CGNAT: why you might share an IP with hundreds of strangers

Ever been blocked from a site you’ve never abused, or hit endless CAPTCHAs for no reason? There’s a decent chance you’re sharing your public IP with hundreds of strangers, and one of them misbehaved. That’s CGNAT — carrier-grade NAT — and most people on mobile data and many on newer fiber plans are behind it without knowing.

The five-minute check

Compare two numbers. First, the public IP this site shows you. Second, the WAN or ‘internet’ address shown in your router’s admin page. If they match, you have your own public IP. If they don’t — especially if the router shows an address starting with 100.64 through 100.127 — you’re behind CGNAT.

That 100.64.0.0/10 range is the giveaway. It’s reserved specifically for carrier-shared addressing, so seeing it means your provider put a second layer of address-sharing between you and the internet.

Why providers do this

IPv4 addresses ran out in 2011, and buying more costs real money — they trade at auction like a commodity. Sharing one public address across hundreds of customers is the economical fix. From the provider’s side it’s rational. From yours, it has teeth.

What breaks under CGNAT

Reputation is the big one: you inherit the behavior of everyone on your shared address. One spammer in the pool and the whole pool eats CAPTCHAs and blocks. Hosting anything — game servers, security cameras, remote desktop — breaks too, because inbound connections can’t find you through the carrier’s translation layer. Port forwarding on your own router does nothing; the blockage is upstream where you have no control.

Your options, in order

First, ask your provider for a public IP. Many will take you off CGNAT for free if you ask, or for a small monthly fee. This is the clean fix and people skip it because they assume it’s hard. It’s usually one support chat.

Second, if you just need to reach a device at home, a tunneling service (Tailscale and similar tools) punches through CGNAT without any provider involvement. Third, IPv6 sidesteps the whole problem — if both ends have it. And if you can’t tell whether you’re affected, the tool on our homepage plus your router’s status page answers it in five minutes.