection that is not yours alone, so CCTV, remote desktop, game servers and self-hosting do not work from outside.
• Stricter game NAT type. Peer-to-peer games and consoles may report "Strict" NAT, causing matchmaking and voice-chat problems.
• Changing addresses. The public IP you appear as may change frequently, and many customers share it at once.

Workarounds

• Ask for a public (or static) IP. Many providers sell it as an add-on and it removes you from CGNAT. Our guide on getting a static public IP explains how to ask.
• Use IPv6. Providers that run CGNAT for IPv4 often give customers IPv6 addresses that are not translated. If both ends support it, that is a direct path (read IPv4 vs IPv6).
• Reverse tunnel or a small VPS. Your device connects out to a server with a public IP, and you reach the device through that server. Tools such as WireGuard, SSH tunnels or tunnel services do this without needing an open port at home.
• A VPN for gaming. A VPN with port forwarding, or a better-routed path, can sometimes improve the NAT type — see reducing ping in online games.

Is CGNAT a privacy feature?

It does make it harder for a random website to link one address to one household, but that is a side effect, not protection. The provider still keeps records mapping time, address and port to your subscription, and it does not hide anything else about your traffic. For real privacy see how to hide your IP address.

Key takeaways

• CGNAT = your provider puts many customers behind a shared public IPv4 address because free addresses ran out.
• Compare your router's WAN IP with the IP shown by an online lookup; if they differ (or WAN starts with 100.64–100.127) you are behind CGNAT.
• It explains wrong locations, CAPTCHAs, strict game NAT and broken port forwarding.
• Fixes: a public/static IP from the provider, IPv6, or a tunnel through a server that has a public address.