How carrier-grade NAT works
Home routers already perform network address translation: many private devices share the router’s public address. CGNAT adds another translation layer inside the provider. Your router receives an address that is not directly reachable from the public internet, and the provider translates many customer connections through one or more public gateways.
The shared-address block reserved for this purpose is 100.64.0.0/10, covering 100.64.0.0 through 100.127.255.255. Providers can also use ordinary private ranges internally, so seeing 10., 172.16-31., or 192.168. on the router’s WAN interface can indicate another upstream NAT layer.
A reliable detection checklist
- Open your router’s status page and find its internet, WAN, or upstream IPv4 address.
- Use the ShowMyIP checker to record the Cloudflare and AWS-observed public addresses.
- If the router WAN address falls inside
100.64.0.0/10or a private range, an upstream NAT layer is present. - If the router shows a normal public address but it differs from the web result, check for a VPN, proxy, second router, or ISP translation.
- Repeat after reconnecting only if doing so will not interrupt important services.
Do not rely on address differences alone. A VPN, enterprise proxy, security service, or multi-router home setup can create the same pattern. The router’s WAN value and network design provide essential context.
Why several public addresses may appear
A CGNAT platform can select gateways by destination, connection timing, capacity, or routing policy. Several AWS regions may therefore observe different public addresses during one test. However, this is evidence of distributed egress, not proof that CGNAT is the cause. Multi-exit VPNs and corporate secure web gateways can behave similarly.
If Cloudflare reports one address and every AWS region reports another, note whether a browser extension, split-tunnel VPN, or security proxy treats the destinations differently. If addresses change between rounds to the same region, the gateway pool may be rotating connections more aggressively.
Problems CGNAT can cause
- Port forwarding fails: your router cannot control the provider’s upstream translation.
- Self-hosted services are unreachable: unsolicited inbound IPv4 traffic cannot identify your connection.
- Peer-to-peer sessions are harder: games and communication tools may need relay servers.
- Reputation is shared: abuse by another subscriber using the same public address can affect rate limits or blocklists.
- Logs are less intuitive: one public address can represent many customers, and one customer can appear through several gateways.
What you can do
Ask the provider whether it offers a public IPv4 address, a static address, native IPv6, or a business tier. A public address may cost extra and still be dynamic. Native IPv6 can permit end-to-end addressing, but the router firewall must remain enabled and the application must support IPv6 safely.
For occasional remote access, an outbound tunnel or authenticated overlay network can work without inbound port forwarding. Choose a method designed for your application rather than disabling router protections.
CGNAT versus double NAT
Double NAT often occurs when an ISP modem-router and a personal router both perform translation. Unlike CGNAT, you may control both layers and can switch one device to bridge or access-point mode. If your personal router’s WAN address matches a private address assigned by another device in your home, inspect the local topology before blaming the carrier.