Carrier-Grade NAT (CGNAT) & Port Forwarding Checker
Detect whether your Internet Service Provider places your connection behind Carrier-Grade NAT (RFC 6598). Diagnose why port forwarding fails, fix Strict NAT (Type 3) in online games, and learn how to bypass CGNAT.
Your Detected Public IP & Network Gateway
Detected Public IP:Loading...
Internet Service Provider (ISP):Detecting ISP...
Autonomous System Number (ASN):AS-----
Location / Gateway Region:Detecting...
This is your visible edge public IP detected across the public Internet.
CGNAT Diagnostic Engine
Enter the WAN / Internet IP reported by your router admin panel (e.g. at 192.168.1.1):
Quick Test Presets:
Diagnostic Analysis & Verdict
Evaluating...Analyzing IP header blocks.
Supplied Router WAN IP:-
Observed Public IP:-
Address Classification:-
Port Forwarding Capability:-
Gaming NAT Type Projection:-
Recommended Action:Loading recommendations...
How to Find Your Router's WAN IP Address
1. Log into your router dashboard
Open your web browser and navigate to your router's default gateway. Most routers use 192.168.1.1, 192.168.0.1, or 10.0.0.1. Enter your admin credentials.
2. Locate the "WAN" or "Internet Status" page
Look for sections named Internet Status, WAN IP, Broadband Connection, or Device Info.
3. Compare with your Public IP above
Paste the WAN IP into our checker above. If it differs from your public IP or falls into 100.64.0.0/10, you are behind CGNAT.
IP Architecture & CGNAT Comparison Matrix
Architecture Type
IP Address Range
Inbound Port Forwarding
Console Gaming NAT
Self-Hosting / VPN
Direct Public IP
Globally Routable IPv4
100% Functional
Open (Type 1)
Native WireGuard, Plex, HTTP
CGNAT (RFC 6598)
100.64.0.0/10
Blocked by Carrier NAT
Strict (Type 3)
Requires Cloudflare / Tailscale
Double NAT (RFC 1918)
192.168.0.0/16, 10.0.0.0/8
Double Forwarding Required
Moderate / Strict (Type 2/3)
Fix by Bridge Mode on Modem
IPv6 Dual-Stack
2000::/3 Global Unicast
Full End-to-End Routability
Open IPv6 Peer-to-Peer
No NAT required, direct AAAA records
How to Bypass CGNAT & Fix Closed Ports
Method 1: Request Public Dynamic / Static IP from ISP
Call your Internet Service Provider customer support. Inform them you need a public IP for hosting security cameras, remote work VPN, or gaming. In France, Freebox allows one-click activation of "IP fixe V4 full-stack" in the subscriber portal for 0 EUR. In Spain, Digi offers "Conexión Plus" for 1 EUR/month, and MásMóvil/Pepephone deactivate CGNAT upon phone request.
Method 2: Use Cloudflare Tunnels (Zero Trust)
Install Cloudflare's lightweight daemon cloudflared on your local server. It creates an outbound HTTPS connection to Cloudflare's global edge network. Incoming visitors hit your custom domain on Cloudflare, which forwards traffic over the established outbound tunnel, bypassing ISP CGNAT completely with 0 open router ports.
Method 3: Tailscale or WireGuard Mesh Overlays
Tailscale uses STUN (Session Traversal Utilities for NAT) hole-punching and DERP relays to connect your laptops, phones, and home servers directly in an encrypted peer-to-peer WireGuard mesh without requiring an open public IPv4 port.
Method 4: Transition to IPv6 Dual-Stack
IPv6 completely eliminates the concept of NAT. With IPv6 enabled on your router and ISP line, every home device receives a globally unique, publicly addressable IPv6 address (/64 prefix), allowing direct peer-to-peer communication governed only by local firewall rules.
Carrier-Grade NAT Frequently Asked Questions
What is Carrier-Grade NAT (CGNAT)?
Carrier-Grade NAT (also defined in RFC 6598 as Large-Scale NAT) is an IPv4 conservation technique used by Internet Service Providers. Instead of assigning a unique, routable public IPv4 address to each home or mobile subscriber, the ISP places thousands of customers behind a shared enterprise-grade NAT gateway, allocating internal shared addresses in the 100.64.0.0/10 range.
Why does CGNAT break port forwarding and multiplayer gaming?
Standard port forwarding requires incoming unsolicited packets from the public internet to reach your local router on a specified listening port. Under CGNAT, your router does not possess a public IP; the ISP router controls external ports. Inbound packets addressed to your public IP cannot determine which internal subscriber they belong to, resulting in Strict NAT Type (Type 3) on consoles (PS5, Xbox) and failed connections for hosted Minecraft, Plex, or VPN servers.
What IP range does CGNAT use?
CGNAT is allocated the dedicated RFC 6598 IPv4 address block: 100.64.0.0 to 100.127.255.255 with subnet mask /10. If your router status page reports an Internet/WAN IP starting with 100.64 through 100.127, your connection is guaranteed to be behind CGNAT.
How can I fix or bypass CGNAT?
There are four proven methods to bypass CGNAT: 1) Call your ISP and request a static or dedicated public IPv4 address (some ISPs provide this free, others charge a modest fee); 2) Enable IPv6 on your router and home devices, as IPv6 provides end-to-end global routability with no NAT; 3) Use Cloudflare Tunnels (cloudflared) to publish web applications without port forwarding; 4) Use peer-to-peer overlay mesh VPNs like Tailscale or WireGuard with STUN NAT hole-punching.
Why does my router WAN IP show 192.168.1.1 or 10.0.0.1?
If your router's WAN IP belongs to RFC 1918 private subnets (10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16), you have Double NAT. This typically happens when your third-party Wi-Fi router is plugged into an ISP modem/gateway that is also performing routing functions. To fix this, set the ISP modem into Bridge Mode or place your secondary router in the ISP gateway DMZ.