Carrier-Grade NAT Explained
Understanding CGNAT (100.64.0.0/10), how to identify it, and its impact on network services.
What is Carrier-Grade NAT?
Carrier-Grade NAT (CGNAT) is a large-scale NAT implementation used by ISPs to share a single public IPv4 address among multiple customers. It's also called Large Scale NAT (LSN) or NAT444. CGNAT became necessary due to IPv4 address exhaustion - there simply aren't enough public IPv4 addresses for every device to have its own.
Why Do ISPs Use CGNAT?
ISPs use CGNAT because: - IPv4 addresses are expensive and scarce - Customer demand for internet connectivity continues to grow - Each customer may have multiple devices needing internet access - Transitioning to IPv6 takes time and planning CGNAT allows ISPs to serve more customers with fewer public IPv4 addresses.
CGNAT Address Range
Range: 100.64.0.0/10
Full Range: 100.64.0.0 to 100.127.255.255
Total Addresses: 4,194,304 addresses
RFC: RFC 6598
Address Breakdown
| Network Block | Available Addresses | Typical Use |
|---|---|---|
100.64.0.0/12 | 1,048,576 | Large ISP CGNAT pool |
100.80.0.0/12 | 1,048,576 | Large ISP CGNAT pool |
100.96.0.0/12 | 1,048,576 | Large ISP CGNAT pool |
100.112.0.0/12 | 1,048,576 | Large ISP CGNAT pool |
How CGNAT Works
CGNAT creates a two-layer NAT system
Two-Layer NAT System
| Layer | Location | Inside Address | Outside Address | Purpose |
|---|---|---|---|---|
| Customer NAT | Home router | Private addresses (192.168.x.x, 10.x.x.x) | CGNAT address (100.64.x.x) | Translate devices to CGNAT address |
| Carrier NAT | ISP equipment | CGNAT addresses (100.64.x.x) | Public IPv4 addresses | Translate many customers to shared public IPs |
Traffic Flow
- Device (192.168.1.100) sends packet to internet
- Home router NATs to CGNAT address (100.64.50.200)
- ISP CGNAT translates to public IP (203.0.113.1) with unique port
- Internet sees traffic from 203.0.113.1:45678
- Return traffic follows reverse path with port mapping
How to Spot CGNAT
Impact on Services
Negative Impacts
Description: Cannot host servers or accept incoming connections
Affected Services: Web servers, Game servers, VPN servers, Remote access
Workaround: Use cloud services or VPN tunnels
Description: Router port forwarding rules don't work from internet
Affected Services: Gaming consoles, Security cameras, Home automation
Workaround: Use UPnP alternatives or cloud-based solutions
Description: Your location may appear incorrect online
Affected Services: Streaming services, Local search, Weather
Workaround: Contact service providers or use location services
Description: Multiplayer gaming may have connectivity issues
Affected Services: Console gaming, P2P games, Voice chat
Workaround: Use gaming VPN or contact ISP for gaming package
Description: Some VPN protocols may not work properly
Affected Services: PPTP, L2TP, Some OpenVPN configs
Workaround: Use VPN protocols that work through NAT
Positive Aspects
- Extends IPv4 address availability
- Allows ISPs to serve more customers
- Provides some security through address hiding
- Reduces need for expensive IPv4 addresses
- Enables ISPs to offer affordable internet service
Workarounds and Solutions
Troubleshooting Common Issues
Cause: CGNAT prevents direct peer-to-peer connections
Diagnosis: Check console network settings for NAT type
Solution: Enable UPnP on router, consider gaming VPN, or request public IP
Cause: CGNAT blocks inbound connections to cameras
Diagnosis: Port forwarding test fails from outside network
Solution: Use cloud-based camera service or VPN access
Cause: CGNAT prevents inbound VPN connections
Diagnosis: VPN connections timeout or fail to establish
Solution: Use cloud VPN service or reverse VPN connection
Cause: Double NAT prevents P2P hole punching
Diagnosis: Applications report connectivity issues
Solution: Use relay servers or protocol-specific workarounds
Quick CGNAT Check
- Check your router's WAN/Internet IP address
- If it starts with 100.64, you're behind CGNAT
- Compare with whatismyipaddress.com
- If different, confirms CGNAT deployment
- Test affected services (gaming, port forwarding)
- Contact ISP about public IP availability and cost
- Research workarounds for your specific needs
- Consider IPv6 deployment if supported
Best Practices
- Test your setup to confirm if you're behind CGNAT
- Document affected services and plan workarounds
- Consider IPv6 deployment as long-term solution
- Evaluate cost of public IP vs workaround solutions
- Use cloud services for hosting needs
- Keep ISP contact info for escalating connectivity issues