Three UK IP Address Constantly Changing?
CGNAT, MOCN & How to Get Your Public IP Back
A factual explainer on why Three UK 5G/4G broadband IPs rotate every few minutes in 2026 — and what actually fixes it.
Multiple long-running threads on the Three Community forum, ISP Review and operator-specific subreddits document the same symptom: a Three UK 5G or 4G connection — typically on the Huawei 5G CPE Pro 2 home broadband CPE — where the public IP address visibly rotates every few minutes, breaking online banking, VoIP, VPNs, and any service that needs a stable inbound endpoint. This article walks through what's actually happening, why it got worse in 2025–2026, and the workarounds that have been reliably reported to work.
1. The symptom — what users are reporting
The pattern repeats across hundreds of forum posts. Typical quotes paraphrased from public threads on Three Community and ISP Review:
- “The IP address has changed 6 times since 11am — I can't stay logged into my bank long enough to complete a transfer.”
- “Huawei 5G CPE Pro 2, brand new install, 5G home broadband. Public IP changes every few minutes. Wasn't doing this last month.”
- “3internet APN used to give me a public routable IPv4 — now I'm getting a 100.x.x.x address. CGNAT.”
- “Three support disabled IPv6 on my account and it's been stable since.”
The hardware most often named is Three's Huawei 5G CPE Pro 2 (model H122-373) — Three's 5G home broadband CPE — but the underlying behaviour is network-side, not router-side, and the same symptoms appear on USB dongles, MiFi units, and 4G fallback. The shared denominator is Three's mobile core, not the customer hardware.
2. What's actually happening — Carrier-Grade NAT
The first thing to understand is that the rotation isn't a bug. It's a consequence of how every modern mobile carrier shares a finite pool of IPv4 addresses across millions of users. The mechanism is Carrier-Grade NAT (CGNAT) — sometimes called Large-Scale NAT or NAT444.
How CGNAT works
Your router gets a private address from the documented 100.64.0.0/10 range (RFC 6598 reserved for shared address space). The carrier's edge router translates many such private addresses to a smaller pool of real public IPv4 addresses on outbound packets, then reverses on the way back.
The mapping between “you” and “the public IP” lives in the carrier's NAT table. When the carrier rebalances load, expires sessions, or rotates pool allocations, your apparent public IP changes.
Why mobile carriers do this
IPv4 exhaustion. RIPE NCC ran out of free /22 allocations in November 2019. Mobile networks add 10s of millions of new connections without proportional IPv4 supply, so they multiplex.
The proper long-term answer is IPv6, where every device can have a globally unique address. The transitional answer — and the one in production today — is CGNAT for IPv4 plus IPv6 alongside.
What makes Three notable in 2026 isn't that they use CGNAT — every UK consumer mobile carrier does. It's how visibly fast the rotation cadence is on certain APN configurations, and the fact that the legacy 3internet APN historically gave many users a public-routable IPv4 — which set an expectation that has now been broken.
3. The IPv4/IPv6 dual-stack trigger
The single most-cited workaround in community threads is to disable IPv6 on the router's APN and run IPv4-only. That fix only makes sense if you understand what dual-stack does differently.
When the Huawei 5G CPE Pro 2 (or comparable CPE) is configured with PDP type = IPv4/IPv6 on the 3internet or three.co.uk APN, the carrier appears to assign:
- A public IPv6 prefix (often globally routable, sometimes with a /64 SLAAC address per device)
- A CGNAT IPv4 address from the 100.64.0.0/10 pool, with the carrier free to remap the public-side mapping aggressively
Switching to PDP type = IPv4 only forces the carrier to provision a single IPv4 address — and on certain APN classes (notably the legacy 3internet) that single address is sometimes still pulled from the older public-routable pool, with much slower rotation.
The honest caveat
This isn't a guarantee, it's a probabilistic improvement. Three is migrating progressively more of the network onto CGNAT regardless of APN. Reports from ISP Review's “3internet APN” thread show the same SIM getting a public IP in one location and a 100.x address two streets away. Treat IPv4-only as a workaround, not a permanent contract.
4. The Vodafone–Three MOCN angle
The Vodafone–Three UK merger completed on 31 May 2025, creating VodafoneThree. Per Vodafone's own newsroom, the combined entity began deploying Multi-Operator Core Network (MOCN) site sharing immediately. By April 2026, ~10,000 MOCN-enabled sites were live, with full rollout expected over six to eight years.
MOCN means a Three SIM can connect through either a Three or a Vodafone radio site, depending on which gives the best signal at your location. Same SIM, same APN, same monthly bill — but the path your packets take through the radio access network is now non-deterministic.
The implication for IP addressing: the IP-allocation policy you hit can differ between Three's native sites and MOCN-shared sites. Multiple ISP Review threads document the same SIM showing a public-routable address on one street and a CGNAT address two streets away. As more sites cut over, this variability is the new baseline.
Why this matters for stable IP expectations
Pre-merger, you could empirically test “does my Three SIM at this address get a public IPv4?” and rely on the answer staying stable. Post-merger, the answer can change without warning when a nearby site is cut into MOCN sharing or when your CPE attaches to a different sector during a re-camp. Architectures that depended on Three's 3internet public IP — IoT remote access, CCTV port forwarding, self-hosted services — are progressively stranded.
5. What actually breaks (and what doesn't)
Not every service is affected. The split is between outbound-only (works fine on CGNAT) and inbound-required or session-stable (broken).
Breaks on rapid IP rotation
- ×Online banking — sessions expecting stable IP, anti-fraud blocks, 2FA loops
- ×VoIP / SIP — registration drops, dropped calls, one-way audio
- ×Site-to-site VPN — IKE/IPsec re-builds, especially aggressive-mode tunnels
- ×Port forwarding — impossible on CGNAT (you don't own the public IP)
- ×Dynamic DNS (DDNS) — points at a shared IP that isn't yours
- ×Self-hosted services — web, mail, game servers that need inbound
- ×CCTV port-forwarded access — outbound cloud relay still works
Generally fine
- ✓Streaming — Netflix, YouTube, Spotify (outbound)
- ✓Web browsing — most sites don't pin sessions to IP
- ✓Cloud SaaS — Slack, Google Workspace, Microsoft 365
- ✓Game clients — most games are client-initiated outbound
- ✓Outbound VPN — WireGuard, OpenVPN client to a remote server
- ✓Cloud-relay CCTV — Hik-Connect, Reolink Cloud, etc.
- ✓VoIP via cloud PBX — if the PBX initiates outbound
If your use case sits squarely in the right column, CGNAT and rapid IP rotation cost you nothing. If you're in the left column, read on.
6. Practical fixes that actually work
Ranked from quickest / most reversible to most architectural. Apply in order — most home users get adequate stability after fix #1 or #2.
Disable IPv6 on the router APN
On the Huawei 5G CPE Pro 2: log in to the admin web UI (typically 192.168.8.1), navigate to Settings → Mobile Network → APN, edit the active profile (usually 3internet or three.co.uk), and change PDP type from IPv4/IPv6 to IPv4. Save and reconnect.
Re-check your public IP at /what-is-my-ip every 5–10 minutes for the next half-hour. If the IP is now stable, this fix is enough for you.
Ask Three support to disable IPv6 on your account
Try 4G-only mode
Architect around CGNAT with an outbound VPN
For users who genuinely need stable inbound reachability — IoT devices, CCTV NVRs, home labs — the durable answer is to stop relying on the carrier-assigned IP entirely. Provision a VPS with a static public IPv4 (~£5/month from any reputable provider) and run an outbound VPN tunnel from the device or from your router to that VPS using WireGuard or OpenVPN. Inbound traffic targets the VPS; the VPS forwards through the tunnel.
This survives CGNAT, MOCN site swaps, and ISP rotation cadence changes — your reachable public IP becomes the VPS's static address rather than anything the carrier hands out.
Switch to a fixed-IP service tier
Replace direct P2P access with cloud-relayed services
7. What this means for mobile proxy operators
Most readers landing here are home broadband users dealing with broken banking sessions. But Three's carrier behaviour also has documented implications for anyone running mobile proxy services on Three SIMs — including resellers operating ports for end-customers.
Network-layer TCP rewriting
Three UK rewrites TCP fingerprints at the carrier edge. This means OS fingerprint spoofing tools that align the proxy stack's TCP signature with the user-agent being sent (e.g. android:3 or ios:2 via ProxySmart-style daemons) are not effective on Three. Whatever your proxy daemon sets, the carrier overwrites it before packets leave their network. If your customer needs OS-spoof-correct egress, route through a different carrier.
Same-IP-on-rotation behaviour
When your customer hits a rotation API, you ask the modem to re-attach. Three's CGNAT pool may map your re-attached session back to the same public IP, especially on short rotation intervals. This isn't a bug — it's a known carrier stickiness pattern. Mobile proxy backends handle this with server-side auto-retry on rotation (typically 2–3 attempts with a 15s wait between) before surfacing a clear same-IP signal. We document this pattern in our reseller program page.
For context, our Mobile Proxy IP Rotation Explained article covers the broader pattern — how mobile carriers handle rotation differently from residential proxies, why dedicated devices give more predictable behaviour than shared CGNAT pools, and why “trust score” depends on fingerprint integrity that carriers like Three actively undermine through TCP rewriting.
The practical takeaway for proxy resellers: if you're specifically buying Three UK ports from an aggregator, accept that two known constraints come with the territory — no effective OS-spoof, and faster-than-typical CGNAT rotation. For workloads where those constraints break the use case (TikTok / Instagram on iOS user-agents, or anything needing IP-stable sessions), specify EE, Vodafone, or O2 in your reseller order instead — or move the workload to a US carrier where the behaviour is documented differently.
8. How to verify whether you're behind CGNAT
Two-minute test, repeatable, no special tools:
- Open your router admin UI and find the WAN IPv4 address the router was assigned. On Huawei 5G CPE Pro 2 it's under System → Device Information.
- Open /what-is-my-ip in a browser on a device behind that router.
- Compare the two addresses. If the router's WAN address falls in
100.64.0.0/10(anything 100.64.x.x through 100.127.x.x), or if it differs from the public IP shown by /what-is-my-ip, you are behind CGNAT. - Re-check /what-is-my-ip every 2 minutes for 20 minutes. If the public IP changes more than once in that window, you have the rapid-rotation variant.
Reference: RFC 6598 — IANA-Reserved IPv4 Prefix for Shared Address Space
The 100.64.0.0/10 range was allocated by IANA in 2012 specifically for service-provider CGNAT deployments. Seeing an address in this range on your router's WAN interface is definitive evidence of CGNAT — there is no legitimate non-CGNAT reason for a customer-facing CPE to be assigned an address in that prefix.
9. Sources & further reading
The patterns described in this article are documented across public forums and operator communications. Key sources:
IP Address Constantly Changing Every Few Minutes — Huawei 5G CPE Pro 2
Three CommunityThe thread that named the symptom most precisely.
5G suddenly switched to CGNAT??
Three CommunityUser reporting transition from public to CGNAT mid-contract.
3internet APN returning CGNAT IP address instead of public routable IP
Three CommunityLong-form thread on the legacy 3internet APN behaviour change.
External IP address is changing all the time
Three CommunityCross-thread discussion of rotation cadence experiences.
Three public IP address changing hourly today
ISP Review ForumIndependent forum corroboration of rotation timing.
Has 3internet APN on Three switched to CGNAT?
ISP Review ForumVariability across geographic locations on the same APN.
When Three's 3Internet APN Stops Giving You a Public IP — What CCTV Installers Need to Know
IoT PortalPractical migration paths for CCTV / IoT installers.
How Vodafone and Three are sharing their mobile networks
Vodafone NewsroomOfficial MOCN explainer from the operator.
Vodafone and Three UK Deploy Joint Network Sharing to 8,000 Mast Sites
ISP ReviewNovember 2025 milestone in the MOCN rollout timeline.
Better experience, faster speeds, wider coverage: Early impact of the Vodafone–Three UK merger
OpensignalIndependent measurement of post-merger network behaviour.
Related from Coronium
What is My IP — live check
Open this in a browser on the affected connection and refresh every 2 minutes to verify rotation cadence.
Mobile Proxy IP Rotation Explained
How mobile carriers handle IP rotation differently from residential, and why dedicated devices give more predictable behaviour.
UK Mobile Proxies
For users who need stable mobile-IP egress in the UK without fighting consumer-CPE CGNAT.
Reseller Program
For operators reselling mobile proxies to customers who need carrier-specific egress (avoid Three for OS-spoof workloads).
DNS Leak Test
Companion check for whether your traffic is leaking DNS queries outside your VPN tunnel — relevant when working around CGNAT with VPN architecture.
Glossary
Reference for CGNAT, CPE, MOCN, APN, PDP type and other terms used in this article.
Three UK IP rotation — FAQ
The honest summary
Three's rapid IP rotation isn't a fault to be ticketed away — it's the new operating posture of a CGNAT-by-default carrier mid-way through a major network-sharing rollout. Disable IPv6 if you can; architect around the carrier-assigned IP if your use case actually needs reachability; and don't expect the historical 3internet public-IP behaviour to come back.