What Is CGNAT and How Does It Affect Port Forwarding?

If you have followed every step of a port forwarding guide correctly — static local IP, correct forwarding rule, firewall allowed — and a port still never shows as reachable, Carrier-Grade NAT is one of the most common explanations, and it is not something you can fix from your own router.

How Home Internet Normally Works

Traditionally, an ISP assigns each customer's router a single public IPv4 address. Your router then performs its own NAT (Network Address Translation) to share that one public address among every device on your home network. Because you have a dedicated public IP, a port-forwarding rule on your router genuinely makes a service reachable from anywhere on the internet.

What Changes Under CGNAT

Carrier-Grade NAT adds another layer of address translation at the ISP itself, sharing a single public IP address across many different customers simultaneously. Your router still gets an IP address, but it is a private address from the ISP's internal range, not a true public one. Any port-forwarding rule you configure on your own router only affects traffic within the ISP's private network — it never reaches the actual public internet, because your router was never given a real public address to forward from in the first place.

Why ISPs Use CGNAT

The pool of available IPv4 addresses has been effectively exhausted for years, and CGNAT lets an ISP serve far more customers than it has public IPv4 addresses for. It is especially common on mobile/cellular data plans and is increasingly used on some residential fixed-line plans as well, particularly on budget tiers.

How to Tell If You Are Behind CGNAT

Compare the public IP address shown in your router's status page against the IP address detected by an external service like PortCheck. If they are different, your router is not holding a true public IP and you are very likely behind CGNAT. You can also check whether your router's WAN IP falls in the 100.64.0.0/10 range, which is specifically reserved for carrier-grade NAT deployments.

What You Can Do About It

• Ask your ISP for a dedicated public IP. Many providers offer this as a paid add-on, sometimes called a “static IP” option, specifically to opt out of CGNAT.
• Use a VPN service that supports port forwarding. You route traffic through the VPN provider's public IP instead of your ISP's, and the provider forwards the port to you over the VPN tunnel.
• Use a reverse tunnel service. Tools that establish an outbound connection from your network to a relay server with a public IP, then forward inbound traffic back through that tunnel, sidestep the need for any inbound port forwarding at all.
• Switch ISPs or plans if a dedicated IP is available on a different plan and having one is important for your use case.