What Is CGNAT and Why Your Public IP Might Not Be Yours Alone

If you've ever pulled up an IP lookup and found that the address doesn't seem to belong to you alone, or a service has flagged your connection as suspicious for no reason you can explain, CGNAT is often the answer. It's one of the most misunderstood pieces of how modern internet connections actually work, and it's becoming more common every year as ISPs run out of new IPv4 addresses to hand out.

Is CGNAT (100.64.0.0/10) a private IP or a public IP from your ISP?

CGNAT stands for Carrier-Grade NAT (Network Address Translation). It's a system ISPs use to share a single public IP address across many customers at once, instead of giving each household or mobile device its own unique public IP. Your router or phone gets an address from the special range 100.64.0.0 to 100.127.255.255, and the ISP handles translating that into whichever shared public IP is actually reaching the internet at that moment. So the honest answer is: it's neither a standard private IP nor a fully dedicated public IP, it's a separate carrier-assigned range that behaves like a private IP from your side, with your ISP owning the actual public IP on the other end. Not sure what your connection is doing right now? Check your actual IP here to see what's actually being assigned to you.

100.64.0.0/10: the mobile network CGNAT range

The core reason CGNAT exists is that IPv4 has roughly 4.3 billion total addresses, and that pool ran out for new allocations years ago. There simply aren't enough unique public IPv4 addresses left for every device on earth to have its own. CGNAT lets an ISP serve thousands, sometimes tens of thousands, of customers using a much smaller pool of public IPs, which is especially common with mobile carriers, since phone volumes are enormous and growing. If your router's WAN-facing IP falls in 100.64.0.0/10, that's your confirmation you're behind CGNAT. This is a distinct, dedicated range, different from the standard private ranges (10.x, 172.16.x, 192.168.x) covered in our private IP ranges guide, specifically so CGNAT traffic never gets confused with ordinary home network addressing.

The practical downsides

• Port forwarding often doesn't work. Since you're sharing a public IP with other customers, your ISP can't forward incoming traffic to just your connection the way it could with a dedicated public IP. Any guide that assumes a standard home setup will fail silently here.
• You may get flagged more than expected. If dozens or hundreds of customers share one public IP, and one of them does something that gets that IP flagged, rate-limited, or blacklisted, everyone behind that same CGNAT IP feels the effect, even though they did nothing themselves.
• Hosting anything from home gets harder. Game servers, self-hosted services, security camera remote access, and remote desktop setups typically expect a stable public IP to be reachable at, which CGNAT doesn't provide by default.
• Some online services behave inconsistently. A handful of websites and services apply stricter rate limits or CAPTCHA challenges to known CGNAT and mobile carrier ranges, since they see disproportionately high traffic volume from a small number of addresses.

What you can do about it

• Ask your ISP for a dedicated public IP. Many ISPs offer this as a paid add-on, sometimes bundled with business-tier plans, sometimes available as a standalone request.
• Use a VPN with port forwarding support. Some VPN providers offer a static IP with forwarding, working around the CGNAT limitation entirely by routing your traffic through their own dedicated address instead.
• Use a reverse tunnel or relay service. For self-hosting specifically, tools that create an outbound tunnel from your network to a public relay can sidestep the need for inbound port forwarding altogether.
• Confirm it's actually CGNAT before troubleshooting further. It's easy to burn hours debugging a port forwarding issue that's actually just CGNAT and has nothing to do with your router configuration. See your real IP behind CGNAT first to rule it in or out before changing any settings.

How to check for CGNAT on your own connection

Log into your router and find the WAN IP address (usually under a Status or Network Info page). If that address starts with anything from 100.64 through 100.127, you're behind CGNAT. If your router's WAN IP instead shows a standard 192.168.x, 10.x, or 172.16-31.x address, you're likely behind a second router or modem in bridge mode rather than CGNAT, which is a different situation entirely.

CGNAT vs. a regular private IP