Sign inMonitor a domain
Network

Am I behind CGNAT? How to tell in two minutes

One comparison answers it: the address your router was given, and the address the internet sees.

By peekip editorialLast checked 5 Oct 20262 min read4 sources
On this page
Short answer

Open your router’s status page and note its WAN (internet) IP address. Then check your public IP. If the WAN address is in 100.64.0.0 to 100.127.255.255 (the shared space reserved for carrier-grade NAT), or in a private range such as 10.x, 172.16–31.x or 192.168.x, and it differs from your public IP, your ISP is sharing a public address between customers. That breaks inbound port forwarding but not normal browsing.

What CGNAT is

Carrier-grade NAT (CGNAT, or CGN) is your ISP doing what your home router already does, one level up: many customers share one public IPv4 address. Between your router and the ISP’s NAT, the ISP numbers links from the Shared Address Space, 100.64.0.0/10, which RFC 6598 reserved for exactly this.[1] Packets using that space “MUST NOT be forwarded across Service Provider boundaries”, so you will never see a website reachable at such an address.[1]

The two-minute test

  1. Find your router’s WAN address. Log in to the router (often at the address printed on its label) and open the status or internet page. Note the IPv4 address it received from your ISP. On some mobile and fixed-wireless gateways the page calls it “WAN IP” or “Internet IP”.
  2. Find your public address. Any what-is-my-IP page shows it; peekip’s home page does.
  3. Compare.
Router WAN addressPublic IPWhat it means
Same as your public IP—No CGNAT: your router has a public address
In 100.64.0.0 – 100.127.255.255DifferentCGNAT: the ISP’s shared address space[1]
In 10.x, 172.16–31.x or 192.168.xDifferentAnother NAT in front of you: CGNAT using private space, or a second router (double NAT)
Different, but itself publicDifferentSomething else rewrites your traffic: a VPN, proxy or work network

The IANA special-purpose registry lists 100.64.0.0/10 as Shared Address Space and the three private-use blocks from RFC 1918, all marked “not globally reachable”.[2]

Run it on yours

Run the CGNAT test

Type your router’s WAN address and we compare it with your public IP and the reserved ranges.

Run the CGNAT test

What CGNAT breaks, and what it doesn’t

  • Fine: browsing, streaming, video calls, most games. Outbound connections work normally.
  • Broken: inbound connections. Port forwarding on your router can’t work, because the shared public address belongs to the ISP’s NAT, not to you. Hosting a game server, remote access to a camera or a home server need another route.
  • Sometimes odd: sites see the same address for many customers, which can affect rate limits, CAPTCHAs and location.

The IETF’s requirements for carrier NATs acknowledge that they “introduce substantial limitations” and ask CGNs to support the Port Control Protocol, so applications can request mappings where an ISP enables it.[3]

What you can do

  1. Use IPv6. If your ISP gives you IPv6, inbound connections to IPv6 can work without NAT (subject to your router’s firewall).
  2. Ask your ISP for a public IPv4 address. Some offer it on request or for a fee.
  3. Use a tunnel or relay for the one service you need to reach from outside.

Apple’s guidance to site operators uses CGNAT as the comparison for iCloud Private Relay: many users behind one address.[4] That’s a good mental model: from the outside, your home looks like one of many behind the same door.

Sources

  1. RFC 6598: IANA-Reserved IPv4 Prefix for Shared Address Space (Apr 2012) · IETF / RFC EditorChecked 5 Oct 2026
  2. IANA IPv4 Special-Purpose Address Registry (updated 2025-10-09) · IANAChecked 5 Oct 2026
  3. RFC 6888: Common Requirements for Carrier-Grade NATs (Apr 2013, BCP 127) · IETF / RFC EditorChecked 5 Oct 2026
  4. Prepare your network or web server for iCloud Private Relay · Apple DeveloperChecked 5 Oct 2026