How to Self-Host Behind CGNAT — Bypass Carrier-Grade NAT

If your internet service provider (ISP) sits you behind carrier-grade NAT (CGNAT), you can't host anything at home. Game servers don't accept connections. Self-hosted email goes nowhere. Home Assistant is unreachable from outside the house. This guide explains what CGNAT is, how to check if you're stuck behind it, which ISPs use it, and most importantly, how to get a real public IP address so you can actually host what you want to host.

What is CGNAT? (Plain English)

Carrier-grade NAT (CGNAT) also called CGN or large-scale NAT (LSN) is a way for your ISP to share a single public IPv4 address among hundreds or thousands of customers. Your home router already performs NAT (translating your devices' private addresses to the public address assigned to your line). CGNAT adds a second translation on top: your ISP takes what looks like a public IP on your router and translates it again to their shared public IP before it reaches the internet.

The result for you is that you don't actually have a public IP of your own. You have a share of one. CGNAT is invisible for everyday browsing, streaming, or video calls, your outbound connections still work; but it breaks any service that relies on other people reaching you: self-hosted websites, email, VoIP, game servers, Minecraft servers, remote desktop, Home Assistant remote access, and so on.

Why ISPs use CGNAT

The IPv4 address space, about 4.3 billion unique addresses total, was fully allocated years ago. Rather than push every customer to IPv6 (which many services and apps still handle poorly), ISPs increasingly reuse a small pool of public IPv4 addresses across customers using CGNAT. It's cheap, invisible to most subscribers, and lets them keep adding new customers without buying IPv4 blocks on the secondary market where prices have climbed to $40+ per address. RFC 6598 reserved the 100.64.0.0/10 address range specifically for this purpose.

How does Network Address Translation (NAT) work?

Network Address Translation (NAT) is a fundamental networking technique that enables multiple devices on a private network to share a single public IP address when accessing the internet. NAT acts as an intermediary between your local network and the broader internet, translating private IP addresses (like 192.168.1.100) into public IP addresses that can be routed across the internet. It has become essential in modern networking because of the limited availability of IPv4 addresses and the need for network security. By implementing NAT, organizations and home users can conserve public IP addresses while maintaining connectivity for many devices simultaneously.

The primary function of NAT is maintaining a translation table that maps internal private IP addresses and port numbers to external public IP addresses and ports. When a device on your private network initiates an outbound connection, the NAT device (typically a router or firewall) replaces the source IP address and port with its own public IP address and an available port number. This process ensures that return traffic can be properly routed back to the originating device. NAT operates at the network layer (Layer 3) of the OSI model and is transparent to end users, meaning devices on the internal network can communicate with external resources without requiring individual public IP addresses.

What happens when device A connects to a website

1. Device A sends a packet (192.168.1.100:12345 → 203.0.113.10:80)
2. The router translates the packet to (202.88.69.1:7771 → 203.0.113.10:80) and records an entry in its NAT table
3. The web server receives a packet from 202.88.69.1:7771

The reply flow from website to device A

1. Website responds (203.0.113.10:80 → 202.88.69.1:7771)
2. The router uses the NAT table to translate the packet (203.0.113.10:80 → 192.168.1.100:12345)
3. Device A receives the response

How does carrier-grade NAT (CGNAT) work?

Carrier-grade NAT works the same way as your home or office NAT, the end result is simply two layers of NAT between your devices and the internet. It lets multiple ISP subscribers share a single public IP address, which saves the number of public IP addresses needed for all users on the internet and allows the internet to keep growing on a limited pool of IPv4 addresses.

What happens when subscriber B's device B connects to a website

1. Device B sends a packet (192.168.1.101:54321 → 203.0.113.10:80)
2. The home / office router translates the packet (172.22.0.102:8881 → 172.22.0.1:8881) and maintains its own NAT table
3. The ISP then translates the packet again (202.88.69.1:6666 → 203.0.113.10:80) and maintains a separate NAT table
4. The web server receives the packet from 202.88.69.1:6666

The reply flow from the website

1. Website responds (203.0.113.10:80 → 202.88.69.1:6666)
2. The ISP router uses the NAT table to translate the packet (203.0.113.10:80 → 172.22.0.102:8881)
3. Your home / office router uses its NAT table to translate the packet (172.22.0.1:8881 → 192.168.1.101:54321)
4. Subscriber B's device B receives the response

The CGNAT IP address range (100.64.0.0/10)

CGNAT uses a reserved IPv4 range defined in RFC 6598: 100.64.0.0 to 100.127.255.255, written in CIDR notation as 100.64.0.0/10. That's roughly 4 million addresses, enough for an ISP to stand up a large customer base without conflicting with any public internet address or the private RFC 1918 ranges (10.x.x.x, 172.16–31.x.x, 192.168.x.x) that home routers use.

The practical signal: if your router's WAN interface shows an address starting with 100.64. through 100.127., your ISP is using CGNAT. You can check this in your router's admin panel (usually under "WAN" or "Status → Internet") or from a computer on the LAN by visiting the router's admin page.

Not every CGNAT deployment uses this range, some ISPs deploy CGNAT on other unallocated blocks, but 100.64.0.0/10 is the standard and the most common signal.

How to check if you're behind CGNAT

Three quick tests. Any one of them confirms CGNAT.

1. Compare your router's WAN IP to your real public IP

Log into your router's admin panel and note the WAN / public IP it reports. Then, from any device on your network, run one of these commands to see what the internet actually sees you as:

curl https://api.getpublicip.com/ip
# or
wget -O- https://api.getpublicip.com/ip

If the two IPs don't match, you're behind CGNAT (or some other kind of upstream translation). See our full guide to finding your public IP on Linux for more commands and alternatives.

2. Check for a 100.64.x.x address on your router's WAN

If your router's WAN interface shows an address in the range 100.64.0.0 - 100.127.255.255, that's the reserved CGNAT range, your ISP is definitely using CGNAT.

3. Try to open a port from the outside

Pick an unused port (say, 8080), forward it on your router to a test service, and try to connect from a phone on mobile data or from a friend's network. If the connection times out and everything in your setup looks correct, CGNAT at the ISP level is the likely cause. You can also call your ISP and ask directly: Am I on CGNAT? Can I get a public IPv4 address on my plan?

Which ISPs use CGNAT?

CGNAT is most common on mobile networks (4G / 5G) and increasingly on fibre broadband in markets where IPv4 is scarce. The list below is not exhaustive, and individual plans or customer cohorts within an ISP may differ, use the three checks above to confirm your own situation.

If your ISP isn't listed, don't assume you're in the clear. Some ISPs offer a static IP add-on as a paid upgrade that takes you out of the CGNAT pool, if that's not an option, read on.

CGNAT vs static IP vs Cloudflare Tunnel vs GetPublicIP

Four realistic ways to get inbound connectivity at home despite CGNAT. Each has trade-offs.

ISP static IP

Ask your ISP. Some offer it for an extra monthly fee, usually on business plans only. You get a real, dedicated public IPv4. Downsides: residential-IP blocks often have poor mail sender reputation (which breaks email hosting), you lose the IP if you move house, and there's no failover if your line goes down. Our full walkthrough: how to get a static IP address.

Cloudflare Tunnel

Free and works, for HTTP(S) only. Cloudflare reverse-proxies your traffic through their edge, so SSL/TLS is terminated on Cloudflare's servers. That's a dealbreaker if you need true end-to-end encryption or you're hosting anything beyond web services (email, game servers, VoIP, SSH over a custom port, etc.). See our detailed comparison: GetPublicIP vs Cloudflare Tunnel vs Tailscale.

Tailscale / mesh VPN

Great if the only people connecting to your server are you and a small circle you can invite onto the VPN. Not suitable for anything that needs to be reachable on the open internet, your services aren't visible to non-members.

GetPublicIP

A dedicated public IPv4 hosted on our edge infrastructure, routed to your server via a WireGuard tunnel. Your server initiates an outbound connection to us (which CGNAT allows), and all inbound traffic for your public IP flows back through that tunnel. SSL/TLS is end-to-end encrypted, we never see your plaintext. Works for any protocol. Portable across locations. Built-in failover.

How does GetPublicIP work?

GetPublicIP delivers a public IP address over an encrypted WireGuard VPN tunnel to your server in your home or office. This solution overcomes carrier-grade NAT and lets you relocate your server to another location without needing to change your IP address, unlike ISP static IP addresses, which are tied to the physical line.

How it works

• Your server connects to the GetPublicIP server. This outbound connection sets the NAT tables between your server and GetPublicIP's server and creates a path for communication something CGNAT allows without issue.
• When remote clients connect to your public IP address, the packets are sent through the encrypted VPN tunnel to your server.
• The SSL / TLS connection between the client and your server is end-to-end encrypted with your own SSL certificates. It starts at the client and ends at your server, we never see the plaintext.

Ready to try it? Create an account or start with the getting-started guide.

Frequently Asked Questions