What is CGNAT and why do I share an IP address?
Carrier-grade NAT shares one public IPv4 address between customers. Check if you are behind CGNAT and why it blocks port forwarding and game servers.
Address sharing at the provider
IPv4 has about 4.3 billion addresses, far fewer than the devices online. Many mobile and broadband providers therefore use carrier-grade NAT (CGNAT): your router receives an address from the provider’s shared range, and the provider translates many customers to a smaller pool of public addresses.
With CGNAT, the public IP that IPNIXA shows may be used by hundreds of other customers at the same moment. Mobile data connections almost always work this way.
Each customer is told apart by port numbers: the provider’s translator gives your connections a set of ports on the shared address and keeps a record of which customer used which address and port at which time.
How to recognize it
Compare the WAN or Internet address on your router’s status page with the public address shown by IPNIXA. If they differ, or if the router address falls in 100.64.0.0/10, your traffic passes through an additional translation layer.
The network organization in your result will still be your provider. CGNAT does not change the country, but it can make city-level location less precise because the shared gateway may serve a wide region.
| Symptom | Likely cause |
|---|---|
| Port forwarding rules have no effect from outside | CGNAT or double NAT |
| Game console reports a strict or type 3 NAT | CGNAT or double NAT |
| Security cameras or NAS only work through the vendor’s cloud app | Incoming connections cannot reach your router |
| More CAPTCHAs or temporary blocks on some websites | A shared address with a poor reputation from other users |
Step-by-step: check whether you are behind CGNAT
This takes about five minutes and needs access to your router’s administration page.
- Open the IPNIXA gaming page, which shows your public IPv4 address and has a CGNAT check.
- Sign in to your router (often http://192.168.0.1 or http://192.168.1.1) and open the status, internet or WAN page.
- Copy the WAN IPv4 address into the CGNAT check and select Compare. IPNIXA explains the result; the address you enter stays on the page. You can also compare by hand:
- If it is between 100.64.0.0 and 100.127.255.255, you are behind CGNAT.
- If it is another private address (10.x, 172.16–31.x or 192.168.x), there is a second router or the provider uses a private range — this is double NAT.
- If it matches your public IPv4 address exactly, you have your own public address and CGNAT is not involved.
- Optional: run tracert 1.1.1.1 on Windows or traceroute 1.1.1.1 on macOS/Linux. A 100.64–100.127 address in the first few hops is another strong sign.
What it changes for you
Incoming connections cannot reach your home network directly, so port forwarding for game servers, cameras or remote desktop does not work. Peer-to-peer applications may fall back to relays and become slower.
Because an address is shared, the actions of other customers can affect you: a website may show more security challenges or block the address after abuse from someone else. Rate limits keyed on IP addresses, including the one IPNIXA uses, are set generously for this reason.
Ordinary browsing, streaming, video calls and most online games work normally behind CGNAT, because they start connections from your side.
Hosting a game server behind CGNAT
Minecraft, Valheim, Terraria, Palworld and most other games that let you host a server need friends to connect to your public IPv4 address and the game’s port. Behind CGNAT that address belongs to your provider’s translator, so their connection attempts never reach your router, however the port forwarding is set up.
The IPNIXA gaming page builds the address to share, such as 203.0.113.25:25565 for Minecraft: Java Edition, and lists the protocol to forward. If friends still cannot join after forwarding, the CGNAT check tells you whether the problem is at your provider (CGNAT), a second router (double NAT) or your own settings.
Ways around it
Many providers offer a public IPv4 address on request or for a fee. IPv6 avoids the problem entirely when both your network and the remote service support it, because each customer receives a global prefix.
For remote access, a VPN or tunnel service that makes an outgoing connection from your home network works through CGNAT. Ask your provider which options they support before changing equipment.
- Ask your provider for a public (sometimes called “real” or dedicated) IPv4 address.
- Enable IPv6 on your router and use it for remote access where the other side supports IPv6.
- Use a mesh VPN or a tunnel service that connects outwards from your network.
- For game consoles, enable UPnP only if your provider gives you a public address; it cannot open ports through CGNAT.
Frequently asked questions
Is CGNAT bad?
Not for everyday use. It lets providers keep connecting customers despite the IPv4 shortage. It mainly affects people who want to host services, forward ports or connect into their home network from outside.
Does CGNAT make me anonymous?
No. Websites see a shared address, but providers record which customer used which address and port at what time, and those records can be disclosed under legal process.
Will IPv6 solve CGNAT problems?
For services reachable over IPv6, yes: each customer receives globally routable addresses. You still need firewall rules to allow the incoming connections you want, and the remote side must support IPv6.
Why can’t my friends join my Minecraft server?
Check three things in order: the server is running and allowed through your PC’s firewall, the game’s port is forwarded to that PC, and your router’s WAN address matches your public IPv4 address. If the WAN address is in 100.64.0.0/10 or differs from your public IP, CGNAT or double NAT is blocking incoming connections.
Does a regular VPN get around CGNAT?
A typical consumer VPN changes your outgoing address but does not accept incoming connections for you. Tunnel and mesh VPN services designed for remote access do work through CGNAT.