What is CGNAT?

9 November 2026

Carrier-grade NAT (CGNAT) is a device in the provider's network that lets many subscribers reach the internet from one public IPv4 address. It tells their connections apart by port number and keeps a table it uses to return each reply to its owner. Mobile networks rely on it heavily, because they have far more devices than addresses.

Why it exists

An IPv4 address is 32 bits long, which caps the total at about 4.3 billion. The regional registries have run out of them, and the move to IPv6 is not finished, so many sites and networks still depend on IPv4.

An operator serving millions of phones does not hold a public address for each one. The practical answer is to give every subscriber an internal address. Their connections are then translated at the network edge onto a small set of public addresses. The basics of public and private addresses are in What is an IP address.

Some operators give the phone an IPv6 address only and translate IPv4 traffic at the network edge. Either way, the public IPv4 address that websites see is shared by many people.

How it works, step by step

1. Your phone gets an internal address from the operator, often from 100.64.0.0/10 or from the RFC 1918 private blocks.
2. An app on the phone opens a connection to a server on port 443, from a source port the system picks.
3. The first packet passes through the CGNAT device, which picks an unused public address and external port and records the mapping between inside and outside.
4. The device rewrites the packet's source address and port to the external ones and sends it on.
5. The server replies to the public address and external port. The device looks up its table and forwards the packet to your phone.
6. When a mapping stays idle for a set time, the device deletes it and the port goes back to the pool.

Part of the mapping table for two subscribers reaching the same server at the same moment might look like this:

inside             outside            destination
100.71.4.12:51034  203.0.113.7:20112  198.51.100.20:443
100.92.8.40:40211  203.0.113.7:20113  198.51.100.20:443

The server sees one address, 203.0.113.7, with two different ports. From the packets alone it has no way to tell that these are two different subscribers.

The 100.64.0.0/10 block

RFC 6598 reserved this block in 2012 as Shared Address Space for service providers. It holds 4,194,304 addresses and is mainly used to number the links between CGNAT devices and subscribers' routers.

The RFC keeps it separate from RFC 1918 private space. Your home router may already use 192.168.1.0/24 inside, so if the provider handed it an address from the same range the two routes would collide. Packets and routes for this block must not cross the provider's network boundary.

A home network behind CGNAT is translated twice. Your router maps the private address to the provider's internal one, and the provider maps that onto the public address.

What the standard requires of CGNAT devices

RFC 6888 collects the common requirements for these devices. Three matter most to someone using the internet:

• Paired addressing. By default, every connection from one internal address leaves from the same public address, whatever the protocol. A website therefore does not see your session jump between addresses.
• A port limit per subscriber. The device must support capping how many external ports one subscriber can hold, so an infected device cannot use up every port on the address.
• No logging of destinations. The RFC recommends that the device not log destination addresses and ports unless required for administrative reasons.

Side effects of sharing an address

RFC 6269 describes the problems that come with sharing an IPv4 address among subscribers. The main ones:

• A block hits everyone. If a site blocks an address because of one abusive subscriber, everyone sharing it is blocked too. The RFC concludes that penalising an address does not work when sharing is widespread. That is why sites find it hard to block a mobile address without hurting other users, a topic covered in IP reputation.
• Tracing abuse needs the port and the time. An address and a timestamp no longer identify a subscriber. The source port and an accurate time are also needed. Servers that want to trace abuse back to a person are therefore advised to log the source port.
• Incoming connections fail. A packet arriving unrequested from outside has no mapping, so the device drops it. Hosting a game server, or reaching a home camera from outside, does not work with port forwarding on your own router.
• Location follows the translator. A subscriber's location is estimated from where the translator's address appears, not from where the subscriber is. More in IP geolocation.
• Port exhaustion. An app that opens a very large number of connections can reach the subscriber's port limit, and new connections then fail until old mappings expire.

How to tell whether you are behind CGNAT

1. Open your router's status page and find the address of the external (WAN) interface.
2. Compare it with your public address as websites see it.
3. If the router's address falls in 100.64.0.0/10, that is 100.64.0.0 to 100.127.255.255, you are most likely behind CGNAT.
4. If it is in an RFC 1918 block and differs from your public address, the provider or a second router translates it again.

On mobile data it is enough to see that the address in the phone's settings differs from your public one. A traceroute also shows the internal hops:

tracert -d 9.9.9.9      # Windows
traceroute -n 9.9.9.9   # Linux, macOS

Addresses from 100.64.0.0/10 in the first few hops are a sign of the provider's internal network.

If you need incoming connections

• Ask for a public address. Some providers give a public or static address on request, sometimes for an extra fee.
• Use IPv6 if offered. Each device gets a public address without translation and can be reached once the firewall allows it.
• Reverse the direction. Your device connects out to an intermediary with a public address, and others reach you through it. This is how reverse tunnels work, along with VPN services that offer port forwarding.

syriaproxy and CGNAT

With syriaproxy, your traffic leaves from real mobile addresses on Syriatel's 4G network inside Syria. Many Syriatel subscribers share them at the same time behind CGNAT. The same address stays for about two hours before Syriatel changes it, and you can request a new one from your account at any time.

How these addresses differ from server addresses is covered in Mobile vs datacenter IPs.

FAQ

Compare your public IP with your router's address to see whether your provider puts you behind CGNAT.