CompareInternet is independent and reader-supported. When you buy through links on this page we may earn a commission from Amazon or eBay at no extra cost to you. We don't accept payment for placement, and we don't publish made-up speeds, test scores or prices — tiers ($ to $$$) show relative cost only. Provider plans and pricing change often; always confirm on the provider's site.
Every device on the internet needs an address. There aren't enough IPv4 addresses for everyone, so many providers, especially 5G home internet, satellite and some fiber and cable ISPs, share one public IPv4 address among many customers. That's carrier-grade NAT (CGNAT).
For browsing, streaming and most gaming, you'll never notice it. But it breaks anything that needs incoming connections: port forwarding for game servers, remote access to a home NAS or cameras, self-hosted services and some peer-to-peer apps. This guide explains how to tell if you're behind CGNAT and the practical ways around it.
How CGNAT works
At home, your router already uses NAT: all your devices share your router's single public address. With CGNAT, your router's address is also private, and your provider translates it again, sharing one public address among many customers. That's two layers of NAT.
Port forwarding on your router only opens ports on the inner layer. The provider's CGNAT layer still blocks unsolicited incoming traffic, and you can't configure it.
Are you behind CGNAT?
- Look up your router's WAN (internet) IP address in its admin page.
- Look up your public IP by searching "what is my IP" from a device on your network.
- If they're different, you're behind another layer of NAT. If the router's WAN address starts with 100.64–100.127 (the range reserved for CGNAT), 10., 172.16–31. or 192.168., you're behind CGNAT or double NAT.
Many 5G home internet services and Starlink residential plans use CGNAT for IPv4. Some cable and fiber providers do too, especially newer ones.
What breaks, and what doesn't
| Works normally | Can break |
|---|---|
| Browsing, streaming, video calls | Port forwarding and hosting game servers |
| Most online gaming as a client | Some consoles' NAT type (strict/moderate) |
| Cloud-connected cameras and smart home devices | Direct remote access to a NAS, cameras or Plex (without relays) |
| VPN apps that connect out | Hosting a VPN server at home |
Workarounds that actually work
1. Use IPv6
Many CGNAT providers also give you native IPv6, where every device can have a globally reachable address. Services that support IPv6 can accept incoming connections if you allow them in your router's IPv6 firewall. The catch: the client connecting in also needs IPv6.
2. Mesh VPNs (Tailscale, ZeroTier)
Tools like Tailscale create private networks between your devices by connecting outward, which CGNAT allows. You can reach your NAS, cameras or home PC from anywhere without port forwarding. For personal remote access, this is the easiest fix. Tailscale's free personal plan covers most home uses.
3. Cloudflare Tunnel
For publishing a web service (a personal website, a Home Assistant dashboard) to the internet, Cloudflare Tunnel runs a small connector at home that connects out to Cloudflare, which then serves your site publicly. No open ports are needed.
4. A cheap VPS relay
A small rented cloud server with a public IP can relay traffic to your home through a WireGuard tunnel. This works for game servers and anything that needs raw ports. It's more technical, but very flexible.
5. Ask for a public IP
Some providers offer a public or static IPv4 address as a paid add-on or on business plans. Ask. It's the simplest fix if it's available.
Gaming on CGNAT
Most online games work fine, because you connect out to game servers. Problems come with peer-to-peer matchmaking, hosting lobbies and some voice chat, which can produce "strict NAT" warnings. Turn on UPnP on your router (it helps the inner NAT layer), use wired connections, and if you still have trouble, a VPS relay or your provider's public IP option can resolve it. See best gaming routers.
Is double NAT the same as CGNAT?
Not quite. Double NAT at home happens when you have two routers doing NAT, for example an ISP gateway plus your own router. You can fix that yourself by putting the ISP gateway into bridge or passthrough mode. CGNAT happens inside your provider's network, and you can't fix it on your end. Check which one you have before troubleshooting. See ISP router vs your own.
Which workaround should you pick?
- Remote access to your own devices (NAS, cameras, home PC): Tailscale or a similar mesh VPN. It's the easiest and most secure.
- Publishing a website or dashboard: Cloudflare Tunnel.
- Hosting a game server for friends: a VPS relay with WireGuard, or a public IP add-on from your ISP.
- Everything, with no fuss: ask your ISP about a public or static IPv4 option, or consider a provider that doesn't use CGNAT.
IPv6 is the long-term answer
CGNAT exists because IPv4 addresses ran out. IPv6 has so many addresses that every device can have its own. As more websites, services and apps support IPv6, CGNAT matters less. Make sure IPv6 is enabled on your router if your provider offers it, and keep your router's IPv6 firewall on. It allows outbound connections and blocks unsolicited inbound ones unless you open them deliberately.
Gear for working around CGNAT
1. GL.iNet Flint 2 (GL-MT6000)
$$Best for: Running Tailscale or WireGuard at the router
GL.iNet's firmware includes WireGuard and Tailscale support, so the whole home network can reach, and be reached through, a mesh VPN or relay.
What we like
- Tailscale and WireGuard built in
- Powerful, flexible OpenWrt base
Watch out for
- Technical
2. Raspberry Pi 5 starter kit
$$Best for: Running a Tailscale subnet router or Cloudflare Tunnel
A low-power Raspberry Pi can run Tailscale as a subnet router, a Cloudflare Tunnel connector or a WireGuard client to a VPS, giving remote access to your whole network behind CGNAT.
What we like
- Low power, always on
- Runs Tailscale or Cloudflare Tunnel
Watch out for
- Some Linux setup required
3. Ubiquiti UniFi Cloud Gateway Ultra
$$Best for: UniFi users wanting built-in remote access
UniFi gateways include remote management and VPN features (such as Teleport) designed to work without traditional port forwarding.
What we like
- Remote access features built in
- Polished app
Watch out for
- No built-in Wi-Fi
Frequently asked questions
What is CGNAT?
Carrier-grade NAT: your provider shares one public IPv4 address among many customers, which blocks incoming connections like port forwarding.
Does Starlink use CGNAT?
Starlink residential service uses CGNAT for IPv4 and provides IPv6. Check Starlink's current plan terms for public IP options.
Can I port forward on T-Mobile or Verizon 5G home internet?
Usually not for IPv4, because of CGNAT. Use IPv6, a mesh VPN like Tailscale, Cloudflare Tunnel or a VPS relay instead.
How do I know if I'm behind CGNAT?
Compare your router's WAN IP with your public IP. A WAN address in the 100.64–100.127 range indicates CGNAT.
Does CGNAT affect gaming?
Most online gaming works. Hosting lobbies and some peer-to-peer features can cause strict NAT problems.
CGNAT troubleshooting before you pay for an upgrade
Carrier-grade NAT means multiple customers can share a public IPv4 address. That can complicate unsolicited inbound connections, including some self-hosted services, even when speed tests look normal.
Check the WAN IP shown in your router against the public address reported by a reputable IP-checking tool, but remember that IPv6, provider gateways, double NAT and mobile networks can change the diagnosis. Ask your provider whether it offers a public IPv4 address or supported IPv6 connectivity.
What to check before deciding
- Identify which application needs inbound access and whether an outbound tunnel or cloud relay can work instead.
- Check for double NAT from two routers before assuming the provider uses CGNAT.
- Confirm cost and availability of a public/static IP or supported IPv6 before changing service.
Continue reading: Internet connection types · Choosing a plan