How to Check if Your ISP Performs CGNAT | CGNAT Test

Port forwarding can fail for more than one reason, such as a firewall rule, double NAT, a router setting, or CGNAT on your ISP’s network. The symptoms can look similar, which is why it helps to confirm what is actually happening before changing more settings. 

CGNAT is particularly easy to miss because your internet connection can otherwise work normally. You may only notice something is different when you try to accept an incoming connection, host a server, or access a device remotely.

The good news is that checking for CGNAT is not particularly complicated. In this guide, we will run through a few CGNAT tests you can use to check if your internet provider is using Carrier-Grade NAT. 

What Is CGNAT?

CGNAT is a type of NAT used by ISPs to let multiple customers share public IPv4 addresses. Instead of assigning a separate public IPv4 address to every connection, the ISP handles the translation on its own network.

One reason ISPs use CGNAT is the limited supply of IPv4 addresses. Sharing them helps providers serve more customers, but it also makes direct inbound connections harder because the public IP is not tied to a single customer.

How to Port Forward Behind CGNAT With PureVPN

PureVPN’s Port Forwarding add-on can route incoming connections through the VPN instead, so you are not depending on the ISP-controlled NAT to forward the port. Just follow these simple steps to set it up:

1. Sign up for PureVPN and add Port Forwarding to your subscription.
2. Download the PureVPN app for your device and sign in.
3. Open the Member Area, go to Subscriptions, and select Configure next to Port Forwarding.
4. Choose Enable specific ports, enter the ports you need, and click Apply Settings.
5. Connect to a server that supports Port Forwarding so the settings take effect.

How to Check If Your ISP Uses CGNAT

No single symptom is enough to confirm CGNAT on its own. The checks below use your WAN IP, public IP, and network route to help identify CGNAT:

Method 1: Check Your Router’s WAN IP Address

Start with the WAN or Internet IPv4 address on the router or gateway that connects directly to your ISP. You can usually find it after signing in to the router’s admin page or app, although the exact menu varies by device.

Once you have the address, check whether it falls between 100.64.0.0 and 100.127.255.255. An address in this range is a strong sign of CGNAT because RFC 6598 reserves the entire 100.64.0.0/10 block as shared address space for service-provider networks.

If the WAN IP instead falls within a private range such as 10.x.x.x, 172.16.x.x to 172.31.x.x, or 192.168.x.x, your gateway still does not have a public IPv4 address. The address alone, however, does not tell you whether the extra NAT is CGNAT, so move on to the next check.

Method 2: Compare Your WAN IP With Your Public IP

Next, compare the WAN IP you found on your router with the public IPv4 address visible on the internet. You can find your public IP using an online IP checker.

If both addresses are the same and the WAN address is a public IPv4 address, there is no additional IPv4 NAT between that gateway and the public internet. If the addresses are different, another NAT layer sits somewhere upstream.

A mismatch does not confirm CGNAT by itself. For example, if you checked the WAN address of a second router connected behind another gateway, local double NAT can also produce different WAN and public IP addresses.

Method 3: Check the Route for Shared Address Space

Traceroute can provide another clue by showing some of the network hops between your device and the internet. On Windows, open Command Prompt and enter:

tracert 8.8.8.8

On macOS or Linux, use:

traceroute 8.8.8.8

Look at the addresses that appear after your home router. If an address in the 100.64.0.0/10 range appears on the ISP side of the route, it supports the other signs that your connection is behind CGNAT.

Do not use the number of hops to make the call. Some providers also hide or filter intermediate hops, which can show up as asterisks or timeouts, so a traceroute that does not reveal shared address space does not rule CGNAT out.

Note: If you are using a VPN or proxy, disconnect it before comparing your WAN and public IP addresses. Otherwise, the public IP you see may belong to the VPN or proxy rather than your ISP connection.

What Can Be Mistaken for CGNAT?

Some signs associated with CGNAT can also have other causes, so it is worth looking at the results together rather than relying on one clue alone.

• A closed port: A firewall, incorrect forwarding rule, or a service that is not listening on the port can also cause an external port check to fail.
• Strict NAT or NAT Type 3: These labels describe how restrictive the connection is, but they do not tell you whether the NAT is being handled by your ISP.
• Different WAN and public IP addresses: A mismatch can point to another NAT layer, but local double NAT can produce the same result.
• Private or shared addresses in traceroute: These can point to CGNAT when they appear on the ISP side of the route, but they do not confirm it.

CGNAT vs Double NAT: How to Tell the Difference

CGNAT and double NAT can look similar, but they are not the same thing. Here is a quick comparison:

Type	NAT Location	Common Clue	Local Fix
CGNAT	On the ISP’s network	A WAN IP in the 100.64.0.0/10 range is a strong CGNAT clue	Not through your home router
Double NAT	Across two routers or gateways on your local network	A second router receives a private WAN IP from the router or gateway in front of it	Usually possible by reconfiguring one of the local NAT devices

What to Do If Your ISP Uses CGNAT

Once you have confirmed CGNAT, the next step depends on what you need the connection for and what your ISP supports. These are the main options:

Ask Your ISP for a Public IPv4 Address

Some ISPs can move customers off CGNAT or provide a public IPv4 address. Availability and any additional cost depend on the provider and plan. A public IPv4 address does not necessarily mean a static one. If you specifically need the same address over time, ask your ISP whether it offers a static IP as well.

Check Whether IPv6 Is an Option

IPv6 can avoid the IPv4 CGNAT limitation when your ISP provides IPv6 connectivity and the service at the other end supports it. IPv6 has enough address space to avoid the kind of address sharing that CGNAT uses for IPv4.

You still need to account for firewall rules, and IPv6 will not help with a service that only works over IPv4. It is worth checking before moving to another workaround.

Related Read: IPv4 vs IPv6: What’s the Difference?

Use a VPN With Port Forwarding

A VPN that supports port forwarding can provide another path for incoming connections instead of relying on your ISP’s CGNAT. The required port is opened through the VPN connection rather than on the carrier-side NAT.

PureVPN’s Port Forwarding add-on can route the incoming connection through the VPN instead, so you are not relying on the carrier-side NAT your ISP controls. You can allow all ports or specify the ones you need. We will cover the steps later in this guide.

Use a Reverse Tunnel or VPS

A reverse tunnel works by creating an outbound connection from your network to a tunnel provider, which can then make a selected local service reachable from outside. Services such as Cloudflare Tunnel use this model without requiring an open inbound port or publicly routable IP on the home connection.

A VPS can serve a similar purpose if you want to manage the public endpoint and routing yourself. Traffic reaches the publicly reachable server first and is then sent back through a tunnel to the service on your network.

Frequently Asked Questions