> For the complete documentation index, see [llms.txt](https://docs.ipcheck.ing/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ipcheck.ing/knowledge-base/concepts/public-private-cgnat.md). # Public, Private & CGNAT Addresses Your router says your address is `192.168.1.14`. A website says it is `203.0.113.42`. Which one is real? Both. They are addresses at different levels, and understanding the difference explains a great deal about how home internet works. ## Two kinds of address Think of an office building. The building has one street address that the postal service knows. Inside, each desk has a room number that only makes sense within the building. IP addresses work the same way. * A **public address** is unique on the whole internet. It is what websites see. * A **private address** is only meaningful inside one local network. Millions of homes use the exact same private addresses at the same time, and that is fine, because those addresses never travel across the internet. Certain IPv4 ranges are reserved for private use. They are defined in a document called RFC 1918, and you will recognise them: | Range | Written as | Where you usually see it | | --------------------------------- | ---------------- | --------------------------------------- | | `10.0.0.0` – `10.255.255.255` | `10.0.0.0/8` | Larger home, office and campus networks | | `172.16.0.0` – `172.31.255.255` | `172.16.0.0/12` | Business networks, container networks | | `192.168.0.0` – `192.168.255.255` | `192.168.0.0/16` | Almost every home router | A few other ranges are special too. `127.0.0.1` always means "this device itself". Addresses starting with `169.254` mean your device failed to get a proper address and made one up. If the address on your computer starts with one of these, it is a private address. It cannot receive traffic from the internet directly. ## NAT: the receptionist If your laptop has a private address that the internet cannot reach, how do web pages get back to you? Your router performs **Network Address Translation**, or NAT. When your laptop sends a request, the router rewrites the sender's address from the private one to the router's own public one, and writes down which internal device the request came from. When the reply arrives, the router looks up its notes and passes the reply to the right device. It behaves like a receptionist in that office building. Outgoing mail leaves with the building's street address on it. Incoming mail arrives at the front desk, and the receptionist knows which room to deliver it to — because they wrote down who sent the original letter. ```mermaid flowchart LR A["Laptop
192.168.1.14"] --> R B["Phone
192.168.1.22"] --> R C["TV
192.168.1.31"] --> R R["Home router
NAT"] --> I["Internet
sees 203.0.113.42"] ``` This is why every device in your home appears to websites as the same single address. NAT was not invented for security, but it has a side effect that acts like it: because there is no note in the router's book for traffic nobody asked for, unsolicited incoming connections have nowhere to go and are dropped. ## CGNAT: a second receptionist Now add the IPv4 shortage from [IPv4 vs IPv6](/knowledge-base/concepts/ipv4-vs-ipv6.md). There are not enough public addresses for every customer to have one. So many providers apply NAT a second time, in their own network. Your router still translates your home devices onto one address — but that address is not public either. It is another shared address, and the provider's equipment translates it again onto a public address shared with many other customers. This is **Carrier-Grade NAT**, usually shortened to CGNAT. ```mermaid flowchart LR D["Your devices
192.168.x.x"] --> R["Home router"] R --> C["ISP address
100.64.x.x"] C --> G["Carrier NAT"] G --> P["Public address
shared with
other customers"] P --> I["Internet"] ``` There is a dedicated address range for the middle layer: **`100.64.0.0/10`**, covering `100.64.0.0` through `100.127.255.255`. It is reserved specifically for carrier-grade NAT, so if your router's own "WAN" or "internet" address falls in that range, you are behind CGNAT. Some providers use other ranges instead, so the reverse is not proof of anything. ## Why providers do it * IPv4 addresses are scarce and expensive. Sharing one public address among dozens or hundreds of customers saves a great deal of money. * Mobile networks have used this approach for years, because they have enormous numbers of subscribers and very few addresses. * It is invisible for ordinary browsing, so most customers never notice. ## What CGNAT costs you For reading news and watching video, nothing. For anything that expects the outside world to reach *in*, it matters. * **Port forwarding does not work.** You cannot open a port on your home router and expect it to be reachable, because the provider's NAT sits above it and knows nothing about your rule. * **Self-hosting is hard.** A home server, a security camera you want to check remotely, a personal file share — all become difficult. * **Some games and peer-to-peer apps degrade.** They still work, but connections may fall back to relay servers, which adds latency. This is often reported as a "strict" or "moderate" NAT type. * **You share a reputation.** If another customer behind the same public address behaves badly, the CAPTCHA or block may land on you too. * **Your apparent location can drift.** The provider's exit point may be in a different city from you. See [Why Is My IP Location Wrong?](/knowledge-base/diagnose/why-is-my-ip-location-wrong.md). The usual remedies are asking your provider for a public IPv4 address (sometimes free, sometimes paid), or using IPv6, which has enough addresses that CGNAT is unnecessary. ## Common misconceptions **"A private address means I am anonymous."** No. Websites never see your private address; they see the public one. Your private address is not a disguise, it is just a room number. **"My router shows 192.168.1.1, so I am not behind CGNAT."** That is your router's address on the *inside*. What matters is the address on its internet-facing side. **"NAT is a firewall."** It blocks unsolicited incoming connections as a side effect, which is genuinely useful, but it is not a security product and does nothing about outgoing traffic or anything already inside your network. **"CGNAT means my connection is slow."** Not directly. It adds a small amount of processing, but the visible effects are about reachability, not speed. {% hint style="info" %} **See it yourself on MyIP** Not sure which side of this you are on? Walk through [Am I Behind CGNAT?](/knowledge-base/diagnose/am-i-behind-cgnat.md), which compares the address your router reports with the public address MyIP sees, and shows you what a `100.64.x.x` address means in practice. {% endhint %} ## Related concepts * [IPv4 vs IPv6](/knowledge-base/concepts/ipv4-vs-ipv6.md) — why the addresses ran out in the first place * [What Is WebRTC?](/knowledge-base/concepts/what-is-webrtc.md) — how apps work around NAT to connect directly * [GeoIP: How IP Geolocation Works](/knowledge-base/concepts/geoip-explained.md) — why a shared exit changes your apparent location * [Why Do Sites See a Different IP?](/knowledge-base/diagnose/why-do-sites-see-a-different-ip.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.ipcheck.ing/knowledge-base/concepts/public-private-cgnat.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.