Carrier-grade NAT, often shortened to CGNAT, lets an internet provider share a limited pool of public IPv4 addresses among many customers. It is common on mobile, wireless and budget broadband networks and can explain why ordinary port forwarding does not work.
How to recognize it
Compare the public IP shown by a website with the WAN address in your router. If they differ and the router shows a shared range such as 100.64.0.0/10, the provider is probably translating traffic again upstream. Some providers use other internal ranges.
Everyday browsing still works
Outbound web, messaging and streaming connections normally work because the carrier keeps translation state. Problems appear when someone on the internet must start a connection toward your home, as with self-hosted servers, certain games or direct camera access.
Options for inbound access
Ask the provider whether it offers a public or static IP. IPv6 may provide direct addressing when both sides support it, protected by firewall rules. Mesh VPNs and outbound tunnels can also connect devices without exposing a public listening port.
Logs and identification
Many customers can appear behind the same public address, so the address alone identifies neither a household nor a device. Providers use timestamps and source ports to distinguish sessions. This is one reason IP evidence must be interpreted cautiously.
Practical checklist
- Compare the router WAN address with an external checker.
- Ask the provider about public IPv4 and IPv6 options.
- Prefer outbound secure tunnels for remote administration.
- Include timestamps and ports when reporting network abuse.
Keep the result in context
Network tools provide useful evidence, not a complete identity or security verdict. Record what you tested, compare results before and after a change, and use several independent signals when a decision matters.
Browse all 25 KiwiVPN guides or return to the public IP checker.