CGNAT (Carrier-Grade NAT)

Carrier-grade NAT is NAT performed by the ISP across its whole customer base. Instead of each subscriber getting a unique public IPv4 address, many share one, with the carrier's equipment translating between them and the private addresses handed to homes. ISPs adopted it to cope with IPv4 exhaustion. The side effect is significant: because you no longer hold a public address of your own, you cannot accept inbound connections or set up port forwarding, and your public IP is shared with strangers.

Under CGNAT your traffic leaves through a carrier address pooled with many other customers — the same mechanism that makes mobile IPs hard to block. The downsides for you are concrete: hosting a service, remote access and peer-to-peer connections that need inbound reachability all break, and any reputation problem caused by another customer on the shared address can affect you too. Detecting CGNAT is simple — the public address your router shows differs from the address a what-is-my-IP site reports through the carrier.

An outbound exit address does not by itself open inbound ports to your device. That requires separate supported routing and firewall configuration. A dedicated IP is exclusive during its assignment under the service terms. Prior history, assignment duration, availability and supported bindings still matter. s4m has selectable public exit configurations. Use the endpoint or profile issued for the protocol and location selected in your account. An exit IP can have a prior history. Accounts, cookies and browser signals may still identify a user; changing an address does not guarantee a clean reputation. Related topics: dedicated IP, VPN, proxies, exit IP, reputation, no-logs, RAM-first.