CGNAT: Why You Can't Port Forward and What to Do About It
The symptom is that you've set up a port forward perfectly according to the NAT documentation, but the game server, camera, or website remains unreachable from outside. Tools like canyouseeme.org show your public IP as "closed" no matter what you try. Before blaming yourself, check whether your ISP has implemented Carrier-Grade NAT (CGNAT), which means that your public address is shared with hundreds of neighbors.
What Is CGNAT?
Carrier-Grade NAT (CGNAT) is a form of network address translation where the ISP runs its own NAT on top of the NAT you have at home. This results in double NAT, making it impossible to set up port forwarding from outside your network because the outer layer of NAT does not forward ports for individual users.
How to Confirm You Are Behind CGNAT
To confirm whether you are behind CGNAT, follow these steps:
- Check Your Router's WAN Address: Look at the public IP address shown on your router.
- Compare with External Tools: Use a tool like whatismyip.com to check your public IP.
- If the addresses differ, especially if your router shows an address in the range 100.64.x.x to 100.127.x.x (the reserved space for CGNAT), you are likely behind CGNAT.
- A 10.x or 192.168.x IP on your router can also indicate CGNAT, as these addresses suggest that the ISP is doing NAT at their end.
If both show the same public IP, then it's a configuration issue, and you should refer back to the NAT documentation.
What to Do
Here are practical solutions ranked by practicality:
TUNNELS: The modern answer involves using tunnels from inside your network to punch through any NAT. For websites, consider Cloudflare Tunnel (our entire setup works flawlessly behind CGNAT). For private access to everything, use Tailscale or WireGuard to a virtual private server (VPS). PlayIt.gg and similar services are specifically designed for game servers.
ASK THE ISP FOR A REAL IP: Many ISPs offer static or non-CGNAT IPv4 addresses for $5-10 per month or will move you off CGNAT upon request, especially in business-class tiers that include it. This is often the cleanest fix for game hosting where relay latency matters.
IPV6: The structural fix involves getting a real IPv6 address from your ISP. With IPv6, services can be directly reachable without any NAT, solving the problem entirely. However, this requires every participant to have IPv6, which is why it's not yet widely used for game servers.
RENT A CHEAP VPS AS YOUR PUBLIC FRONT DOOR: This DIY version of option 1 involves using a cheap VPS as your public front door and tunneling to it. It teaches you about the process but may be more complex than necessary.
By understanding CGNAT and implementing these solutions, you can overcome the limitations imposed by shared public IP addresses and ensure your services are reachable from outside your network.