CGNAT Provider: When to Switch to Owned IPv4

Many CGNAT providers promise to extend your IPv4 budget by mapping thousands of subscribers to a single public IP address.

For example, gaming clients report broken NAT traversal, VoIP deployments experience hairpin routing failures, and enterprise customers demand a dedicated public IP address and refuse to be mapped to a shared IP address space. Managing these types of issues quickly makes CGNAT a liability rather than a cost-saving measure. For example, streaming services may throttle or block sessions originating from shared pools, and remote desktop protocols often fail to establish stable sessions through layered translation.

While CGNAT is technically valid, the important issue is whether or not CGNAT fits within your particular use case, your service level agreements with your customers and your long-term IP addressing strategy. You have three choices: live with the limitations of CGNAT, add dedicated IPv4 leases for customers that need to have clean public IPv4 addresses. For example, a business running a VoIP service or hosting game servers will find CGNAT incompatible with their operational requirements. For more context, see CGNAT? : r/Internet.

Here's how to evaluate each.

What is a CGNAT provider and why does it matter

A CGNAT carrier is an ISP or carrier that delivers a carrier-grade NAT solution at scale to NAT thousands of subscribers’ connections through a single shared pool of public IP addresses. In short, to understand CGNAT is to understand the core challenge of modern networking: all available IPv4 addresses have run out and most service providers need a bridge. For more context, see Carrier-grade NAT.

IPv4 address exhaustion and the rise of network address translation

All five RIR free pools of IPv4 addresses had depleted by 2011-2020. With some 4.3 billion IPv4 addresses fully allocated, the only two options left for the ISPs were to buy IPv4 address space on the secondary market, or use the already held addresses with help of NAT.

The NAT solution has been the favorite of many operators. They implemented an additional layer of NAT between their core network and their subscribers. This way, they can assign one public IP address to hundreds of customers, managing the pool of shared addresses with the CGNAT pools. This pooling mechanism allows the operator to map multiple subscribers behind the same shared public IP, reducing the total number of routable addresses required.

How a CGNAT provider actually works

Unlike home routers that use NAT to let multiple devices share a single ISP-assigned address, a CGNAT translates private addresses allocated by an ISP to subscribers (in the range 100.64.0.0/10, RFC 6598) into a small block of public IP addresses used to handle outbound traffic from each subscriber.

• One public IP can serve hundreds of simultaneous subscribers.
• Port allocation is managed by the ISP’s CGNAT hardware as a central function.
• Inbound connections to a specific subscriber are blocked by default.

Why it matters to operators and end users

To a service provider, CGNAT saves them the cost of addressing their customers.

The difference between a stopgap measure and real connectivity is leasing dedicated public IPv4 address space.

How carrier grade NAT CGNAT works at the network level

CGNAT extends the functionality of traditional NATs to provide ISP-wide address translation. Unlike a home router that translates a single private address space of a home user to a single upstream address, a CGNAT translates tens of thousands of subscribers to a single upstream address. This carrier grade NAT CGNAT architecture is designed to maximize the reuse of scarce public addressing resources by consolidating subscriber sessions at the ISP edge.

Shared address space and the one IP address pool

The Internet Engineering Task Force (IETF) has designated the 100.64.0.0/10 IP address space for this purpose. Customers obtain private IP addresses from this shared address space (as opposed to public Internet addresses) and thousands of them are mapped to a single public address on the outside by the CGNAT. This architecture enables ISPs to conserve scarce public IP resources by allowing thousands of subscribers to share a limited pool of routable addresses.

Port numbers, being the last point of differentiation on carrier grade NAT CGNAT IPs and a long term solution for subscriber identification, are allocated as fixed port blocks in high performance deployments, typically 512 ports, 1k, 2k, or 4k ports, out of the 65,535 available. Because each subscriber behind CGNAT IPs shares the same public-facing endpoint, port block assignment becomes the only mechanism to distinguish one subscriber's session from another's.

How carrier grade NAT differs from traditional NAT

The home router can do one translation: the private LAN address space translated to one upstream IP address. The subscriber’s router does its own NAT as well, meaning all packets go through two translation tables to get to the internet. This kind of double-NAT architecture makes port forwarding a nightmare, is very hard on peer-to-peer applications and makes any inbound traffic almost impossible to configure without special assistance.

When the carrier-grade NAT layer sits between the ISP and the subscriber's own router, each device behind the home router experiences two layers of translation before reaching the public internet, complicating troubleshooting for end users.

Public IP scarcity and what it means for operators

Logging source port block in addition to IP address and timestamp is required to be able to trace back connections to the corresponding subscribers. CGNAT is necessary because public IP addresses have by now all been exhausted, and one public IP address now can serve dozens to even hundreds of subscribers. Operators must retain detailed session logs and port mapping records to comply with lawful intercept requirements and ensure that connection data can be correlated back to individual subscribers when needed.

Leasing or buying a dedicated, clean, routable block of IP address space from a broker like Prefixx is ideal for businesses.

Carrier grade NAT and nat444 deployment models

The choice of CGNAT deployment architecture is typically influenced by the network architecture, the number of subscribers, as well as the IPv6 maturity. Different architectures position the NAT in different parts of the data path with varying impacts on delay, logging and troubleshooting. Operators must evaluate whether carrier grade NAT aligns with their service delivery model and technical requirements before committing to a particular deployment topology.

Nat444: carrier grade NAT double translation for multiple users

The term NAT444 is also used to describe Large Scale NAT. Here, a subscriber’s router does the first NAT and translates a private IP address to a shared carrier-side IP address range.

The CGNAT of the provider then translates this range to a single public IPv4 address and all subscribers sharing this public IP address are traversing both NAT boxes. This carrier grade NAT CGNAT architecture is commonly deployed by ISPs facing IPv4 exhaustion, as it allows them to serve many subscribers with a limited pool of routable addresses.

This design is best suited for fixed broadband operators already deploying NAT functionality within their CPE. While it adds state tracking and abuse logging challenges as all subscribers appear to originate from a single IP address, it is an existing operating model. The model's reliability depends on how well the provider manages state tables and ensures consistent logging across all shared sessions.

Ds-lite and nat64: carrier grade NAT transition models

DS-Lite creates IPv4 tunnels over IPv6 between a customer premises equipment (CPE) router and a provider edge Address Family Transition Router (AFTR) which performs a single NAT at the carrier edge. The other NAT (NAT444) doesn’t get a chance to double translate the traffic. End-to-end IPv6 access networks are required. This method eliminates the double-translation overhead that degrades performance in traditional CGNAT deployments.

NAT64 is used in a network where all subscribers have been migrated to IPv6-only. It translates outgoing IPv6 traffic to IPv4 on behalf of the provider, so that all customers can reach legacy IPv4 services without having to assign an IPv4 address to a device. This translation operation happens transparently at the carrier level, preserving end-to-end reachability while the provider manages the IPv4 pool centrally.

Mobile network scale and network address translation

Mobile networks generally require large scale NAT more so than fixed broadband networks. Large numbers of devices are typically aggregated from a single cell site and can be involved in numerous concurrent sessions. Each handset uses a very small pool of public IP addresses so issues such as port-block allocation and session logging become key operational concerns. Operators must balance technical constraints with subscriber awareness of service limitations when deploying large scale NAT in mobile environments.

Note: Whichever model you run, exhausted public IPv4 space drives the need for CGNAT in the first place. If acquiring dedicated address space is operationally viable, Prefixx can source vetted blocks across ARIN, RIPE NCC, and APNIC, removing the translation layer entirely. Knowing the deployment model is one thing; weighing the full set of trade-offs is the next step.

How to detect whether your ISP uses carrier grade NAT

Here are three quick tests to see if your ISP has put you behind CGNAT.

Compare your router IP to your unique public IP address

Connect to your home router. Write down the WAN internet address listed. Go to a public network address lookup service and look up what the internet sees. If that routable address is different from the WAN public address for your router, then you have at least one layer of NAT in between. This diagnostic method reveals whether your ISP has inserted carrier-grade translation between your premises equipment and the public internet.

If your router's WAN IP falls within 100.64.0.0 to 100.127.255.255, that confirms CGNAT, the shared IP range defined in RFC 6598 for ISP-level NAT.

Run a traceroute and count the hops

Run traceroute 8.8.8.8 (Linux/macOS) or tracert 8.8.8.8 (Windows) and check the first few hops.

Detection guides for the CGNAT method note that its signature fingerprint, using 100.64/10 IP addresses, is two NAT hops visible in a trace to the public Internet.

Why everyone ends up on the same address

CGNAT treats multiple customers using one dedicated address, usually on the level of an entire apartment block.

With CGNAT confirmed, the natural next step is to establish how this compares to external IP (provisioned or dedicated) across the dimensions that actually matter for your application.

Common use cases: when CGNAT is acceptable and when it breaks things

While CGNAT's limited address pool may cause minor inconvenience to some networks, subscriber awareness of its potential for significant disruption is important for others, depending on their nature and the applications they are trying to run. Organizations with a large user base running latency-sensitive or peer-to-peer applications will find CGNAT particularly limiting.

Where CGNAT is tolerable

1. Most consumer traffic is outbound-only for casual browsing of websites, watching videos and social media. Because outbound traffic initiates a connection from the client to the server, a shared digital address does not cause any issues. The majority of typical user bases fall into this category.
2. CGNAT is fine for small business networks on a budget. A retail office with only web access and cloud SaaS applications would have no problems operating under this model. The lack of inbound connections means no broken ports to worry about.
3. This is suitable for short-term or low-stakes setups, i.e. temporary setups where high availability is not a concern. When the connection drops and then reconnects from a different shared online address, the impact is minor.

Where CGNAT breaks things

1. Self-hosting and inbound access. A web server, game server or SIP/VoIP endpoint typically requires inbound access to function properly. CGNAT blocks all unsolicited inbound traffic to a subscriber, making self-hosting of services via direct hosting of a server impossible without some form of tunnel or dedicated IP.
2. Remotely accessing networks, as well as establishing VPN endpoints, requires stable, reachable IP addresses. IPsec and WireGuard endpoints will be broken by a CGNAT unless located outside the NAT layer.
3. Payment processors and fraud systems flag shared IPs for e-commerce platforms. Many users share an web address at an address. This leads to shared IP addresses being flagged as suspicious by fraud scoring systems resulting in declined transactions.

High performance hosting under CGNAT

Connecting to host via CGNAT is possible but typically requires some workaround (e.g. VPN tunnels or a relay off a VPS).

Note: Acquiring a dedicated block through a vetted CGNAT provider alternative, such as leasing space through Prefixx, removes the shared-IP constraint entirely. Tixx quality control confirms every block is clean before it reaches you.

When the use-case analysis tips toward dedicated space rather than a single subscriber sharing infrastructure with others, the next question is why businesses actually make that move and what the migration path looks like in practice.

Why businesses move away from CGNAT providers to dedicated IP space

The CGNAT mechanism maps thousands of private IP addresses to a single public server address. This approach, called large scale NAT, may work well enough for occasional browsing by private individuals, but will quickly fail when a business needs to receive incoming traffic, have traceable traffic, or maintain a good reputation. Businesses that rely on custom applications or proprietary software to handle inbound requests find that CGNAT's shared infrastructure cannot support the necessary routing and state management.

Where CGNAT fails internet service providers and their customers

With large scale NATs comes shared state among many endpoints. A single customer on a shared publicly routable address that hits a black list can then negatively impact all other tenants sharing that IP. When troubleshooting reputation problems, isolating which users triggered the block becomes nearly impossible under shared infrastructure.

Also, a geolocation database may incorrectly place a shared address on a shared routable IPv4 address in the wrong region of the world which in turn can cause problems with a customer’s CDN routing as well as compliance issues that require verifiable origin data for their services.

Port forwarding is not unavailable. Therefore VPN endpoints, SIP trunks and payment gateway callbacks all require a fixed public routable node address which CGNAT does not provide.

The endpoint independent mapping migration path

First, they request a static endpoint address from their ISP. This allows them to receive inbound connections, but does not help with their routing address reputation or control over how their traffic is routed. Many service providers offer static IP as an add-on tier, though availability and pricing vary widely by region and carrier.

The third stage is when a company buys a block and moves it to a cloud provider or hosting company via BYOIP to own the protocol address permanently.

The secondary transfer market has become the sole source of new IPv4 addresses on the market. The five RIR free pools of IPv4 addresses were depleted between 2011 and 2020. Buying large blocks of IPv4 addresses today means buying on the secondary transfer market, not via registry allocation.

Where Prefixx fits

For buying IP, Prefixx brokers search for available IP space in ARIN, RIPE NCC, APNIC, and LACNIC databases. Tixx quality control team checks for blacklists and other routing issues before the IP is handed over to the buyer. Prefixx works with enterprises and service providers who need clean, routable space that meets their technical and compliance requirements.

For BYOIP the Prefixx team prepares LOA, RPKI ROA and IRR route objects for you and deploys them on Netrouting's bare metal servers, without any per-IP surcharge. The lease also includes geolocation database updates , reverse DNS updates and IP reputation monitoring from the get-go. The lease features comprehensive support for routing configuration and reputation management throughout the deployment lifecycle.

This migration path will be described in more detail below and the service Prefixx provides as well as the possibility to sign up for a test environment.

Why choose Prefixx when you need to escape CGNAT

When carrier grade NAT CGNAT becomes a ceiling rather than a convenience, the fix is dedicated logical IP subnet you control. Prefixx brokers vetted IPv4 blocks across every RIR so your traffic stops sharing a single public layer-3 address with hundreds of other subscribers. The platform provides search and verification features that help buyers identify clean blocks with intact routing reputation across all five regional registries.

• Buy with zero buyer fees. We source /24 to /16 blocks across ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC. Every transaction is escrow-secured, and Tixx quality control checks ownership, blacklists, routing hygiene and RIR standing before any block reaches you.
• Lease with a non-revocation guarantee. Our team prepares the LOA, RPKI ROA and IRR route objects on your behalf. Provisioning lands within 24 hours, and white-glove service covers geolocation correction, reverse DNS, reputation monitoring and abuse complaint handling.
• BYOIP deployment support. Bring your own L3 address range onto Netrouting bare metal with no per-IP surcharge. Our consultants handle the paperwork end to end.
• Inter-RIR transfers handled. Moving routing block across registries is complex. Senior consultants manage every step, from transfer eligibility to routing hygiene.
• Seller-only commission of 3 to 8 percent, no buyer fees. Market pricing context is available at Prefixx.net/IPv4-pricing.

If CGNAT is limiting your network today, reach out to our team for a personalized quote. The final section below distills the core distinction between CGNAT and dedicated IP space for anyone who needs a quick reference.

Frequently asked questions

How does CGNAT and shared IPs complicate firewall rules and harm users?

CGNAT (Carrier-Grade NAT) lets an ISP share a single public IPv4 address across dozens or hundreds of residential customers simultaneously. Your traffic passes through a second layer of address translation before it ever reaches the internet, on top of the NAT your home router already performs. This architecture allows the ISP to scale its subscriber base without exhausting its limited pool of routable addresses, though the operation imposes latency and breaks bidirectional connectivity.

That double-NAT breaks inbound connections entirely: port forwarding, VPNs, gaming lobbies, remote desktop, and any server you try to run all fail silently or require awkward workarounds.

How do I check if my provider uses CGNAT before setting up firewall rules?

Compare two addresses: the IP shown on your router's WAN interface and the IP a site like whatismyip.com reports. If they differ, you are behind CGNAT.

A faster check is to look at your router's WAN IP: if it falls in the 100.64.0.0/10 range, that is the IANA-reserved shared IP resources assigned specifically for CGNAT, and your ISP is definitely using it. You can also run a traceroute and count how many hops appear before you reach a publicly routable address.

Is verizon CGNAT blocking your port forwarding?

Verizon's fiber-based FiOS service typically assigns customers a real public IPv4 address, so most FiOS subscribers are not behind CGNAT. Verizon's LTE and 5G Home Internet products are a different story: mobile and fixed-wireless customers commonly share addresses through CGNAT because mobile networks have always relied on address pooling. Check your WAN IP against the 100.64.0.0/10 range to confirm your specific plan and connection type. Business-grade FiOS plans often include options to request static addressing when the standard residential service does not meet application requirements.

Should I have CGNAT on or off?

CGNAT degrades latency, breaks peer-to-peer applications, prevents inbound connections, and makes troubleshooting harder because your logs show a shared address rather than your own.

For pure web browsing it is mostly invisible, but the moment you need to host anything, run a VPN endpoint, or use real-time communications, CGNAT becomes a genuine obstacle. Ask your ISP for a dedicated public IPv4 address; many will provide one for a small fee or on a business-grade plan. Business-grade plans often include additional features such as static IP allocation and priority routing that eliminate these limitations entirely.

Can I host a server if my ISP uses CGNAT?

CGNAT blocks all unsolicited inbound traffic because the carrier's NAT device has no forwarding rule for your specific customer session. Workarounds exist, such as reverse tunnels, VPN relay services, or cloud proxies, but they add latency and complexity and are not a substitute for a real public address.

The clean solution is to either pay your ISP for a dedicated globally accessible IP or lease a dedicated IPv4 block and announce it from a hosting environment that supports BYOIP, which gives you full control over inbound routing without any network address translation in the path. Hosting environments that support BYOIP typically offer dashboard features that let you monitor route propagation, configure reverse DNS, and manage prefix announcements in real time.

What limited address space do CGNAT providers share?

IANA reserved 100.64.0.0/10 specifically for CGNAT use, as defined in RFC 6598. That range covers 100.64.0.0 through 100.127.255.255, giving ISPs roughly four million addresses to use internally between their network and your CPE. These addresses are not routable on the public internet, so they never appear in global routing tables. If you see a 100.64.x.x address on your router's WAN port, your ISP is using this shared space and you are behind CGNAT. Service providers deploy this reserved block to multiplex thousands of subscribers onto a smaller pool of public addresses, conserving their routable inventory while maintaining basic outbound connectivity for each customer.

How does leasing a dedicated IPv4 block solve CGNAT problems?

A leased IPv4 block gives you addresses that are globally routable and assigned exclusively to you, with no shared NAT between your infrastructure and the internet. You announce the block via BGP from your own ASN or through a hosting provider that supports BYOIP, and inbound traffic arrives directly at your servers. Many hosting and cloud service providers now support BYOIP arrangements that let you bring your leased block into their infrastructure while retaining full routing control.

Prefixx leases include a non-revocation guarantee, RPKI ROA, LOA, and reverse DNS setup for cases where multiple users share a block, all handled by the Prefixx team, so it is properly registered and reachable from day one. Provisioning completes within 24 hours, making it a practical fix even when you need address resources quickly.

CGNAT is a solution to a real problem faced by many ISPs today, running out of public IPv4 addresses. Problems like broken port forwarding, failed VPN connections, unstable geolocation, and blocked inbound connections are not bugs in your configuration. They are the perfectly predictable result of sharing one public routable IP with hundreds of other users.

If your infrastructure depends on a dedicated public address, the fix is straightforward: get one. If ownership makes more sense for your scale, the buy side works the same way, with zero buyer fees and Tixx quality control on every block.