Carrier-grade NAT (CGNAT) is an ISP-side translation layer used to conserve public IPv4 addresses. RFC 6598 reserves 100.64.0.0/10 as shared address space for this purpose. A customer router can therefore receive a WAN address that is not publicly reachable even though browsing and outbound applications work normally. The provider translates many subscriber connections again before they reach a public IPv4 address.

CGNAT places translation inside the provider network

This matters most for inbound reachability. A port-forward rule on your home router controls only the NAT boundary you own. If the ISP performs another translation upstream, unsolicited connections from the internet usually cannot be mapped through that provider layer unless the ISP offers a specific service. Dynamic DNS also cannot create reachability by itself; it can name an address, but it cannot remove upstream NAT.

Compare the router WAN address with the public address

  • Compare the router WAN address with the public address reported externally.
  • If the WAN lies in 100.64.0.0/10, CGNAT is strongly indicated; private RFC 1918 WAN addresses can indicate an ISP gateway or provider NAT as well.
  • Confirm with the ISP before buying hardware or repeatedly changing port-forward rules.
  • For hosting, ask whether the provider offers a public IPv4, static IP, port mapping, IPv6, or business service.
  • Consider IPv6 when both endpoints/services support it and firewall policy is correctly configured.
  • For remote access, a VPN/overlay service that initiates outbound connections can work around lack of inbound IPv4 without exposing arbitrary ports.

A home server behind a provider NAT boundary

A router shows WAN 100.72.18.9 while an external site shows 198.51.100.x. Port 443 is forwarded correctly to a home server but remains unreachable from mobile data. The mismatch plus shared-address WAN strongly suggests provider NAT; the home router cannot create a mapping in a translation device it does not control.

Shared 100.64.0.0/10 space and inbound limits

CGNAT is conceptually similar to double NAT but occurs in the provider network. The shared-address block was created specifically so ISPs would not collide with ordinary RFC 1918 space when connecting customer equipment. Applications that are NAT-friendly often work transparently because the translation state is created by outbound traffic. Peer-to-peer hosting, some games, self-hosted servers, and inbound VPN endpoints are more likely to notice the difference.

Avoid forwarding ports only at the home router

  • Forwarding the same port repeatedly on the home router when the ISP layer is the blocker.
  • Assuming a public-IP lookup and router WAN must always show the same number.
  • Treating CGNAT as a Wi-Fi problem.
  • Opening broad DMZ settings when the upstream provider still does not deliver unsolicited traffic.

Is 100.64.0.1 a private address?

It is not RFC 1918 private space; it belongs to the shared 100.64.0.0/10 block reserved for service-provider address sharing.

Can I port forward through CGNAT?

Usually not with only your home router. You need provider support, public addressing, IPv6, or an overlay/tunnel approach.

Does CGNAT slow the internet?

Not necessarily. Performance depends on provider implementation and many other factors. The defining issue is address sharing and inbound reachability.

Can a VPN help?

An outbound-initiated VPN or overlay can provide remote reachability, depending on the service and security model.

Technical references

Video walkthrough for CGNAT and 100.64.0.0/10 Explained: Why Port Forwarding May Stop at the ISP

Explains why inbound connections and port forwarding can fail even when the local router rule is correct because the ISP does not provide a directly reachable public IPv4 address.