CGNAT check: are you behind carrier-grade NAT?
Port forwarding doesn't work and you want to know why. This check compares your router's WAN IP with the public IP the internet sees. You get a yes or no, and what still works if the answer is yes.
1. Your public IP
The address this page sees your request coming from.
Looking it up… An IPv6 address Couldn't read it. Enter it below.
curl -4 https://expose.dev/cgnat-check/ip
On Windows, type curl.exe instead of curl.
On a VPN or iCloud Private Relay? Then this is the VPN's address. Switch it off and reload, or .
The IPv4 address your router got from your ISP, from its status page.
Where do I find it?
-
1. Find your router's address: the default gateway.
On Windows, run
ipconfig. On macOS, runroute -n get default. On Linux, runip routeand look afterdefault via. It is often 192.168.0.1, 192.168.1.1 or 10.0.0.1. - 2. Open that address in your browser and sign in. The password is often printed on a sticker on the router.
- 3. On the status, overview or Internet page, look for WAN IP, Internet IP, IPv4 address or Public IP in the Internet or WAN section.
- 4. Don't use the router's LAN address, the one you just opened, or your computer's own IP. Those are addresses on your own network.
Can't sign in to the router? Use the traceroute method below.
Enter your router's WAN IP to get the answer.
That isn't an IP address. Copy the WAN or Internet IPv4 address from your router's status page, such as 100.72.14.9.
That's an IPv6 address.
CGNAT only affects IPv4. Look for the WAN IPv4 address on the same page. If your router shows no IPv4 address at all, or one starting with 192.0.0., your ISP carries your IPv4 traffic through its own NAT (DS-Lite or a similar setup). That works like CGNAT: inbound IPv4 connections can't reach you.
Yes, you're behind CGNAT.
Your router's WAN IP is in 100.64.0.0/10, the shared address space ISPs use for carrier-grade NAT (RFC 6598). Port forwarding on your router can't work over IPv4: inbound connections stop at your ISP's NAT.
Yes, your IPv4 is shared through your ISP (DS-Lite).
is in 192.0.0.0/29, the range DS-Lite uses between your router and your ISP (RFC 6333). Your IPv4 traffic goes through the ISP's NAT, so for IPv4 this is the same as CGNAT. You do get native IPv6, so opening a port over IPv6 can work.
Another NAT sits in front of your router.
is a private address (RFC 1918), so something between your router and the internet translates it. That's either a modem or second router in front of yours (double NAT), or your ISP's NAT.
If there's another box in front of your router, open its admin page and check its WAN IP. If that one is your public IP, it's double NAT: put that box in bridge mode, or forward the port on both. If there's no other box you control, it's your ISP's NAT, which works like CGNAT. And check this is the WAN address, not the router's own LAN address.
Your router has no Internet address yet.
means the router didn't get an address from your ISP. Check the connection, then run the check again.
That isn't an address an ISP gives a router.
is a loopback, multicast, reserved or special-purpose address. Check that you copied the WAN or Internet IPv4 address.
Your router has a public WAN IP.
is a public address.
No, you're not behind CGNAT.
Your router's WAN IP is the public IP the internet sees, . Port forwarding can work: forward the port on the router and allow it in the router's firewall. If it still fails, your ISP may block that port, or your public IP has changed since.
Probably yes: your WAN IP isn't your public IP.
Your router reports , but your traffic reaches the internet from . Another NAT translates it on the way, most likely your ISP's CGNAT. First rule out a VPN or iCloud Private Relay on this device, and a router with a second, backup connection. If none applies, inbound connections won't reach your router.
This tool doesn't log or store IP addresses. Your public IP is read from your request only to show it to you. The addresses and traceroute output you enter are checked in your browser and never sent to us.
Can't sign in to your router? Use traceroute
Trace the route to your own public IP. If your router holds that address, it answers at the first hop. If the address sits further out, at your ISP, something in between is doing NAT. Run this in a terminal and paste the whole output below.
macOS and Linux
traceroute -n -m 8 1.1.1.1
Windows
tracert -d -h 8 1.1.1.1
Without your public IPv4 this traces to 1.1.1.1 instead, which can show a CGNAT address on the way but gives a weaker answer.
On Linux without traceroute, tracepath -n works too.
No hops found. Paste the whole output, including the numbered lines.
No hop answered with an address. Run it again, or use the WAN IP check above.
No CGNAT. Your router answered for at the first hop, so the public IP is on your router.
Behind CGNAT. Hop is , in the 100.64.0.0/10 range ISPs use for carrier-grade NAT. One exception: VPNs such as Tailscale use the same range, so if one runs on this computer, switch it off and trace again.
Another NAT holds your public IP. only answered at hop , so it isn't on your router. That's a second router at home (double NAT) or your ISP's NAT. Check the WAN IP of the router at hop 1 to tell which.
Inconclusive. Your public IP never answered. A router that holds the address usually answers at the first hop, so this points to NAT further out, but some routers don't answer traceroute at all. The WAN IP check above settles it.
Inconclusive. Only the first hop answered, so the trace can't tell. Run it again, or use the WAN IP check above.
Inconclusive. After your router, these hops use private addresses: . That can be a second router, your ISP's NAT, or private addresses inside your ISP's network. Tracing to your own public IP, with the first line of the output included, gives a clearer answer.
Your IPv4 is shared through your ISP (DS-Lite). Hop is , in the 192.0.0.0/29 range DS-Lite uses (RFC 6333). For IPv4 this works like CGNAT: no inbound connections.
Inconclusive. No public address answered after your router, so the trace can't tell. Use the WAN IP check above.
No sign of CGNAT. After your router, the hops that answered are public addresses. That's a good sign, not proof: the WAN IP check above is the reliable one.
How the check works
Your router's WAN IP is the address your ISP gave it. Your public IP is the address websites see. Without CGNAT they are the same. The check first looks at which range the WAN IP is in, then compares the two:
| Router WAN IP | What it means |
|---|---|
| 100.64.0.0 to 100.127.255.255 | CGNAT. RFC 6598 set this range aside as shared address space for carrier-grade NAT. |
| 192.0.0.0 to 192.0.0.7 | DS-Lite (RFC 6333). Your IPv4 goes through the ISP's NAT, like CGNAT. |
| 10.x, 172.16.x to 172.31.x, 192.168.x | Private (RFC 1918). Another router in front of yours (double NAT) or the ISP's NAT. |
| Public, and the same as your public IP | You have a public IPv4. Port forwarding can work. |
| Public, but different from your public IP | Probably CGNAT, unless a VPN or a backup connection explains it. |
| 169.254.x.x | The router has no address from the ISP yet. |
The check only looks at IPv4 addresses. It can't see whether your ISP blocks a port, and a VPN on this device changes the public IP it sees. A WAN IP in the CGNAT range settles it; a mismatch is strong evidence but not proof.
A worked example
Your router's status page lists the Internet IPv4 address 100.78.201.14,
and this page sees you as 203.0.113.7. 100.78.201.14 lies between
100.64.0.0 and 100.127.255.255, so the answer is CGNAT before the two are even compared. The address
203.0.113.7 belongs to your ISP's NAT and is shared with other customers. A port you forward on
your router never sees a connection, because nothing addressed to 203.0.113.7 is passed on to you.
Now say the router shows 192.168.1.50. That's private, so your router
sits behind another one, often the ISP's modem-router. Open that one, usually at 192.168.1.1 here. If its
WAN IP is 203.0.113.7, the same as your public IP, you have double NAT, not CGNAT. Bridge mode on the
modem fixes it.
What CGNAT is, and what it breaks
Carrier-grade NAT (CGNAT, or CGN) is NAT run by your ISP instead of your router. There aren't enough IPv4 addresses to give every customer one, so the ISP gives your router an address from a shared range and translates the traffic of many customers to one public IPv4 address. RFC 6598 reserved 100.64.0.0/10 for this in 2012. Those addresses aren't routed on the internet.
Everything you start from home still works: browsing, streaming, calls, a VPN app. What breaks is anything that waits for the internet to connect to you. Port forwarding does nothing, because the connection stops at the ISP's NAT before it reaches your router. That rules out hosting a website, a game server, remote access to a NAS or camera, or a VPN server at home. RFC 6598 also names peer-to-peer apps that can't seed and SIP phones that can't take incoming calls. And you share your public IP with other customers, so a block or rate limit aimed at one of them hits you too.
How to get around CGNAT
- Ask your ISP for a public IPv4 address. Some ISPs give you one on request, some charge for it, some only on business plans. Then port forwarding works as usual.
- Use IPv6. CGNAT only applies to IPv4. If your ISP gives you IPv6, your devices have global addresses: allow the port in your router's IPv6 firewall. Only visitors with IPv6 can reach you.
- Use an outbound tunnel. A client on your machine connects out to a server with a public address, and that server sends incoming traffic back through the connection. CGNAT only stops connections coming in, so this works wherever you can browse. An SSH reverse tunnel (
ssh -R) to a server you rent does the same. - Use a mesh VPN for your own devices. If only you need to reach your NAS or home server, a mesh VPN connects your devices without opening anything to the internet.
- Double NAT is easier. If the check found a private WAN IP and the box in front is yours, put it in bridge mode, or forward the port on both devices.
Share a local site or port from behind CGNAT
Expose is an outbound tunnel. The client connects out to the Expose server, so nothing has to reach your router from outside, and CGNAT, DS-Lite and double NAT don't matter. One command gives a local site a public HTTPS URL:
expose share http://localhost:3000For a service that doesn't speak HTTP, such as SSH or a database, share the TCP port:
expose share-port 22Expose doesn't tunnel UDP, so it can't host a UDP game server or a WireGuard endpoint. For those, look at Pinggy or LocalXpose, or a server you rent. And if only your own devices need access, a mesh VPN suits that better than a public URL.
curl -fsSL https://expose.dev/install.sh | sh
irm https://expose.dev/install.ps1 | iex
Questions
What is CGNAT?
Carrier-grade NAT is network address translation run by your internet provider instead of your router. Your router gets an address from a shared range, usually 100.64.0.0/10, and the ISP translates the traffic of many customers to one public IPv4 address. It saves IPv4 addresses, but connections from the internet can no longer reach you.
How do I know if I'm behind CGNAT?
Compare your router's WAN IPv4 address with the public IP a website sees. If the WAN address is between 100.64.0.0 and 100.127.255.255, you are behind CGNAT. If it is public and matches, you are not. If it is private (10.x, 172.16 to 172.31.x or 192.168.x), another NAT sits in front of your router.
What is the difference between CGNAT and NAT?
Your home router does NAT: it shares one address among your devices, and you can forward ports on it. CGNAT is a second NAT at your ISP that shares one public address among many customers. You can't configure it, so you can't forward ports through it.
Is 100.64.x.x a private IP address?
Not in the RFC 1918 sense, but it isn't public either. 100.64.0.0/10 is the shared address space that RFC 6598 set aside for carrier-grade NAT, and it isn't routed on the internet. VPN meshes such as Tailscale use the same range for their device addresses.
Is 172.16 a public IP?
No. 172.16.0.0 to 172.31.255.255 is one of the three private ranges in RFC 1918, along with 10.0.0.0/8 and 192.168.0.0/16. A router with a WAN address in these ranges has another NAT in front of it.
Can I port forward behind CGNAT?
Not over IPv4. Inbound connections stop at the ISP's NAT, so a port you forward on your router never sees them. Ask your ISP for a public IPv4 address, use IPv6, or use an outbound tunnel.
Is CGNAT bad?
For browsing, streaming and video calls you won't notice it. It is a problem if you host anything at home: a website, a game server, a NAS or a VPN server. Peer-to-peer apps can't accept incoming connections, and you share your public IP, and any block or rate limit on it, with other customers.
Does IPv6 get around CGNAT?
Yes, for visitors who have IPv6. CGNAT only applies to IPv4. With IPv6 your devices get global addresses, and you allow the port in your router's IPv6 firewall. Visitors on IPv4-only networks still can't reach you.
My router's WAN IP starts with 192.0.0. What does that mean?
Your connection uses DS-Lite (RFC 6333). Your router gets native IPv6 and sends IPv4 through a tunnel to the ISP, which translates it to a shared public IPv4. For IPv4 this works like CGNAT: no inbound connections.
Does a VPN get around CGNAT?
A regular VPN app doesn't, because it also only makes outbound connections. It helps if the VPN provider offers port forwarding. To reach only your own devices, a mesh VPN connects them without opening anything to the internet.