Glossary · Networking

CGNAT (Carrier-Grade NAT)

CGNAT is NAT performed by an internet provider that lets many customers share a small pool of public IPv4 addresses.

Updated October 6, 2026

CGNAT (Carrier-Grade NAT) is large-scale NAT run inside an ISP's network. Customers receive private or shared-space addresses (often in 100.64.0.0/10) and their traffic is translated to a public address shared by many subscribers.

Why it matters

IPv4 addresses are scarce, so providers use CGNAT to serve more customers. For the user it means inbound connections are blocked, so port forwarding, self-hosted servers and some games or remote-access tools do not work. Many users also share one public IP, so a block against that address can hit innocent neighbors.

Example

$ ip addr   (router WAN)
inet 100.72.14.9/10

A WAN address in 100.64.0.0/10 while a website reports a different public IP is a strong sign you are behind CGNAT. Ask your provider for a public address or use IPv6 or a tunnel.

Common mistakes

  • Trying to set up port forwarding on the home router when the ISP is the blocking NAT.
  • Assuming your public IP is unique to you.
  • Hosting a monitoring or webhook endpoint at home without checking for CGNAT.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · NetworkingForward ProxyA forward proxy is a server that makes requests to the internet on behalf of clients, hiding or filtering their traffic.Glossary · NetworkingNAT (Network Address Translation)NAT is a technique where a router rewrites IP addresses and ports in packets so many private devices can share one public IP address.Glossary · NetworkingPrivate vs Public IP AddressA public IP address is reachable on the internet, while a private IP is reserved for local networks and not routed globally.Guide · EmailEmail Blacklist Removal Guide: Find the Cause, Get Delisted, Stay CleanLearn how DNS blocklists work, how to check IP and domain listings, fix the root cause first, request delisting, and prevent repeat listings on your mail server.8 min readGuide · EmailReverse DNS (PTR) for Email: Why It Matters and How to Set It UpHow PTR records and forward-confirmed reverse DNS affect email delivery, how to check them with dig, and how to set matching rDNS, HELO and A records.6 min readGuide · DNS & DomainsWebsite Blocked in India or Just Down? How to Tell the DifferenceLearn how ISP-level DNS, IP and SNI blocking differ from a real outage, which signs to look for, and how to diagnose with our tools without bypassing the law.7 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.