You forwarded the port on your router, checked the firewall, rebooted everything, and still nobody outside can reach your camera, game server or remote desktop. Before you lose another afternoon, ask one question: does your ISP use CGNAT? If it does, the problem is not your router, and no setting inside your home will fix it.
What CGNAT is
CGNAT stands for Carrier-Grade NAT. To understand it, think about your home network: the router gets an IP address from the ISP and shares it with every device in the house, which use internal IPs like 192.168.0.10. That is regular NAT.
With CGNAT, the ISP does the same thing one level up. Instead of giving your router a public IP, it gives it an internal address from the ISP's own network, and hundreds or thousands of customers reach the internet sharing a small pool of public IPs. You keep browsing normally, but you no longer have an address of your own on the internet.
Why ISPs use it
IPv4 addresses ran out. There are about 4.3 billion of them, and demand is far higher. Buying new blocks has become expensive, so many ISPs, especially fast-growing ones, put residential customers behind CGNAT to save addresses. The long-term answer is IPv6, which has addresses to spare (see the difference between IPv4 and IPv6).
What CGNAT breaks
For browsing, streaming and social media, almost nothing changes. The trouble starts when someone outside needs to start a connection to you:
- Port forwarding does not work. Your router's port forwarding only reaches as far as the ISP network. Incoming connections stop at the CGNAT device, which does not know which customer to send them to.
- Cameras and DVRs that rely on direct access by IP stop working from outside.
- Home servers (Minecraft, a website, Plex, your own VPN) become unreachable from the internet.
- Online games may report strict or moderate NAT and struggle with matchmaking or voice chat.
- Shared blocks: since many people use the same public IP, if someone else on that IP abuses a service, you may get captchas or blocks too.
How to tell if you are behind CGNAT
The test is to compare two numbers: the IP your router got from the ISP and the IP you show up with on the internet.
1. Check your public IP
Open the My IP tool and write down the IPv4 address shown. That is the IP websites see you with.
2. Check the router's WAN IP
Log in to your router's admin page (usually 192.168.0.1 or 192.168.1.1 in the browser) and find the internet status page, sometimes called WAN, Internet or Connection. Write down the IPv4 address shown there.
3. Compare
- Both are the same: your router has a public IP. There is no CGNAT, and port forwarding should work.
- The WAN IP is between
100.64and100.127: that is CGNAT. This range,100.64.0.0/10, was reserved precisely for it. - The WAN IP is
10.x,172.16to172.31or192.168.x: that is a private address. It may be ISP CGNAT, or another router of yours in front (for example, the ISP modem running in router mode). In that second case it is double NAT inside your home, which you can fix yourself by putting the modem in bridge mode.
Extra clue from traceroute
On your computer, run tracert 8.8.8.8 (Windows) or traceroute 8.8.8.8 (Linux and macOS). If one of the first hops after your router has an address from 100.64.x.x to 100.127.x.x, that is a strong sign of CGNAT. If you are unsure how to read the output, see how to read a traceroute.
What to do if you are behind CGNAT
Ask your ISP for a public IP
This is the most direct fix. Call or open a ticket and ask for a "public IPv4" or to have your line taken off CGNAT. Some ISPs do it for free, others charge for it as an add-on or only offer it on business plans. If you need the address to stay the same, ask for a static IP; see the difference in static vs. dynamic IP.
Use IPv6
Many ISPs that use CGNAT give each customer a public IPv6 address. If your router and your service support IPv6, anyone else with IPv6 can reach you directly, as long as the router firewall allows incoming traffic. The My IP tool shows whether you already have an IPv6 address.
Use a tunnel or a VPN with a public exit
Reverse tunnel services and mesh VPNs open the connection from the inside out, which gets through CGNAT. Another option is to rent a cheap cloud server and run a tunnel to it. It works well, but adds latency and depends on a third party.
Prefer the manufacturer's cloud service
Modern cameras and DVRs usually offer access through the manufacturer's app, which also connects from the inside out. It is not as flexible as direct access, but it solves the problem for most people.
After the change, confirm it
Once your ISP takes you off CGNAT, repeat the comparison: the router's WAN IP should match the IP shown in My IP. Then, with port forwarding set up and the service running, use the port test to confirm from outside that the port is open.