What Is CGNAT?

How CGNAT works

At home, your router performs NAT: devices on your network have private addresses, and the router shares its one public address among them. CGNAT adds a second layer inside the provider's network. Your router, or your phone, gets a private address from the provider, and the provider's NAT shares a pool of public addresses among thousands of subscribers.

The private addresses need a range that will not clash with the ones people use at home. RFC 6598, published in April 2012, reserved 100.64.0.0/10 for this as Shared Address Space and kept it distinct from the RFC 1918 private ranges. IANA's special-purpose address registry lists it.

The operator rules are in RFC 6888, the requirements for carrier-grade NATs. Each outbound connection gets a mapping from the subscriber's private address and port to a public address and port. To reconstruct who used an address, the operator logs mappings with a timestamp, and RFC 7422 describes assigning each subscriber a fixed range of ports to cut the size of those logs.

Why carriers rely on CGNAT

IPv4 has about 4.3 billion addresses and they ran out at the regional registries years ago. A mobile operator with millions of devices cannot give each one a public IPv4 address, so it shares them.

How common is it? The most cited measurement is Richter and colleagues, A Multi-perspective Analysis of Carrier-Grade NAT Deployment, presented at IMC 2016. Combining BitTorrent crawls with an in-app network test, they found CGNAT in more than 90% of the cellular networks they could test, and in roughly 17 to 18% of non-cellular access networks. They also found more CGNAT where IPv4 addresses were scarcer. The numbers are from 2016; the direction since then, with more devices and no new IPv4 space, has only made sharing more common.

What CGNAT breaks

RFC 6269, the IETF's review of issues with IP address sharing, lists the side effects. The ones people meet most:

• No incoming connections. You cannot forward a port on a carrier's NAT, so hosting a game server or a camera stream from home or a phone fails.
• Shared reputation. RFC 6269 notes that when a spammer sits behind a CGN, blocklisting that IP restricts every other subscriber sharing it.
• Address-based access rules. An allowlist that trusts one IP trusts everyone behind that address.
• Coarser location. The public address belongs to the operator's NAT, which may be in another city.

For most browsing none of this is visible. It shows up in hosting, gaming and anything that treats an IP as a person.

Why sites go easy on shared mobile IPs

The shared-reputation problem cuts both ways. A site that bans a carrier address may block a large number of real customers on that network. Anti-abuse teams know this, so on carrier ranges they tend to lean on cookies, logins, device signals and behavior, and use the IP as one input among several. That is a reasoned inference from address sharing, not a published rule of any particular site.

It is also why mobile proxies exist. Traffic from a carrier IP looks like the many ordinary subscribers who share it. The deeper version of this argument, including what it does not protect against, is in CGNAT and mobile proxy trust. For how a UK carrier's addressing behaves in practice, see Three UK IP changes and CGNAT.

Check whether your connection uses CGNAT

Compare two addresses: the one your router or phone was given, and the one websites see.

1. Find the WAN address on your router's status page, or the IP address in your phone's network details.
2. Find your public address:

# 1. Your public IPv4 address, as websites see it
curl -s https://api.ipify.org

# 2. Is an address inside the shared CGNAT range?
python3 -c "import ipaddress; print(ipaddress.ip_address('100.72.3.9') in ipaddress.ip_network('100.64.0.0/10'))"
True

If the router's WAN address is in 100.64.0.0/10 and the public address is different, the provider is translating for you: that is CGNAT. Some providers use other private ranges for the same purpose, so a WAN address in 10.0.0.0/8 that differs from the public IP points the same way. A traceroute that shows hops in 100.64.0.0/10 is another sign.

CGNAT and IPv6

IPv6 has enough addresses for every device, so it does not need sharing. Many mobile operators run IPv6 natively and keep CGNAT, or a translation technique such as NAT64, only for traffic that still needs IPv4. Sites reachable over IPv6 then see a per-device address, while IPv4-only sites see the shared CGNAT address.

This describes carrier networks in general. It is not a statement about which address families any particular proxy product supports.

CGNAT and mobile proxies

A mobile proxy's public address is the carrier's, so it usually sits behind the same CGNAT as ordinary subscribers. On a dedicated Coronium line, the device and SIM are rented to one customer and no other Coronium customer uses that line; the carrier may still share the public address with its own subscribers, as it does for every phone on the network.

When you rotate a line, the device reconnects and the carrier assigns a new mapping, often on a different public address. Rotation on a mobile line is a carrier event, not a switch inside a pool. Coronium allows one rotation per 60 seconds at most.

Frequently asked questions