> For the complete documentation index, see [llms.txt](https://docs.ipcheck.ing/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ipcheck.ing/knowledge-base/diagnose/am-i-behind-cgnat.md).

# Am I Behind CGNAT?

If port forwarding does nothing, a game insists your connection type is "strict", or a home server is unreachable from outside, this is usually the reason.

{% hint style="success" %}
**Quick answer.** Log into your router and find its WAN IP address. Compare it with the address shown on [ipcheck.ing](https://ipcheck.ing). **Same address** — you have a real public IP. **Different** — your ISP has put you behind carrier-grade NAT, and you share one public address with other customers.
{% endhint %}

## What CGNAT is, briefly

The world ran out of IPv4 addresses, so many ISPs stopped giving each customer one. Instead they place hundreds or thousands of customers behind a shared translator: outgoing connections work normally, but there is no address that belongs to you alone.

It is the same trick your home router already plays on your devices, applied one level higher — hence "carrier-grade". Longer explanation: [Public, Private & CGNAT Addresses](/knowledge-base/concepts/public-private-cgnat.md)

## The check

{% stepper %}
{% step %}

#### Find your router's WAN address

Open your router's admin page — usually `192.168.1.1` or `192.168.0.1` — and look for a status page. The field you want is labelled **WAN IP**, **Internet IP**, or **External IP**. Write it down.
{% endstep %}

{% step %}

#### Find the address the internet sees

Open [ipcheck.ing](https://ipcheck.ing) and read the IPv4 address on the first card in [IP Infos](/knowledge-base/connection-tools/ip-information.md). Turn off any VPN or proxy first, or you will be comparing against the VPN exit instead.

From a terminal, the same thing in one line:

```bash
curl 4.ipcheck.ing
```

{% endstep %}

{% step %}

#### Compare

| Result                                                                  | Meaning                                                                               |
| ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
| The two addresses match                                                 | You have a real public IPv4 address. Port forwarding will work.                       |
| They differ                                                             | **You are behind CGNAT.** Your router's WAN address is not visible from the internet. |
| The router's WAN address starts with `100.64.` – `100.127.`             | Confirmed CGNAT. That range is reserved for exactly this purpose.                     |
| The router's WAN address is `10.x`, `192.168.x`, or `172.16`–`172.31.x` | Also not public — either CGNAT, or your router sits behind another router             |
| {% endstep %}                                                           |                                                                                       |
| {% endstepper %}                                                        |                                                                                       |

{% hint style="info" %}
**The telltale range is `100.64.0.0/10`** — that is every address from `100.64.0.0` to `100.127.255.255`. It was set aside specifically for carrier-grade NAT, so seeing it on your WAN interface is as close to a definitive answer as you will get.
{% endhint %}

## Other signs, without opening the router

None of these is proof on its own, but together they make a strong case.

| Sign                                                            | Why it points to CGNAT                                                                                                                 |
| --------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| Port forwarding is configured correctly but nothing reaches you | Incoming connections never get past the carrier's translator                                                                           |
| A game reports "strict NAT" or "NAT type 3"                     | Your device cannot receive direct incoming connections                                                                                 |
| Your public address changes several times a day                 | You are being assigned from a shared pool                                                                                              |
| The reported city is a large hub far from home                  | Traffic exits through a regional gateway — see [Why Is My IP Location Wrong?](/knowledge-base/diagnose/why-is-my-ip-location-wrong.md) |
| You have an IPv6 address but no usable public IPv4              | A very common modern ISP configuration                                                                                                 |

{% hint style="warning" %}
The **WebRTC Leak Test** cannot answer this question. MyIP deliberately shows only the address a STUN server reports back — your public-facing address — and not your device's local addresses. It tells you what the outside world sees, not what is on your router's WAN port.
{% endhint %}

## What it actually breaks

**Works normally:** browsing, streaming, video calls, online gaming as a client, cloud services. Anything where *you* start the connection is unaffected.

**Breaks or becomes awkward:**

* Port forwarding of any kind
* Hosting a game server, a Minecraft world, or a Plex/Jellyfin server for friends
* Reaching your home NAS or security cameras from outside
* Remote desktop into your home machine
* Some peer-to-peer transfers, which fall back to slower relayed connections
* Hosting a website from home

## Your options

### 1. Use IPv6

Often the cleanest answer. Most ISPs that deploy CGNAT also hand out real, globally routable IPv6 addresses — one per device, no translation involved.

Check whether you have one: look at the **IPCheck.ing IPv6** card, or run `curl 6.ipcheck.ing`. If you get an address back, IPv6 works.

The catch is that whoever connects to you also needs IPv6. That is increasingly common on mobile networks and increasingly likely at home, but it is not universal.

### 2. Ask your ISP for a public IPv4

Many ISPs will move you off CGNAT if you ask. Some do it for free, some charge a small monthly fee, some only offer it on business plans. Ask specifically for "a public IPv4 address, not behind CGNAT" — the phrasing matters, because front-line support often confuses this with a static address.

### 3. Use a tunnel

Services and tools exist that give you a reachable address by relaying traffic through a machine that has one. Options range from consumer remote-access tools to self-hosted reverse tunnels on a cheap virtual server. This works regardless of CGNAT, because the connection is always started from your side.

### 4. Rent a small server

If you are hosting something anyway, hosting it somewhere with a real public address sidesteps the problem entirely.

<details>

<summary>Is CGNAT bad for privacy?</summary>

In one narrow sense it helps: your address is shared with strangers, so it identifies you less precisely. In practice this matters little, because tracking mostly relies on cookies and browser fingerprints rather than addresses — see [Browser Fingerprinting Explained](/knowledge-base/concepts/browser-fingerprinting.md).

It has one real downside. Sharing an address with hundreds of people means sharing their reputation. If one of them attracts a block or a rate limit, you can be caught by it, which is why you may see more CAPTCHAs than usual.

</details>

<details>

<summary>Is a static IP the same as a public IP?</summary>

No, and this trips up a lot of support conversations. **Public** means reachable from the internet. **Static** means it does not change. You can have a public address that changes weekly, which is fine for most self-hosting when paired with a dynamic DNS service. What you cannot work around is an address that is not public at all.

</details>

<details>

<summary>My router shows a public address but forwarding still fails</summary>

Then CGNAT is not your problem. Check for a second router or a modem in router mode creating a double-NAT, check the firewall rules on the forwarding device, and confirm the service is actually listening. Test from outside your own network — many routers will not let you reach your own public address from inside.

</details>

## Still stuck?

* [Public, Private & CGNAT Addresses](/knowledge-base/concepts/public-private-cgnat.md) — the concept in full
* [IPv4 vs IPv6](/knowledge-base/concepts/ipv4-vs-ipv6.md) — why IPv6 solves this
* [Why Do Sites See a Different IP?](/knowledge-base/diagnose/why-do-sites-see-a-different-ip.md) — when addresses legitimately differ


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.ipcheck.ing/knowledge-base/diagnose/am-i-behind-cgnat.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.