How to check if your ISP performs CGNAT

If you struggle to forward ports, your ISP performs CGNAT to preserve the IPv4 pool. You can’t open ports or add port forwarding rules because ISPs reject all requests via CGNAT.  

We will discuss later in the article how you can bypass CGNAT. However, the first step is to check whether or not your ISP performs CGNAT. 

What is CGNAT? 

CGNAT (Carrier-Grade Network Address Translation) is an address translation mechanism performed to conserve the IPv4 pool. Most ISPs perform CGNAT to continue using the IPv4 infrastructure while transitioning towards IPv6 publicly. 

Acquiring more IP addresses can be expensive since the IPv4 pool is depleting, so performing CGNAT allows ISPs to assign a single public IP to multiple customers. Even if you try to open ports on a router that’s sitting behind CGNAT, ISPs can reject your port forwarding requests. Plus, you can get your IP blacklisted if you try to port forward behind CGNAT. 

Why is Port Forwarding an issue with CGNAT?

Several consumers rely on the same IP address on a private network, making Port forwarding a router difficult. If you try to forward a port on a shared public IP address, the data will also be sent to all the other customers. And, even if your router is configured for port forwarding, opening ports, and bypassing CGNAT can get every IP blacklisted on a private network. 

How to check if the ISP performs CGNAT?

Here are a few ways to verify if your ISP is performing CGNAT:

Check the router’s WAN IP address 

The first method deals with the WAN IP address. All you need to do is access your router’s settings and check the said IP address. If it lies in a specific range, it implies that your ISP is using CGNAT. The detailed instructions are as follows:

1. Open up a web browser of your choice.
2. Enter your router’s IP address in place of a URL.
3. Hit enter.
4. On the router login page, enter your user credentials.
5. Once you have access to the user dashboard, you must locate the WAN IP address.
6. In the status screen, look for the WAN IP section (the name could differ depending on your router)
7. Now check the IP address the router’s internet WAN interface is receiving. 
8. If this WAN IP lies in the range of 100.64.x.1 to 100.127.x.254, it could mean that you are behind CGNAT.

Compare the WAN IP and the public IP address

The second method also employs the WAN IP to determine if you are behind CGNAT. But instead of using a range, we check whether the WAN IP matches our public IP address. If so, your ISP is not using CGNAT to conserve the IPv4 pool. The specific steps are given below:

1. Locate the WAN IP address as mentioned in the method above.
2. Note down this WAN IP.
3. To get the public IP address, open a new tab.
4. In the URL field, type what’s my IP address.
5. Hit enter.
6. The browser will display your current public IP on the screen.
7. Compare the said address with the WAN IP.
8. If both addresses differ, then your ISP is using CGNAT.
9. If they are the same, then it means that you are not behind CGNAT.

Traceroute the public IP

You have to use the command prompt to check whether or not the ISP is performing CGNAT. You need to run a single command and analyze the results. Follow these instructions to understand the procedure:

1. Get your public IP address as stated in the method above.
2. Note down this public IP.
3. Open the command prompt (Press Windows + type cmd in the search bar).
4. Enter the following command → tracert your public IP address.
5. Hit enter.
6. If there is just a single hop in the results, you are not behind CGNAT.
7. But if there are two hops, your ISP uses CGNAT to conserve bandwidth. 

How to forward ports behind CGNAT

There is a possibility that you could opt out of the CGNAT plan, but there is a catch. Your ISP may ask you to upgrade to a premium plan, which is not what we need. Lucky for you, there is a more accessible and much safer way to forward ports behind CGNAT.

Just use a reliable VPN service, such as PureVPN, to open ports and bypass CGNAT with a few clicks. Not only is this solution efficient, but it is relatively safe as it removes the general security risks attached to port forwarding.

How PureVPN can help you forward ports behind CGNAT

Can’t open ports because of CGNAT or double NAT? You have come to the right place. Consider using PureVPN’s port forwarding add-on for all your port forwarding needs on multiple routers. 

Our port forwarding add-on can help you simplify the port forwarding process but also allows you to bypass CGNAT with ease. Follow the instructions below to enable this effective add-on:

1. Login to the PureVPN member area.
2. Click the subscription tab.
3. Click Configure.
4. Apply your desired port settings.
5. Click Apply settings.

Quickly and safely open ports using PureVPN

With our Port Forwarding add-on, opening ports is as simple as 1, 2, and 3!

Host a server with a Dedicated IP and Port Forwarding add-on 

A Dedicated IP allows you to create servers and external IP addresses to connect to your server without any IP mapping issues. You need a dedicated IP with a Port Forwarding add-on if you wish to host a game server, get your IP whitelisted, or want your friends to connect to your at-home devices. 

Do ISPs Know You Are Using a VPN? 

Are you curious if the ISP knows about you using a VPN? The answer could be clearer. When you connect to a VPN server, your ISP can see that you are connected to a VPN server, the time of your connection, and the port the VPN uses for traffic. However, your actual online traffic remains hidden from your internet service provider.

In summary, a VPN protects your online activities from ISPs and surveillance agencies, enhancing security and online privacy. You can browse multiple websites and platforms without anyone tracking your digital footprints as long as you are connected to a VPN server. 

Wrapping up

Contact our friendly reps via the Live Chat option if you need help in forwarding ports on a router (Starlink, Xfinity, or Spectrum). 

Frequently Asked Questions