Why Now Daily.

Published

Carrier-Grade NAT: Why Many Customers Share an IP Address

Carrier-grade NAT, or CGNAT, lets an internet provider share one public IPv4 address among multiple customers. The provider translates each outbound connection using addresses and ports, often adding a second NAT layer outside the customer's router. It conserves scarce IPv4 space, but unsolicited inbound…

Timeline

  1. 2011-06-01: IETF RFC 6269 documented operational and application effects of sharing public IPv4 addresses.
  2. 2012-04-01: IETF RFC 6598 reserved 100.64.0.0/10 as Shared Address Space for service-provider NAT deployments.
  3. 2013-04-01: IETF RFC 6888 published common requirements for carrier-grade NAT devices.
  4. 2026-10-12: The standards and current deployment guidance were reviewed for this guide.

Carrier-grade NAT, also called CGN or CGNAT, is network address translation operated by an internet provider. It allows several subscribers to make outbound IPv4 connections through one public IPv4 address. A customer's home router may already translate private household addresses, and the provider then performs another translation upstream. That creates two NAT layers for many connections. The term describes where the translation occurs and who operates it; it is not a promise about speed, service quality or security. [2][4]

CGNAT exists mainly because globally routable IPv4 addresses are scarce. RFC 6598 reserved 100.64.0.0 through 100.127.255.255, written as 100.64.0.0/10, as Shared Address Space for provider networks. It is not ordinary public address space and is distinct from the private ranges commonly used inside homes. A provider may use other internal arrangements, so the absence of a 100.64/10 WAN address does not conclusively rule CGNAT out. IPv6 reduces the need for this particular form of IPv4 sharing when deployed end to end. [1][3]

For an outbound session, the carrier gateway records a mapping between the subscriber-side address and port and a public address and port. Replies follow that mapping back. An unsolicited inbound packet usually has no mapping, which is why port forwarding on the home router alone often cannot expose a game server, camera or self-hosted service through CGNAT. NAT traversal protocols may help some applications, but success depends on the application's design and the provider's translation behavior. [2][3]

A shared public address can also affect websites and investigations. Several unrelated customers may appear to a service under the same IPv4 address, so one user's abuse can trigger rate limits, reputation blocks or login challenges for others. IP geolocation may point to the gateway rather than the subscriber. RFC 6269 explains that accurate attribution can require the public address plus source port, protocol, precise timestamp and provider translation logs. A public IP address by itself is therefore weak evidence that one particular person or device performed an action. [3]

A practical check compares the IPv4 WAN address shown by the router with the address reported by a reputable external address-check site. A WAN address inside 100.64.0.0/10, or another nonpublic range, together with a different external address is consistent with upstream translation. A mismatch can also result from a VPN, a proxy, another router or stale status information. Confirm with the provider before changing equipment or paying for a service; only the provider can state how that connection is provisioned. [1][4]

If inbound access is necessary, ask whether the provider offers a public dynamic IPv4 address, a static address or a business plan. IPv6 can provide globally addressable connectivity when both ends support it, but the host still needs a correctly configured firewall and the application must listen on IPv6. Other options include an authenticated outbound tunnel, a relay or a VPN product that explicitly supplies inbound port forwarding. Review cost, logging, terms and authentication, and never disable the host or router firewall simply to overcome a NAT problem. [1][2][3]

CGNAT does not encrypt traffic, hide activity from the provider or make a subscriber anonymous. It is also not a substitute for a firewall: translation state can block many unexpected inbound packets, but security depends on gateway behavior, device patching and explicit policy. Conversely, being behind CGNAT is not evidence of malware, censorship or Wi-Fi sharing. It is an address-management design that can coexist with IPv6, provider filtering and an ordinary home network, each of which must be diagnosed separately. [2][3]

For routine browsing and streaming, many users never notice carrier translation. The limitations become visible when an application expects direct inbound IPv4 reachability, when many subscribers share a site's reputation limits or when investigators need to distinguish users behind one address. Start with the actual symptom, record the router and external addresses and ask the provider which public-address or IPv6 options are available. That approach is safer and more reliable than assuming a new router, a generic VPN or a manual port-forward rule will remove a translation layer controlled by the carrier. [2][3][4]

Sources

  1. IETF RFC 6598 — IANA-Reserved IPv4 Prefix for Shared Address Space
  2. IETF RFC 6888 — Common Requirements for Carrier-Grade NATs
  3. IETF RFC 6269 — Issues with IP Address Sharing
  4. Cisco — Configure Carrier-Grade NAT IP addresses

Related stories