How to Check If Your ISP Uses CGNAT (and What to Ask Before You Buy)

You can usually tell whether your internet provider uses carrier-grade NAT (CGNAT) in about five minutes. Log in to your router, find the WAN or internet IP address, and compare it with the public IP address an IP lookup site shows you. If the router's WAN address starts anywhere from 100.64 to 100.127, or the two addresses don't match, your connection is almost certainly behind CGNAT.

That matters only for some households. Browsing, streaming, video calls and cloud-connected cameras work normally behind CGNAT because they start connections from inside your home. What breaks is anything that needs the internet to reach in: classic port forwarding, hosting a game server, reaching a home NAS or self-managed camera recorder directly, and some remote-access VPNs. If you rely on any of those, check before you buy a plan, not after installation day.

What CGNAT is, in one minute

Your home router already does network address translation (NAT), sharing one internet address among all of your devices. With CGNAT, the provider adds a second layer of translation inside its own network, so many customers share a single public IPv4 address. Your router never gets a public address of its own, which is why a port-forwarding rule on your router has nothing to forward from.

The Internet Engineering Task Force set aside 100.64.0.0/10 (100.64.0.0 through 100.127.255.255) in RFC 6598 as shared address space for exactly this purpose. That is why the 100.64 range is the clearest single sign of CGNAT. Our guide to port forwarding and bypassing CGNAT covers the workarounds in depth; this page focuses on confirming whether you have it.

Test 1: Compare your router's WAN address with your public IP

1. Open your router's admin page or app. The address is often printed on a label on the router or in the provider's app.
2. Find the status or internet page and note the WAN IP, internet IP or IPv4 address. Ignore LAN addresses that start with 192.168.1 or similar; those belong to your own network.
3. On a device connected to that router, visit any "what is my IP" lookup site and note the public IPv4 address it shows.
4. Compare the two using the table below.

Router WAN address	What it usually means	Can you port forward?
Matches the public IP exactly	You have your own public IPv4 address; no CGNAT	Yes, on your router
Starts with 100.64 to 100.127	Provider CGNAT using RFC 6598 shared space	No, not from your router
Starts with 10., 172.16 to 172.31, or 192.168	Either your router sits behind another router in your home (double NAT) or the provider uses private space for CGNAT	Depends; see Test 2

Test 2: Run a traceroute to find where the translation happens

A traceroute lists each hop between you and a server, so it shows whether the private addresses are inside your home or inside your provider's network.

• On Windows, open Command Prompt and run tracert -d 1.1.1.1.
• On a Mac or Linux computer, open Terminal and run traceroute -n 1.1.1.1.

Hop 1 is your own router. If hop 2 is another private address such as 192.168.0.1, you probably have a second router or a provider gateway in your home, which is double NAT rather than CGNAT. If one of the first few hops after your equipment is in the 100.64 to 100.127 range, the translation is happening in your provider's network, which is CGNAT. Some providers block traceroute replies, so a row of asterisks only means that hop did not answer.

Test 3: Check whether you have public IPv6

CGNAT applies to IPv4. Many providers that share IPv4 addresses also hand out public IPv6 addresses, which can let some apps and remote-access tools reach your home directly when both ends support IPv6. Look for an IPv6 address on your router's status page that starts with 2 or 3, or check the IPv6 result on an IP lookup site. A public IPv6 address does not remove CGNAT, but it can be a workable path for cameras, NAS boxes and remote desktop tools that support it.

CGNAT vs double NAT

The two problems look alike in a game console's "strict NAT" warning, but the fix is completely different. Our explainer on double NAT and online gaming goes deeper.

	Double NAT	CGNAT
Where the second NAT lives	In your home: a provider gateway plus your own router	In your provider's network
Typical WAN address on your router	192.168.x.x or 10.x.x.x from the gateway	100.64 to 100.127, or private space from the provider
Can you fix it yourself?	Usually: put the gateway in bridge or passthrough mode, or run one router only	No; you need a public IP from the provider or a tunnel workaround

Which connections commonly use CGNAT

Practices vary by provider, region and plan, so treat this as a starting point and confirm at your address.

• Starlink's help center says its default IPv4 setup uses CGNAT with 100.64.0.0/10 addresses and does not allow inbound traffic. A public IPv4 option is limited to its Priority plans, and Starlink provides native IPv6 with a /56 prefix on every plan. Its own Wi-Fi routers do not support port forwarding, so a third-party router is needed either way. Our guide to port forwarding on Starlink covers the options.
• T-Mobile Home Internet's support page says its gateways cannot change NAT type or enable port forwarding. Plan on outbound-only use unless you add a tunnel service.
• Other 5G and fixed wireless services, including Verizon 5G Home Internet, and smaller rural wireless providers are worth asking about directly, since address policies can differ by network.
• Cable and fiber providers more often assign a public IPv4 address to each home, but some use CGNAT in parts of their network. The WAN test above is the only way to know for sure.

Questions to ask a provider before you buy

If you plan to run self-hosted cameras, a game server, a home lab or a remote-access VPN, ask these before you sign up, and get the answers in writing or in chat:

• Does this plan give my router its own public IPv4 address, or is it shared through CGNAT?
• If it is CGNAT by default, can I opt out or request a public IPv4 address, and is there a monthly fee?
• Is a static IP available on residential service, or only on business plans?
• Do you provide native IPv6 with prefix delegation to my own router?
• Can your gateway run in bridge or passthrough mode so I can use my own router?

Security cameras that connect to a cloud app usually work fine behind CGNAT. If you are sizing a camera setup, see how much upload speed security cameras need.

What to do if you are already behind CGNAT

First, ask your provider for a public IPv4 address; some will switch you for free or for a small fee. If that is not an option, tunnel services work by having a device in your home open an outbound connection to a server that then accepts inbound traffic for you. Our guide to Cloudflare Tunnels for getting around CGNAT walks through one popular approach, and a VPN service with port forwarding is another. For devices that support it, IPv6 can avoid the problem entirely. For more on how address assignment works, see dynamic vs static IP addresses.

Rural and satellite homes

In rural areas, the choice is often among Starlink, Viasat and Hughesnet, so ask each one the questions above if inbound access matters to you. For most households that stream, work and use cloud cameras, the IP address policy will never come up. Confirm the current address policy and plan terms with each provider before ordering.

By RSINC. Address ranges come from IETF RFC 6598. Starlink and T-Mobile details reflect each company's support pages as checked on October 14, 2026. Provider address policies can change, so confirm at your address before you rely on inbound access.