Carrier-grade NAT allows an internet provider to share limited public IPv4 addresses among many customers. A home router performs one translation, and the provider performs another before traffic reaches the internet.
How to recognize it
Compare the router's WAN address with the public address reported by a trusted site. If they differ and the WAN address falls in shared or private space, upstream NAT may be active. The shared IPv4 range is 100.64.0.0/10, from 100.64.0.0 to 100.127.255.255; it is distinct from RFC 1918 private space. A second local router can also produce a mismatch, so ask the ISP whether it uses CGNAT.
What it affects
- Inbound port forwarding
- Self-hosted games or services
- Remote camera access
- Attribution based only on a shared public IP
Practical options
Ask the ISP for a public IPv4 address, use IPv6 where properly supported, or use an outbound tunnel service designed for the application. Do not expose administration panels directly merely to work around NAT.
CGNAT changes reachability, not normal outbound browsing. It also demonstrates why one public IP is weak proof of one person's identity.
Logs need ports and time
Because many subscribers share one public address, providers distinguish connections using source ports and precise timestamps. An IP address without that context may be insufficient for incident investigation.
Do not buy a “static IP” blindly
Ask whether the offer is a publicly routed address, whether inbound ports are filtered and whether IPv6 is available. “Static” only means the address is stable; it does not guarantee inbound reachability.
An outbound tunnel or relay adds another operator and security boundary. Evaluate that provider and application access controls before relying on it for remote access.