Network Architecture: Public WAN vs. Private LAN IP Addresses
An Internet Protocol (IP) address is a numerical label assigned to every device communicating across a network. In modern networking, every connected workstation, smartphone, and IoT device possesses at least two concurrent IP addresses: an internal private LAN IP managed by your local router DHCP server, and an external public WAN IP provisioned by your Internet Service Provider (ISP). With WhatMyIP.site, you can inspect your active public IPv4/IPv6 address, autonomous system routing (ASN), ISP infrastructure, and browser fingerprint metadata with sub-millisecond edge resolution.
Written by Marcus Vance (Lead Network Systems Engineer)
•
Technical Review by Elena Rostova, CISSP
•
Updated October 2026
How to Detect If Your ISP Put You on Carrier-Grade NAT (CGNAT RFC 6598)
Because global IPv4 address allocation was officially exhausted in 2011, many residential broadband and cellular carriers implement Carrier-Grade NAT (CGNAT / Large-Scale NAT). Instead of assigning a unique public IPv4 address to your optical ONT or cable modem, your ISP places your router inside an intermediary carrier pool governed by RFC 6598 (the 100.64.0.0/10 subnet range, spanning 100.64.0.0 through 100.127.255.255).
To detect if you are behind CGNAT without calling support:
- Log into your router admin panel (commonly found at 192.168.1.1 or 192.168.0.1).
- Navigate to the Status, Device Info, or WAN / Internet tab.
- Look at the assigned WAN IPv4 Address. If this address starts with
100.64.x.xthrough100.127.x.x, or differs completely from the public IP reported at the top of WhatMyIP.site, your connection is behind CGNAT.
Under CGNAT, traditional port forwarding for home servers (such as Plex, Minecraft, WireGuard, or NAS storage) is blocked upstream at the ISP gateway. Solutions include requesting a dedicated static IPv4 address from your ISP, adopting native IPv6 routing, or utilizing zero-trust overlay tunnels such as Tailscale, WireGuard, or Cloudflare Tunnels. You can run our interactive CGNAT and Port Forwarding Audit for detailed walkthroughs.
Why Your Default Gateway (192.168.1.1 / 10.0.0.1) Is Never Visible on the Web
A common misconception among computer users is attempting to access their home network from an external office or mobile connection by typing 192.168.1.1 or 10.0.0.1 into their browser. Under RFC 1918, three IPv4 address blocks are designated strictly for private networking:
- 24-bit Block:
10.0.0.0–10.255.255.255(Class A private range) - 20-bit Block:
172.16.0.0–172.31.255.255(Class B private range) - 16-bit Block:
192.168.0.0–192.168.255.255(Class C private range, default for home routers)
Internet core routers intentionally drop any data packet addressed to RFC 1918 subnets. Your home router performs Network Address Translation (NAT) and Port Address Translation (PAT), mapping dozens of internal LAN sockets into a single public IP address. Websites only see your public WAN IP, never your device's internal 192.168.x.x address. If you encounter routing disconnects, refer to our guide on fixing default gateway unavailable errors.
How WebRTC STUN Requests Leak Real IP Addresses Through VPNs
Many users install Virtual Private Networks (VPNs) expecting total anonymity, unaware of browser-level WebRTC (Web Real-Time Communication) vulnerabilities. WebRTC enables low-latency voice, video, and P2P data streaming in Chrome, Firefox, Safari, and Edge. To establish direct peer-to-peer connections through firewalls, WebRTC sends Session Traversal Utilities for NAT (STUN) requests over UDP.
In unhardened browsers, these STUN requests can bypass the operating system's virtual network adapter (TUN/TAP) and query the default physical network interface directly. A remote website running a simple JavaScript snippet can capture your real residential public IP address, entirely unmasking your VPN tunnel. You can verify your connection integrity using our comprehensive VPN and Proxy Leak Checker.
Resolving Double NAT and Strict NAT (Type 3) in Online Gaming
Multiplayer console and PC gamers frequently encounter "Strict NAT", "NAT Type 3", or "Double NAT Detected" errors in Call of Duty, FIFA, GTA Online, and Xbox Live party chat. Double NAT occurs when your home network contains two cascading routing devices that both perform Network Address Translation:
- Device 1: An ISP-provided fiber/cable modem gateway performing NAT (WAN →
192.168.1.1). - Device 2: A customer-owned Wi-Fi 6 or mesh router connected to Device 1, also performing NAT (
192.168.1.x→192.168.50.1).
Because incoming UDP handshake packets cannot traverse two layers of stateful firewall translation, peer-to-peer matchmaking fails. To resolve Double NAT, access the ISP modem configuration and enable Bridge Mode (disabling routing functions so only your secondary router handles DHCP and NAT), or configure the secondary router as an Access Point (AP Mode).
Why IP Geolocation Can Show an Adjacent City or ISP Datacenter
Users frequently ask: "Why does WhatMyIP show I am in a city 50 miles away from my house?" Unlike mobile GPS chips that calculate physical coordinates from satellite constellations, IP geolocation is an estimation derived from Autonomous System Number (ASN) routing registries, BGP announcements, and commercial geolocation databases (such as MaxMind GeoIP2, IP2Location, and DB-IP).
Broadband and 5G cellular providers route residential traffic through regional Points of Presence (PoPs). If you reside in a suburban town, your fiber optic connection likely terminates at an ISP regional datacenter in the nearest major metropolitan hub. Geolocation identifies the edge routing gateway, preserving your household privacy while providing sufficient geographic context for content delivery networks.