Carrier-grade NAT (CGNAT)

The full report shows the address the internet sees for you. Compare it with your router’s WAN page to confirm.

The range that gives it away

RFC 6598 reserved 100.64.0.0/10 in 2012 specifically for the link between a subscriber’s router and a carrier’s translator. It covers 100.64.0.0 through 100.127.255.255, about 4.2 million addresses.

The IETF created it because carriers had been using RFC 1918 space for the same job, which collided with the addresses customers were already running on their LANs. A dedicated range removed the collision.

Address on your router’s WAN page	What it means
Matches the address on this site	You hold a public IP. Normal setup.
100.64.x.x to 100.127.x.x	Carrier-grade NAT.
192.168.x.x, 10.x.x.x, 172.16-31.x.x	A second router sits upstream. You are double-NATed inside your own building.
169.254.x.x	The WAN link never got a lease. Not CGNAT, a fault.

Some ISPs deploy CGNAT with public addresses on the subscriber side instead of 100.64/10, so a clean check is simply whether the router’s WAN address and the address on this site are the same string.

Why ISPs do it

IANA handed out its last free IPv4 blocks in 2011, and the regional registries exhausted their general pools over the following decade. A carrier adding subscribers has three options: buy addresses on the secondary market at roughly forty US dollars each, deploy IPv6 and translate the remaining IPv4 traffic, or share IPv4 addresses across subscribers. Most large mobile carriers and many fixed-line ISPs chose sharing.

Mobile networks are almost universally behind CGNAT. Fibre and cable ISPs vary by country and by how recently they grew.

What CGNAT breaks

RFC 6269 catalogues the consequences. The ones you will actually meet:

• No inbound port forwarding. A rule in your router forwards a port from the router’s WAN address, and that address is not reachable from the internet. A home NAS, a game server, a security camera, or a self-hosted site will not accept connections.
• Shared reputation. If another subscriber on the same public address triggers a rate limit or a spam filter, you inherit it. This is the usual cause of CAPTCHAs that appear for no reason.
• Geolocation drift. Databases place you at the carrier’s translation site, which can be a different city or region. See why a site thinks you are somewhere else.
• Session table pressure. Each translator holds a finite number of concurrent mappings. Heavy peer-to-peer traffic can exhaust your share and cause connections to fail intermittently.
• Weaker logging. Attributing an action to a subscriber needs the source port and a precise timestamp, not just the address.

Things that keep working normally: browsing, streaming, video calls, gaming as a client, VPN clients, and anything else your device starts.

Test whether an inbound port reaches you

Set up a listener, then check it from outside.

nc -l 8080

Forward TCP 8080 in your router to that machine, then run /port-check against port 8080. If the port shows closed while the listener is running and the forward is correct, the block is upstream, and CGNAT is the usual reason.

Two other signals worth reading together on /report: a connection type of mobile or hosting when you expect residential, and an ASN belonging to a carrier’s core network rather than its consumer brand.

How to get a real public IP

Ask your ISP directly. The wording that works is specific:

I need a public IPv4 address on my line rather than a CGNAT address. Is a static or dynamic public IPv4 available on my plan, and what does it cost?

Common outcomes, in the order you are likely to hear them:

1. Free on request. Several fixed-line ISPs will move a line off CGNAT if you ask, sometimes only through a support ticket rather than the app.
2. A small monthly fee, often bundled with a static address.
3. Business plan only. The consumer tier stays on CGNAT.
4. Refused, which is common on mobile and on some large cable networks.

If the answer is no, the workable alternatives are IPv6, which most CGNAT deployments provide alongside the shared IPv4 and which gives you globally routable addresses with no translation, or a tunnel: a VPN provider that sells port forwarding, a Cloudflare Tunnel, a Tailscale funnel, or a small cloud instance running a reverse proxy back to your network.

Check your IPv6 status first on /ipv6-test. If it works, a service that is reachable over IPv6 solves the problem for any client that also has IPv6, which is now close to half of them.