Shared connections
What is CGNAT and how can I check?
Carrier-grade NAT (CGNAT) lets an internet provider share public IPv4 addresses among customers. Your home router may translate device traffic first, with a second translation taking place inside the provider's network.
The public address on Check my IP alone cannot tell you whether CGNAT is present. To investigate, compare the router's WAN IPv4 address with the public IPv4 observed on the same connection.
The CGNAT IP range: 100.64.0.0/10
The shared range runs from 100.64.0.0 through 100.127.255.255. It is separate from the usual private IPv4 ranges and is defined by RFC 6598. Seeing it on a provider-facing WAN interface is a useful clue, not a complete diagnosis. Some providers use other arrangements, and software overlays can also use shared space.
Check your WAN address step by step
- Open your router's administration page or app using its own instructions. Find Internet, WAN or connection status. Do not confuse the WAN address with the router's LAN address.
- Record the WAN IPv4 address. Do not change settings. If a separate modem/router sits upstream, note that too.
- On a device using that connection, note the public IPv4 at the same time. A VPN, browser proxy or relay can make this comparison misleading; document whether one is in use. Follow your organization's rules on managed connections.
- Use the IP range checker to classify the WAN address and compare it with the observed public IPv4. The checker processes your input in the browser.
| Observation | What to investigate |
|---|---|
WAN is in 100.64.0.0/10 | Shared address space. Ask the provider whether this connection uses CGNAT. |
| WAN is private IPv4 | Another NAT layer may exist in your home, building or provider network. |
| WAN and public IPv4 differ | Upstream translation, another route, VPN/proxy use or a changed address can explain it. |
| WAN and public IPv4 match | The addresses match for this observation. This does not establish that incoming ports are reachable. |
CGNAT and port forwarding
A forwarding rule on your home router cannot, by itself, configure the provider's upstream NAT. If you need to receive incoming connections, ask whether the provider offers a public IPv4 option or an explicit port mapping. A public address and a static address are different features; you may not need both.
IPv6 can provide another route when both ends support it, but the service and firewall must also be configured appropriately. It does not automatically make an IPv4-only service reachable. Use our IPv6 test for an outbound connectivity check, not an inbound port test.
Questions to send your provider
- Does my current plan use CGNAT for IPv4?
- Can I receive incoming connections, and is a public IPv4 option available?
- Is that option dynamic or static, and does it cost extra?
- Do you provide native IPv6, and are incoming connections filtered?
For the address terminology behind these questions, read public vs private IP addresses.