What Is CGNAT? Carrier-Grade NAT Explained, and What It Means for Your IP

Networking guide · Last reviewed 1 October 2026 · 10 min read

CGNAT, short for carrier-grade NAT, is a technique internet providers use to put many customers behind one shared public IPv4 address. It is why your router’s internet address often isn’t the address websites see, why port forwarding stops working on some connections, and why a mobile phone’s IP is shared with thousands of other subscribers. This guide explains what CGNAT is, how it works, how to tell whether you are behind it, what it breaks, and why it matters for mobile proxies and static residential IPs.

What is CGNAT?

Network address translation (NAT) lets several devices share one IP address. Your home router already does it: phones, laptops and TVs get private addresses such as 192.168.1.20, and the router rewrites their traffic so it all leaves from the one public address your provider gave you.

Carrier-grade NAT does the same job one level up, inside the provider’s network. The IETF’s requirements document for it, RFC 6888, defines a carrier-grade NAT as a NAT-based function used to share the same IPv4 address among several subscribers, one the subscribers don’t manage. Instead of giving each home or phone its own public address, the provider gives it an internal one and translates many subscribers onto a smaller pool of public addresses.

When a home router’s own NAT sits behind the provider’s carrier-grade NAT, traffic is translated twice. That arrangement is often called NAT444, because an IPv4 address is translated to another IPv4 address, and then to a third.

Why providers use carrier-grade NAT

IPv4 has about 4.3 billion addresses, far fewer than the number of connected devices. The regional registries that hand out addresses have largely run out of fresh IPv4 blocks, so new providers and growing networks have to buy addresses on the transfer market or share the ones they have. Carrier-grade NAT is the sharing option: a provider with one public address per hundred subscribers can keep adding customers without buying more.

The IETF’s own position is that sharing is a stopgap. RFC 6269, which catalogues the problems address sharing causes, concludes that deploying IPv6 is the only long-term way to ease pressure on the IPv4 pool. In practice, most providers now run IPv6 alongside IPv4, and carrier-grade NAT handles the IPv4 part.

How carrier-grade NAT works

laptop 192.168.1.20  (private, home network)
      |  home router NAT
      v
router WAN 100.64.12.7  (shared address space, provider network)
      |  carrier-grade NAT
      v
public IP 203.0.113.50, port 40211
      |
      v
website  -->  sees 203.0.113.50, shared with many other subscribers

The address between the provider’s NAT and your router comes from a range set aside for exactly this. RFC 6598 reserves 100.64.0.0/10 as “Shared Address Space” for service providers deploying carrier-grade NAT. It exists because providers couldn’t safely reuse the private ranges from RFC 1918 (such as 192.168.0.0/16) on that link: a customer’s own router might already use the same range on the home side.

Because many subscribers leave from the same public address, the NAT tells them apart by port. Each outgoing connection gets a public address and port pair, and the NAT remembers which subscriber it belongs to so the reply can find its way back. RFC 6888 requires carrier-grade NATs to support a limit on how many ports each subscriber can use, so that one heavy user can’t exhaust the pool for everyone sharing the address, and recommends holding a released port back for a short time before giving it to someone else.

Carrier-grade NAT also appears in IPv6 transition designs. DS-Lite (RFC 6333) carries a subscriber’s IPv4 traffic inside IPv6 to a provider NAT. NAT64 (RFC 6146) and 464XLAT (RFC 6877) let IPv6-only devices, common on mobile networks, still reach IPv4 websites through a translator.

How to tell if you are behind CGNAT

1. Find your router’s WAN address. Log in to the router and look for the internet, WAN or broadband IP address.
2. Find your public address. Search “what is my IP” from a device on the same network.
3. Compare them. If the two match, you have your own public IP. If the router shows an address in 100.64.0.0 to 100.127.255.255, you are behind carrier-grade NAT. A different private address, such as 10.x.x.x, usually means the same thing.
4. On a phone, assume you are behind carrier-grade NAT on mobile data unless your plan includes a public IP.

What CGNAT breaks

RFC 6269 puts the blocking problem plainly: penalty-box responses to abuse don’t work when many people share an address, because blocking the abuser punishes everyone else behind it. The same document notes that a subscriber behind a carrier-grade NAT geolocates to wherever the NAT’s address block appears to be, which may not be where the subscriber is.

CGNAT vs a static IP

If you need an address that stays the same, for example to be allowlisted by a partner’s firewall, to run a server, or to keep the same identity on an account for weeks, carrier-grade NAT works against you. The fix is a static public IP from your provider, a server with its own address, or, for online work that should look like a home user, a static residential proxy: a fixed residential IP that stays assigned to you. ProxyEmpire’s static residential proxies give you one fixed residential IP per proxy, sold in a fixed list of countries with country-level targeting.

Does CGNAT slow down your internet?

Usually not in a way you would notice. Rewriting an address and port is simple work for the provider’s equipment, and a well-sized carrier-grade NAT adds very little delay. When CGNAT does feel slow, the cause is normally one of three things:

• Where the NAT sits. Traffic has to pass through the provider’s NAT before reaching the internet, and if that box is far from you, every connection takes a longer path.
• Port limits. Each subscriber gets a limited number of ports. An app that opens a very large number of connections at once, such as a torrent client or a busy scraper, can hit the limit, and new connections then fail or stall until ports are freed.
• Overloaded equipment. If the provider has put too many subscribers on too little NAT capacity, everyone on it can see slower connections at busy times.

On security, carrier-grade NAT is not a firewall, though it has a side effect that looks like one: unsolicited incoming connections can’t reach your devices, because the NAT has no mapping for them. That doesn’t replace a firewall or updates on your own devices. Sharing an address doesn’t make you anonymous either: as RFC 6269 points out, an IPv4 address alone no longer identifies one subscriber, so providers that need to trace traffic log the port and time as well.

CGNAT on mobile networks

Mobile carriers have far more devices than public IPv4 addresses, and phones move between cell towers constantly, so carriers put mobile data behind carrier-grade NAT almost everywhere. A single public carrier IP can front a large number of phones at once, and the address your phone gets can change when it reconnects. Many carriers also give phones IPv6 addresses and use NAT64 or 464XLAT for the IPv4 sites that remain.

That sharing is the reason mobile IPs are treated gently by websites. Because a carrier address can stand for many real subscribers, blocking it outright risks blocking many legitimate visitors, so sites tend to be cautious about banning mobile addresses and lean on other signals instead. It is also why a mobile IP looks like an ordinary phone user: it is literally the address that thousands of ordinary phone users share.

CGNAT and proxies

• Rotating mobile proxies route your traffic out through real mobile carrier connections, so the website sees a carrier IP from behind the carrier’s NAT, shared with ordinary subscribers. That is why mobile proxies suit the hardest targets. ProxyEmpire’s rotating mobile proxies cover 4M+ mobile IPs in 174 countries, with targeting by country, city and carrier included at no extra charge.
• Sticky sessions on mobile keep the same carrier IP while the connection stays up. Because the carrier can reassign addresses when a device reconnects, a mobile IP is steady for a session, not forever.
• Static residential proxies need an address that stays the same for weeks, so a home connection behind carrier-grade NAT, whose public IP is shared and can move, is a poor base for one. A static residential IP should be one fixed address that only you use; see what static residential proxies are.
• Dedicated mobile proxies give you a whole mobile connection to yourself instead of a shared pool, with unlimited bandwidth and full IP rotation. See ProxyEmpire’s dedicated 4G and 5G mobile proxies.

Working with or around CGNAT

• Use IPv6. Most networks behind carrier-grade NAT also offer IPv6, which gives each device a globally reachable address. Apps and services that support IPv6 avoid the problem entirely.
• Ask for a public IP. Many broadband providers will switch you off carrier-grade NAT, sometimes for a fee or on a business plan.
• Use an outbound tunnel. Remote-access tools and tunnels that connect out from your network to a relay work behind carrier-grade NAT, because they don’t need incoming ports.
• Host elsewhere. Put anything that must accept incoming connections on a server with its own public address.

CGNAT FAQ

References

1. IETF — RFC 6888, “Common Requirements for Carrier-Grade NATs (CGNs)” (2013). rfc-editor.org/rfc/rfc6888
2. IETF — RFC 6598, “IANA-Reserved IPv4 Prefix for Shared Address Space” (2012). rfc-editor.org/rfc/rfc6598
3. IETF — RFC 6269, “Issues with IP Address Sharing” (2011). rfc-editor.org/rfc/rfc6269
4. IETF — RFC 1918, “Address Allocation for Private Internets”. rfc-editor.org/rfc/rfc1918
5. IETF — RFC 6333, “Dual-Stack Lite Broadband Deployments Following IPv4 Exhaustion”. rfc-editor.org/rfc/rfc6333
6. IETF — RFC 6146, “Stateful NAT64”. rfc-editor.org/rfc/rfc6146
7. IETF — RFC 6877, “464XLAT”. rfc-editor.org/rfc/rfc6877