Carrier-grade NAT allows an internet provider to share limited public IPv4 addresses among many customers. A home router performs one translation, and the provider performs another before traffic reaches the internet.
How to recognize it
Compare the router's WAN address with the public address reported by a trusted site. If they differ and the WAN address falls in shared or private space, CGNAT may be active.
What it affects
- Inbound port forwarding
- Self-hosted games or services
- Remote camera access
- Attribution based only on a shared public IP
Practical options
Ask the ISP for a public IPv4 address, use IPv6 where properly supported, or use an outbound tunnel service designed for the application. Do not expose administration panels directly merely to work around NAT.
CGNAT changes reachability, not normal outbound browsing. It also demonstrates why one public IP is weak proof of one person's identity.
Logs need ports and time
Because many subscribers share one public address, providers distinguish connections using source ports and precise timestamps. An IP address without that context may be insufficient for incident investigation.
Do not buy a “static IP” blindly
Ask whether the offer is a publicly routed address, whether inbound ports are filtered and whether IPv6 is available. “Static” only means the address is stable; it does not guarantee inbound reachability.
Confirm CGNAT instead of guessing
Compare the router's WAN address with the address reported by an external service. If they differ and the WAN value falls in shared or private space, the provider may be translating again. Ask the ISP directly because some networks use additional designs.
Choose the remedy by use case
Remote access may work through IPv6, a provider-issued public address, an outbound tunnel or an application relay. Port forwarding on the home router cannot control the carrier's upstream translation. Buying a static address helps only if it is publicly routed and inbound traffic is permitted.
CGNAT is not evidence that a connection is insecure. It is an address-sharing architecture whose main practical effect is loss of straightforward inbound reachability and more complex attribution.
Sources and further reading
Use the right privacy tool for the task
A browser proxy changes the network path for one session. Review the Privacy Policy and use a trusted direct connection for sensitive accounts.