Carrier-grade NAT allows an internet provider to share limited public IPv4 addresses among many customers. A home router performs one translation, and the provider performs another before traffic reaches the internet.
How to recognize it
Compare the router's WAN address with the public address reported by a trusted site. If they differ and the WAN address falls in shared or private space, CGNAT may be active.
What it affects
- Inbound port forwarding
- Self-hosted games or services
- Remote camera access
- Attribution based only on a shared public IP
Practical options
Ask the ISP for a public IPv4 address, use IPv6 where properly supported, or use an outbound tunnel service designed for the application. Do not expose administration panels directly merely to work around NAT.
CGNAT changes reachability, not normal outbound browsing. It also demonstrates why one public IP is weak proof of one person's identity.
Logs need ports and time
Because many subscribers share one public address, providers distinguish connections using source ports and precise timestamps. An IP address without that context may be insufficient for incident investigation.
Do not buy a “static IP” blindly
Ask whether the offer is a publicly routed address, whether inbound ports are filtered and whether IPv6 is available. “Static” only means the address is stable; it does not guarantee inbound reachability.
Confirm CGNAT instead of guessing
Compare the router's WAN address with the address reported by an external service. If they differ and the WAN value falls in shared or private space, the provider may be translating again. Ask the ISP directly because some networks use additional designs.
Choose the remedy by use case
Remote access may work through IPv6, a provider-issued public address, an outbound tunnel or an application relay. Port forwarding on the home router cannot control the carrier's upstream translation. Buying a static address helps only if it is publicly routed and inbound traffic is permitted.
CGNAT is not evidence that a connection is insecure. It is an address-sharing architecture whose main practical effect is loss of straightforward inbound reachability and more complex attribution.
Confirm carrier-grade NAT with two observations
Compare the WAN address shown by the router with the public address reported by an external service. If the router receives an address from a shared or private range and the values differ, the provider may be translating traffic again. A traceroute and the provider's documentation can strengthen the conclusion.
CGNAT conserves IPv4 space but makes unsolicited inbound connections difficult. Port forwarding on the home router cannot control the provider's translation. Game hosting, remote access and some peer-to-peer applications may therefore fail even though ordinary browsing works.
Choose a remedy for the use case
Ask the provider about a publicly routed IPv4 address, native IPv6 or a business service. A tunnel or relay can help selected applications, but it adds another operator and security boundary. “Static IP” only means stable, so confirm that inbound traffic is supported.
For investigations, a shared public IP needs source ports and precise timestamps to distinguish subscribers. An address alone may be insufficient evidence of which customer created a connection.