100.64.0.0/10: CGNAT shared address space

100.64.0.0/10 is shared address space, reserved by RFC 6598 in 2012 for carrier-grade NAT. Addresses run from 100.64.0.0 to 100.127.255.255. An ISP assigns one to your router and translates it to a public address shared with other subscribers, so inbound connections cannot reach you.

Why the range had to exist

By 2011 IPv4 exhaustion had forced ISPs to put a second layer of NAT between subscribers and the internet. They needed address space for the segment between the subscriber’s router and the carrier’s translator, and every obvious choice was wrong. Using public space wasted addresses that could be sold. Using RFC 1918 space collided with the customer’s own LAN, because a home router on 192.168.1.0/24 behind a carrier also using 192.168 space produces routing that cannot be resolved.

ARIN returned a /10 to IANA for the purpose, and RFC 6598 designated it as Shared Address Space in April 2012. The key sentence in the RFC is that it “is IPv4 address space designated for Service Provider use with the purpose of facilitating CGN deployment”, and that it must not be used on both sides of a NAT device.

When you see it

• On your router’s WAN or Internet status page, as the address the ISP handed out.
• In a traceroute from your network, as the first hop past your own gateway.
• On mobile connections, where CGNAT is close to universal.
• In Tailscale, Nebula, and similar overlay networks, which use the range for their own virtual addresses.
• In the home page report output on this site, where a WAN address in this range and a different public IP is the signature of carrier NAT.

How to confirm it in two minutes

1. Open your router’s admin page and find the WAN or Internet section. Note the IPv4 address.
2. Compare it with the public IP on this site’s report page.
3. If the WAN address starts with 100.64 through 100.127 and differs from the public one, you are behind CGNAT.
4. If the WAN address is in 10.x, 172.16 to 172.31, or 192.168, you have a second router upstream and you are double-NATed inside your own premises.
5. If they match, you have a real public address.

Test whether anything can reach you from outside with /port-check.

What it costs you

RFC 6269 catalogues the consequences of address sharing, and they are the reasons people notice CGNAT at all. Inbound port forwarding does not work, because the port on the shared public address is not yours to assign. Geolocation points at the carrier’s aggregation site rather than your town. Reputation is shared, so a rate limit or a ban triggered by another subscriber lands on you. Logs that record only an IP address cannot identify a subscriber without the carrier’s translation records and a port number.

The Tailscale overlap

Tailscale assigns each node an address in 100.64.0.0/10, and so do several other overlay networks. The reasoning is sound: the range is reserved, so no home or corporate network is supposed to be using it, which makes collisions unlikely. The side effect is that a 100.x address on your machine may be your VPN mesh rather than your ISP. Check which interface it is on before concluding anything about your connection.

What it is not

This is not a private range in the RFC 1918 sense, and it should not be used for a LAN. It is not your public IP, so it will never appear in a web server’s logs for your traffic. And it is not 169.254.0.0/16, which means DHCP failed. A 100.64 address means DHCP worked and your ISP made a design decision.