KiwiVPN
Privacy & networking · 3 min

Carrier-Grade NAT and Shared Public IPs

Learn how carrier-grade NAT works, how to compare your router WAN IP with your public IP, and what CGNAT means for hosting, gaming, and remote access.

Carrier-grade Network Address Translation (CGNAT) is a system some internet providers use to let many customers share a smaller pool of public IPv4 addresses. It helps providers manage limited IPv4 availability, but it can complicate services that expect to accept incoming connections from the internet.

How CGNAT works

Your home router may give devices private addresses such as 192.168.1.20. Usually, the router shares one public address. With CGNAT, the ISP adds another translation layer: your router’s outward-facing WAN address may be private or shared, and the provider’s gateway translates traffic again before it reaches the public internet. A public IP lookup shows the address visible at the final outward edge, which may be shared with other customers.

Signs you may be behind CGNAT

  • The WAN/Internet address displayed by your router does not match the address shown by an external IP checker.
  • The router WAN address falls into a private range or the shared range 100.64.0.0/10 used for carrier-grade NAT.
  • Port forwarding appears configured correctly, but unsolicited inbound connections still cannot reach your home network.
  • Your provider confirms that residential service uses shared IPv4 addressing.

No single symptom is definitive in every network design, so compare the evidence and ask your provider.

What CGNAT can affect

Ordinary browsing, streaming, messaging, and most outgoing connections usually work normally. CGNAT can make it difficult to host a game server, access a home camera remotely, run a server, or use an application that depends on direct inbound IPv4 connections. Some apps work around this with relay servers or NAT traversal, so CGNAT does not mean every peer-to-peer app will fail.

Options if you need inbound access

  1. Ask the ISP whether a public IPv4 address is available, and whether it costs extra.
  2. Check whether your ISP supports native IPv6 and whether your application supports it securely.
  3. Consider a reputable overlay or remote-access VPN designed for private device-to-device connectivity.
  4. Use the application’s relay feature where available.
  5. Do not expose router administration or open random ports as a workaround.

A commercial VPN may change the public IP websites see, but it does not automatically make your home device reachable from outside. Some VPN providers offer port forwarding or dedicated addresses, but these features depend on the plan and carry their own security considerations.

Test your connection

Open the KiwiVPN public IP checker and compare its result with the WAN/Internet IP shown in your router. If they differ, record both values and ask your provider whether CGNAT is used. Share these details only with the provider or people helping troubleshoot; avoid publicly posting full network diagnostics.

Common questions

Is CGNAT unsafe?

CGNAT is a network architecture, not by itself evidence of a security problem. Its impact depends on the provider’s implementation and the services you need to use.

Can restarting my router remove CGNAT?

Usually not. If the provider places the connection behind CGNAT, rebooting typically does not remove that layer.

Can a VPN fix CGNAT?

A normal consumer VPN generally changes outbound routing rather than giving you inbound access to your home router. A remote-access or mesh VPN may solve a different connectivity need.

Read NAT explained, Static vs. dynamic IP, and Router security checklist.

Further reading

Browse all KiwiVPN guides or return to the public IP checker.