What CGNAT is

There are not enough IPv4 addresses for every home, so many ISPs share one public address among many customers. Your router gets a private address from the ISP instead of a public one. Outgoing connections work normally, but nobody on the internet can start a connection to you, so port forwarding for a game server, CCTV or a home lab has no effect.

How to check

1. Open your router’s status page and note the WAN (internet) IP address.
2. Search “what is my IP” in a browser on the same connection.
3. If the two differ, or the WAN address starts with 100.64 to 100.127 (the 100.64.0.0/10 shared range), you are behind CGNAT. Addresses starting 10., 172.16–172.31 or 192.168. on the WAN side also mean another NAT sits above you.

Use the CIDR calculator to see what a range like 100.64.0.0/10 covers.

Your options

• Ask your ISP for a public IP. Some ISPs offer one on request or with business or static-IP plans. Availability and price vary, so ask support directly.
• Use IPv6. If your ISP and router hand out IPv6, devices can be reachable over IPv6 without CGNAT. Visitors need IPv6 too.
• Use a tunnel to a VPS. A small VPS with a public IP can forward traffic to your home over WireGuard. You control it, but you maintain it.
• Use a tunnel service. Tools such as Cloudflare Tunnel publish a web app at home without opening ports.
• Use a mesh VPN to reach your own devices. NordVPN’s Meshnet or similar tools link your devices into a private network, which suits remote access to your own NAS or PC.

What about gaming?

CGNAT mostly affects hosting: other players can’t connect to a game server on your home PC. It rarely matters for joining online games. A VPN will not usually lower your ping and can raise it. If you want to host for friends, a game server on a VPS avoids CGNAT completely.

Sources (checked 13 Nov 2026): NordVPN Meshnet, RFC 6598 (100.64.0.0/10).