What is CGNAT and how to get around it

Carrier-Grade NAT (CGNAT) is how ISPs cope with the exhaustion of IPv4 addresses. Instead of giving every customer a unique public IP, the ISP puts hundreds or thousands of subscribers behind a single shared public address and translates their connections at a big carrier-grade router. It is the same idea as the NAT in your home router, but one layer up and shared across many households. For ordinary browsing you never notice — outbound connections work fine. The problem is inbound.

Because you share a public IP with strangers, you do not truly own a reachable address. You cannot open a port to your machine, because the ISP's router, not you, decides what that shared IP does with incoming packets — and it has no idea which subscriber a random inbound connection is meant for.

There is a quick test. Find your public IP on a "what is my IP" site, then look at the IP shown in your router's WAN status page. If they differ — your router thinks its WAN IP is private while the world sees a different one — you are behind CGNAT. A dead giveaway is a WAN address in the 100.64.0.0/10 range, which is reserved specifically for CGNAT, or a private-looking WAN IP (10.x, 172.16–31.x, 192.168.x) when you expected a public one.

The symptoms are all inbound: port forwarding in your router does nothing, friends cannot join a game you host, self-hosted services are unreachable from outside, and BitTorrent runs slowly with no incoming peers. Everything you try to host fails, even though everything you visit works.

You cannot defeat CGNAT from your side alone, because the missing piece — a public IP that is yours — lives at the ISP. The honest options: 1) Ask your ISP for a public/static IP; many offer one, sometimes for a small fee. 2) Rent a VPS and run your service there, or tunnel to it with WireGuard so the VPS's public IP fronts your home service — the standard self-hoster's fix. 3) Use a dedicated / personal IP: an address reserved for you that, unlike a CGNAT-shared one, can actually be pointed at your service and whitelisted.

The common thread is the same as with port forwarding: the cure for "I don't have a real public IP" is to get one you control. A shared VPN exit does not provide that for inbound hosting, but a VPS plus a dedicated IP does — a stable address with ports you own. That is the direct, honest path from "behind CGNAT" to "reachable".