What Is CGNAT? Carrier-Grade NAT and Why Strangers Share One IP

CGNAT, short for carrier-grade NAT, is how an internet provider shares one public IPv4 address among many subscribers. RFC 6888 defines it as a NAT function "used to share the same IPv4 address among several subscribers". It exists because IPv4 ran out. It is also nearly universal on mobile networks: a 2016 study found it in more than 90% of them. For proxies it settles two things. A shared address is costly for a site to block, and a device behind one cannot take incoming connections.

What is CGNAT?

CGNAT is network address translation run by the internet provider, one level above your home router. Your router already shares one address among the devices in your home. A carrier-grade NAT does the same for thousands of customers, so many homes or phones leave the internet from one public IPv4 address.

The provider runs it, and the subscriber has no control over it. RFC 6888 says so plainly: "A CGN is not managed by the subscribers."

How does carrier-grade NAT work?

Follow one request. Your device has a private address from your router, and your router has a private address from the provider. When you load a page, the provider's NAT rewrites the source to one of its shared public addresses. It remembers the mapping, so the reply finds its way back. Your traffic is translated twice, which is why engineers also call this setup NAT444.

The sharing runs on ports. Each connection behind the shared address gets its own port number, and RFC 6888 sets rules for handing them out. REQ-4 says a CGN "MUST support limiting the number of external ports" per subscriber, so one heavy user cannot take them all. REQ-8 says a freed port should wait "at least 120 seconds" before it goes to someone else.

What is the 100.64.0.0/10 range?

It is the Shared Address Space, reserved in April 2012 by RFC 6598. The RFC set it aside "to accommodate the needs of Carrier-Grade NAT (CGN) devices". Providers use it to number the link between their NAT equipment and your router. It runs from 100.64.0.0 to 100.127.255.255, which is 4,194,304 addresses.

A separate range was needed because homes already use the private ranges. If the provider numbered its side with 10.x addresses and your home network used 10.x too, the two would collide. RFC 6598 notes that Shared Address Space "is intended for use on Service Provider networks", unlike the private ranges of RFC 1918.

Why do internet providers use CGNAT?

IPv4 has room for about 4.3 billion addresses, and the registries ran out of free ones in the early 2010s. Cloudflare puts it simply: "While the long-term solution is the transition to IPv6, CGNAT emerged as the immediate, practical workaround."

How common is it? A study presented at the ACM Internet Measurement Conference in 2016 found CGNAT in 17 to 18% of the networks that connect end users. In cellular networks it found it in more than 90%. Some operators in that study reported as many as 20 subscribers per IPv4 address. Cloudflare wrote in 2025 that "a single IPv4 address may represent hundreds or even thousands of users".

How do you know if you are behind CGNAT?

Compare two addresses:

1. Your public IP. Our proxy IP checker shows the address a site sees.
2. Your router's WAN address. Open the router's admin page and read the internet or WAN address.

If the WAN address falls between 100.64.0.0 and 100.127.255.255, you are behind CGNAT. If it is another private address, such as 10.x or 192.168.x, some other NAT sits in front of you. That holds whenever it differs from your public IP. If the two match, you hold a public address of your own. On mobile data, CGNAT is the normal case.

Is CGNAT bad?

For browsing, streaming and apps that only connect outward, you will rarely notice it. It hurts in two places: incoming connections and shared reputation.

Incoming connections. Nothing on the internet can open a connection to you, because the public address is not yours alone. Port forwarding, game servers and remote access to a home device break. The IETF tested real applications behind CGNAT for RFC 7021. Some "did not first send outgoing traffic and hence did not open an incoming port through the CGN". Peer-to-peer gaming on Xbox failed in those tests.

Shared reputation. Whatever one user does, every user on the address carries. RFC 7021 warns about a shared address that "is added to a blacklist" or meets a per-address connection limit. Either way, "it could negatively impact legitimate users". Cloudflare measured exactly that in 2025:

The median bot rate was 4.8% on CGNAT addresses against 4.7% on others, and the mean was lower, 7% against 13.1%. Yet CGNAT addresses were "subject to rate limiting three times more often than non-CGNAT IPs". Per-address rules punish the crowd for one user.

There is one upside. Cloudflare notes that CGNAT has "the positive side effect of protecting many home devices that might be vulnerable to compromise". Nothing outside can reach them directly.

Does CGNAT hide who you are?

It hides you from the website, which sees only the shared address. It does not hide you from your provider. RFC 6888 notes that a provider may need "to identify a subscriber" from the external address, port and timestamp. The reason it gives is "to deal with abuse". RFC 6302 asks the other side to keep its half of that trail. It recommends that internet-facing servers log the source port of each connection, along with the address and an accurate timestamp.

With those three values, a provider can trace a request back to one subscriber. Sharing an address spreads its reputation across many people, and a log can still single one of them out.

Is CGNAT the same as a proxy or a VPN?

They sit in different places. Your provider runs CGNAT, and you cannot choose or switch it off. A proxy is something you pick: RFC 9110 defines it as "a message-forwarding agent that is chosen by the client". You can use a proxy from behind CGNAT, and then a site sees the proxy's exit address and never your provider's shared one.

How do you get a public IP address back?

Ask your provider first. RFC 6888 expects CGNAT to run alongside other services, "such as IPv6 services or regular IPv4 service assigning public addresses to subscribers". Some providers offer a public IPv4 address as an option. Where your provider and the other side both support IPv6, that traffic needs no shared address at all. For a service that must accept incoming connections, hosting it on a server with its own public address also works.

Does IPv6 replace CGNAT?

Over IPv6, yes, where the provider offers it. IPv6 has enough addresses for every device, so IPv6 traffic needs no shared IPv4 address. Adoption is uneven. APNIC Labs measures the share of users who can use IPv6 in each country:

Where IPv6 is rare, more traffic depends on shared IPv4 addresses. Cloudflare found the highest ratios of users to IPv4 addresses in large parts of Africa and South Asia. It also found that "Africa has a much higher ratio of user agents to IP addresses than other regions".

What does CGNAT mean for proxies?

Mobile proxies sit on shared addresses. A mobile proxy exits from a carrier address, and carriers run CGNAT almost everywhere. A site that blocks such an address blocks every subscriber behind it, the collateral damage RFC 7021 and Cloudflare both describe. Our guides to what a mobile proxy is and mobile vs residential proxies go further. Our mobile proxies cost $1.50 per GB.

A shared address is no free pass. Sites have started to count users behind a shared address separately. Cloudflare's rate limiting rules offer a key called "IP with NAT support". Cloudflare describes it as a way "to handle situations such as requests under NAT sharing the same IP address". Its 2025 post says it uses its CGNAT detection to tune its security features.

Reputation is shared too. We read Scamalytics' list of its highest-risk addresses on October 22, 2026. It held mobile carriers such as Claro and MTN Nigeria at a score of 100. Many people sharing one address can give it a record that none of them earned alone.

Free proxies almost never sit on mobile networks. On October 22, 2026, 4,992 free proxies were working on our list. Only 4 sat on mobile carrier addresses. A free proxy is a server that waits for strangers to connect. RFC 7021 found that an application behind CGNAT that does not connect out first opens no port the outside can reach.

A datacenter IP is the opposite case. It belongs to a hosting network, which a site can identify through its ASN, and nobody else shares it. Our dedicated datacenter addresses and IPv4 or IPv6 options cover that end, and our pricing page lists every product.

What this page could not check

• Older study. The CGNAT shares by network come from the 2016 IMC study. Newer per-network figures are not public.
• Cloudflare's view. The bot and rate-limit figures describe traffic Cloudflare sees, in a 2025 post updated July 15, 2026.
• Capable is not used. APNIC measures whether users can use IPv6. Their traffic to IPv4-only sites still needs an IPv4 address.
• Our free list only. The mobile count covers the public free proxies our checker collects.
• Check by January 22, 2027. IPv6 shares and provider practice change.

Sources

• RFC 6888: Common Requirements for Carrier-Grade NATs (CGNs). IETF, April 2013.
• RFC 6598: IANA-Reserved IPv4 Prefix for Shared Address Space. IETF, April 2012.
• RFC 7021: Assessing the Impact of Carrier-Grade NAT on Network Applications. IETF, September 2013.
• A Multi-perspective Analysis of Carrier-Grade NAT Deployment. Richter and others, ACM Internet Measurement Conference, 2016.
• One IP address, many users: Detecting CGNAT to reduce collateral effects. Cloudflare blog, October 29, 2025, updated July 15, 2026.
• Rate limiting rule parameters. Cloudflare developer documentation, read October 22, 2026.
• IPv6 measurement per country. APNIC Labs, 30-day average to October 19, 2026, read October 22, 2026.
• IP fraud check, list of high-risk addresses. Scamalytics, read October 22, 2026.
• HProxy free proxy list, working addresses by network type, October 22, 2026, 06:57 UTC.