- CGNAT is a technology that shares the same public IP address among several users to alleviate the lack of IPv4 addresses.
- It causes critical problems such as the inability to open ports, strict NAT on consoles, and failures in remote access to home servers.
- The main solution is to request a direct public IP address from the operator, although there are technical alternatives such as tunnels or VPNs.
You want to set up a game server, access your cameras remotely, or connect to your NAS, but no port forwarding rule is working. The router might be fine; the problem could be the... CGNA used by your carrier.
This technology often goes unnoticed when browsing, using social media, or watching streaming content. The limitations appear when You need to receive connections initiated from the internet.because your line does not have a unique public IPv4 address.
What is CGNAT and why is it used?
IPv4 offers approximately 4.300 billion addresses, an insufficient number for all connected devices. Regional registries exhausted their main pools of new addresses years ago, so operators are resorting to various techniques to utilize existing ones.
El Carrier-Grade NAT or CGNAT It allows multiple clients to share the same public IPv4 address. Instead of assigning a public IP directly to each router, the operator introduces a second layer of address translation within its own network.
The process is similar to the NAT already performed by your home router, but on a larger scale. Home devices share the router's address, and with CGNAT, multiple routers also share the ISP's public address. Outgoing traffic functions normally, but unsolicited incoming connections don't know which client to route to.
What problems can sharing an IP address cause?
The main drawback is that Opening a port on the router is not enough.The connection is stopped at the operator's infrastructure before reaching your network, so you cannot directly publish a web server, a personal VPN, or certain self-hosted services using IPv4.
A NAS, Plex, or home automation system will continue to function within the local network. What might fail is direct access from outside the network, unless the application uses its own intermediary servers or some other indirect connection method.
In video games and P2P applications, CGNAT can cause restrictive NAT and make it difficult for you to act as a host. This can affect matchmaking or voice chat, though it depends on the game and the intermediary mechanisms it uses.
The commercial VPNs you install for browsing usually work because the connection originates from home. The problem arises when you want to Host your own VPN server and connect to it from the outside.
How to know if you're behind CGNAT
The most useful method is to compare the router's WAN IPv4 address with the IPv4 address visible on the internet. Access the router's control panel, which is usually located at 192.168.1.1 o 192.168.0.1, and look for the WAN connection information.
Then, use a service like whatismyip.com to check your connection's public IP addressMake sure to compare IPv4 addresses, as some pages may display an IPv6 address first.
If your router's WAN IPv4 address is public and matches the one displayed on the website, you're usually not under CGNAT. If they're different, there's an additional layer of NAT, although it could also be a second router installed in your home.
The clearest clue is that the WAN address is located between 100.64.0.0 y 100.127.255.255This block, called 100.64.0.0/10This is reserved for shared operator networks. If in doubt, your carrier should provide final confirmation.
How to request to leave the CGNAT
The most direct solution is to contact customer service and specifically request exit CGNAT and receive a dynamic public IPv4 addressIt is not necessary to contract a static IP: a dynamic public address allows you to open ports, although it may change over time.
The conditions depend on each operator and may be modified:
- DIGI: officially offers Plus ConnectionA dedicated IPv4 address for €1 per month. Activation is available through My DIGI or by contacting customer support.
- MásMóvil: indicates in its help page Users who need a public IP address should contact customer support, but no specific timeframe is publicly guaranteed.
- Vodafone: It states that most of its fiber connections receive a dynamic public IPv4 address. Even so, it's advisable to check each line individually, as the configuration may depend on the access type.
It's not advisable to rely on old lists for other providers, as policies can vary depending on the tariff, coverage, and network used. It's best to check your router's WAN settings first and consult the current terms and conditions.
Once the operator confirms the change, restart the router to renew the connection. Then, re-compare the two IPv4 addresses before configuring port forwarding.
Alternatives if you can't leave the CGNAT
One possibility is to use Tailscale or ZeroTierThese tools create a private network between your devices and allow you to access a NAS, a home server, or a computer without directly publishing ports on the internet.
To expose a website or an API, you can use Cloudflare Tunnel or ngrokIts connectors initiate an outbound connection to the tunnel provider, so they work even if the line is behind CGNAT. Depending on the service and its features, some uses may require a paid plan.
Another option is to use a VPN that offers port forwarding or a dedicated IP address. Not all VPNs include both features, so you should check the terms and conditions before paying.
In any of these cases, protect access through authentication, encryption, and updates. Leaving CGNAT or creating a tunnel does not automatically make a service secure.
Will IPv6 end CGNAT?
IPv6 uses 128-bit addresses and has around 3,4 × 1038 combinations. This allows assigning global addresses without sharing a single IPv4 address among numerous clients.
However, having IPv6 alone does not guarantee remote access. The service, the device you're connecting from, and both networks must be compatible, and the router's firewall must allow the connection. IPv6 is also not inherently more secure than IPv4; it still requires proper configuration.
In short, to exit CGNAT you must first confirm that your router is not receiving a public IPv4 address and check your ISP's options. If they cannot assign you one, private overlay networks and tunnels offer a practical alternative for regaining remote access without opening ports.
I am a technology enthusiast who has turned his "geek" interests into a profession. I have spent more than 10 years of my life using cutting-edge technology and tinkering with all kinds of programs out of pure curiosity. Now I have specialized in computer technology and video games. This is because for more than 5 years I have been writing for various websites on technology and video games, creating articles that seek to give you the information you need in a language that is understandable to everyone.
If you have any questions, my knowledge ranges from everything related to the Windows operating system as well as Android for mobile phones. And my commitment is to you, I am always willing to spend a few minutes and help you resolve any questions you may have in this internet world.