Comprobador de Carrier-Grade NAT (CGNAT) y Puertos
Comprueba al instante si tu proveedor de internet (Digi, MásMóvil, Pepephone, Movistar, Vodafone) te ha asignado CGNAT (RFC 6598). Descubre por qué no puedes abrir puertos y cómo solucionar la NAT Estricta en consolas y PC.
Tu IP Pública Detectada y Datos de Red
Motor de Diagnóstico CGNAT
Introduce la IP WAN / Internet que aparece en la administración de tu router (ej: 192.168.1.1):
Cómo Averiguar la IP WAN de tu Router
Abre tu navegador y entra en la puerta de enlace predeterminada de tu red local: 192.168.1.1 o 192.168.0.1. Introduce tu usuario y contraseña.
Busca el apartado denominado Estado de la Conexión, Dirección IP WAN o Información de Red.
Pega la IP WAN en nuestro analizador. Si no coincide con tu IP pública o pertenece al rango 100.64.0.0/10, estás detrás de CGNAT.
Matriz Comparativa de Direccionamiento IP y CGNAT
| Architecture Type | IP Address Range | Inbound Port Forwarding | Console Gaming NAT | Self-Hosting / VPN |
|---|---|---|---|---|
| Direct Public IP | Globally Routable IPv4 | 100% Functional | Open (Type 1) | Native WireGuard, Plex, HTTP |
| CGNAT (RFC 6598) | 100.64.0.0/10 | Blocked by Carrier NAT | Strict (Type 3) | Requires Cloudflare / Tailscale |
| Double NAT (RFC 1918) | 192.168.0.0/16, 10.0.0.0/8 | Double Forwarding Required | Moderate / Strict (Type 2/3) | Fix by Bridge Mode on Modem |
| IPv6 Dual-Stack | 2000::/3 Global Unicast | Full End-to-End Routability | Open IPv6 Peer-to-Peer | No NAT required, direct AAAA records |
Cómo Salir de CGNAT y Abrir Puertos
Method 1: Request Public Dynamic / Static IP from ISP
Call your Internet Service Provider customer support. Inform them you need a public IP for hosting security cameras, remote work VPN, or gaming. In France, Freebox allows one-click activation of "IP fixe V4 full-stack" in the subscriber portal for 0 EUR. In Spain, Digi offers "Conexión Plus" for 1 EUR/month, and MásMóvil/Pepephone deactivate CGNAT upon phone request.
Method 2: Use Cloudflare Tunnels (Zero Trust)
Install Cloudflare's lightweight daemon cloudflared on your local server. It creates an outbound HTTPS connection to Cloudflare's global edge network. Incoming visitors hit your custom domain on Cloudflare, which forwards traffic over the established outbound tunnel, bypassing ISP CGNAT completely with 0 open router ports.
Method 3: Tailscale or WireGuard Mesh Overlays
Tailscale uses STUN (Session Traversal Utilities for NAT) hole-punching and DERP relays to connect your laptops, phones, and home servers directly in an encrypted peer-to-peer WireGuard mesh without requiring an open public IPv4 port.
Method 4: Transition to IPv6 Dual-Stack
IPv6 completely eliminates the concept of NAT. With IPv6 enabled on your router and ISP line, every home device receives a globally unique, publicly addressable IPv6 address (/64 prefix), allowing direct peer-to-peer communication governed only by local firewall rules.