CGNAT
Carrier-grade NAT, the technique of putting many subscribers behind one shared public IP address to conserve scarce IPv4 space.
Carrier-grade NAT is what providers do when they run out of IPv4 addresses and still have customers to connect. Instead of giving each subscriber a public address, the provider issues private ones internally and translates all of them through a small pool of shared public addresses. It is ordinary home NAT applied a second time, at the scale of an entire carrier, which is where the name comes from.
The consequence is that one visible address can represent a great many separate people. Dozens or hundreds of households on a fixed-line network, and on mobile networks routinely more than that, since cellular carriers have the least IPv4 per subscriber and lean on it hardest. Ordinary home NAT hides the devices in one house behind one address; carrier-grade NAT hides many houses behind one.
That single fact is the whole reason mobile proxies sit at the top of the trust hierarchy, and it is worth being precise about the mechanism because it is not a compliment. Sites are cautious with those addresses because blocking one risks locking out every real customer behind it, and the site cannot tell which of them misbehaved. The restraint protects them, and you benefit from standing in the crowd.
The same mechanism cuts the other way on residential supply, which people notice less often. In markets that depend heavily on carrier-grade NAT, a residential address is not the clean one-per-household identity the phrase implies. It may already be carrying a crowd before your traffic joins it, which means the reputation you inherit is a shared one and the request volume the address shows is not all yours.
It also creates a real limitation worth knowing: a connection behind carrier-grade NAT cannot accept inbound connections, because there is no unique public address to direct them to. That is invisible for ordinary browsing and immediate for anything that needs to be reachable from outside, which is one practical reason some residential supply is outbound-only.
Frequently asked questions
How do I know if I am behind CGNAT?
Compare the address your router reports on its WAN interface with the public address a website says you have. On an ordinary connection they match. Behind carrier-grade NAT your router holds a private address, commonly in the 100.64 to 100.127 range reserved for exactly this, while the public address is shared upstream. Mobile connections are behind it almost universally.
Why does CGNAT make mobile proxies more trusted?
Because it makes blocking expensive for the site rather than because anyone trusts you. When one address carries many genuine subscribers, banning it locks out real customers, and the site has no way to tell which user was the problem. The address inherits the benefit of the doubt that the crowd behind it has earned.
Does CGNAT affect residential proxy quality?
It can, and not in your favour. In markets that rely on it heavily, a residential address may already be shared by other households, so the reputation you inherit and the request volume visible from that address are not solely yours. It is one reason a country's residential supply can behave quite differently from another's despite both being labelled residential.
Can I receive inbound connections behind CGNAT?
Not directly, because there is no unique public address that identifies your connection. Nothing outside can address you specifically. It makes no difference to ordinary outbound browsing or scraping, and it rules out anything that needs to be reachable from the internet without a relay in between.
Back to the full glossary.