How to Tell if You Are Behind CGNAT (and What It Means for Servers)

You are behind CGNAT (carrier grade NAT) if the WAN IP on your router's status page is different from the IP a "what is my IP" site shows, or if the WAN IP falls in 100.64.0.0 to 100.127.255.255. CGNAT means your ISP shares one public IPv4 address between many customers, so incoming connections never reach your router and port forwarding for a game server cannot work, no matter what you set. The fixes are to get a public IP from your ISP, use IPv6, use a tunnel, or host the server somewhere else.

What CGNAT actually is

Your router already does NAT: it shares one public address between every device in your home. With CGNAT, your ISP adds a second, much bigger layer of NAT on its side. Your router gets a private address from the ISP, and hundreds or thousands of homes share a pool of real public addresses.

Outgoing traffic works fine, which is why browsing, streaming and joining other people's servers feel normal. The problem is incoming traffic. When a friend tries to join your game server, their packet hits the ISP's shared address. The ISP has no rule telling it which of its customers should receive it, so it drops it. You cannot add a rule there, because you do not control that equipment.

ISPs use it because IPv4 addresses ran out. It is standard on mobile networks and very common on:

5G and LTE home internet (T-Mobile, Verizon 5G Home, AT&T Internet Air)
Satellite (Starlink residential plans)
Fixed wireless and many rural ISPs
Some fiber and cable providers, especially newer or smaller ones and outside the US

Test 1: compare WAN IP with your public IP

Sign in to your router and find the status or internet page. It shows a WAN IP, Internet IP or Broadband IP.
On any device at home, search "what is my IP" and note the address.

If both addresses match, you have a real public IP and port forwarding can work. If they are different, something between your router and the internet is doing NAT. That is either CGNAT or a second router in your own home (double NAT).

Test 2: check the address range

Look at the WAN IP from Test 1.

WAN IP starts with	What it means
`100.64.` to `100.127.`	Reserved for CGNAT. You are behind carrier NAT.
`192.168.`, `10.`, `172.16.` to `172.31.`	Private range. Usually another router in your house (double NAT), but some ISPs use these for CGNAT too.
Anything else, matching "what is my IP"	Public IP. No CGNAT.

If it is a private range, check whether there is a modem router between your router and the wall. If there is, you likely have double NAT rather than CGNAT, and that one you can fix yourself.

Test 3: tracert to your public IP

When the router app hides the WAN IP, use a traceroute from a PC:

tracert 8.8.8.8

On Linux or macOS use traceroute 8.8.8.8. Look at the first few hops. Hop 1 is your router. If hop 2 or 3 shows an address in 100.64.x.x to 100.127.x.x, your ISP is running CGNAT.

You can also run tracert against your own public IP from "what is my IP". If you have a real public address it resolves in one or two hops. Behind CGNAT it wanders through several ISP hops first.

Test 4: ask your ISP

Call or chat with support and ask: "Is my connection behind CGNAT, and can I get a public IPv4 address?" The words "public IPv4" and "CGNAT" usually get you to the right answer quickly. Front line agents sometimes confuse it with a static IP, so be specific: you do not need a static address, you need a public one.

What you can do about it

Ask for a public IPv4 address. Some ISPs move you off CGNAT for free on request, especially fiber and cable providers that only use it for part of their customers. Others charge a monthly fee or only offer it on business plans. Once you have a public IP, normal port forwarding works.

Use IPv6. Many CGNAT connections give every device a real IPv6 address. If the game supports IPv6 and your friends have IPv6 too, they can connect directly after you open the port in your router's IPv6 firewall. In practice, a lot of players still lack IPv6, and some games do not listen on it. See hosting a game server over IPv6.

Use a tunnel. A tunnel agent on your PC connects out to a relay service, which gives you a public address. playit.gg is built for game servers and handles both TCP and UDP. The downside is extra latency through the relay. Our playit.gg setup guide walks through it.

Use a virtual LAN. Tailscale, ZeroTier and similar tools let a small group connect as if they were on one network, punching through CGNAT in most cases. Every player installs the app. See Tailscale for game servers.

Host outside your home. A VPS or a game server host has public addresses and open ports, and your connection type stops mattering.

Things that do not work behind CGNAT

People lose whole evenings to these:

DMZ on your router. It forwards all ports to one PC, but traffic still never reaches the router.
UPnP. It talks to your own router only, so it opens nothing on the ISP's NAT.
Bridge mode on your modem. Your own router just inherits the same CGNAT address.
DDNS. It points a name at the shared address, which still drops incoming traffic.
Changing the server's port. The ISP's NAT drops everything inbound, not specific ports.

Gameplay from Minecraft: Java Edition

The path with no ISP in the way

If your ISP will not give you a public IP, the most reliable option is a server that does not live behind your connection at all. A GamezServers server has its own address and the game ports open as soon as it goes live, about a minute after checkout for most games. Your friends connect straight to it, your home IP stays private, and you can run a Minecraft server or any of the other games on the games page without caring what kind of internet you have.

FAQ

Can I port forward with CGNAT?

No. The forward on your router works, but the ISP's NAT in front of it drops incoming connections before they arrive. You need a public IP, a tunnel, or a server hosted elsewhere.

Is CGNAT bad for online gaming?

For playing on other people's servers it is mostly fine. It can cause strict or moderate NAT types on consoles and breaks hosting, peer to peer voice and some co-op games.

How much does it cost to get out of CGNAT?

It depends entirely on the ISP. Some do it free on request, some charge a monthly fee for a public or static IP, and some mobile and satellite ISPs only offer it on business plans.

Does a VPN fix CGNAT?

A normal privacy VPN does not, because it only handles outgoing traffic. A VPN or tunnel service that offers port forwarding or a reachable address does, at the cost of extra latency.