Verificador de Carrier-Grade NAT (CGNAT) e Portas
Saiba instantaneamente se a sua operadora (Claro, Vivo, Oi, provedores locais) coloca a sua conexão sob CGNAT (RFC 6598). Entenda por que o redirecionamento de portas falha e como obter NAT Aberto.
Seu IP Público Detectado e Gateway de Rede
Motor de Diagnóstico CGNAT
Digite o IP WAN (Internet) informado no painel do seu roteador (ex: 192.168.1.1 ou 192.168.0.1):
Como Descobrir o IP WAN do Seu Roteador
Abra seu navegador e acesse o gateway padrão da sua rede: 192.168.1.1 ou 192.168.0.1. Faça login com suas credenciais.
Procure pela seção Status da WAN, Endereço IP da Internet ou Informações do Dispositivo.
Insira o IP WAN no nosso testador acima. Se ele diferir do seu IP público ou estiver na faixa 100.64.0.0/10, você está em CGNAT.
Comparativo de Arquiteturas IP e CGNAT
| Architecture Type | IP Address Range | Inbound Port Forwarding | Console Gaming NAT | Self-Hosting / VPN |
|---|---|---|---|---|
| Direct Public IP | Globally Routable IPv4 | 100% Functional | Open (Type 1) | Native WireGuard, Plex, HTTP |
| CGNAT (RFC 6598) | 100.64.0.0/10 | Blocked by Carrier NAT | Strict (Type 3) | Requires Cloudflare / Tailscale |
| Double NAT (RFC 1918) | 192.168.0.0/16, 10.0.0.0/8 | Double Forwarding Required | Moderate / Strict (Type 2/3) | Fix by Bridge Mode on Modem |
| IPv6 Dual-Stack | 2000::/3 Global Unicast | Full End-to-End Routability | Open IPv6 Peer-to-Peer | No NAT required, direct AAAA records |
Como Contornar o CGNAT e Abrir Portas
Method 1: Request Public Dynamic / Static IP from ISP
Call your Internet Service Provider customer support. Inform them you need a public IP for hosting security cameras, remote work VPN, or gaming. In France, Freebox allows one-click activation of "IP fixe V4 full-stack" in the subscriber portal for 0 EUR. In Spain, Digi offers "Conexión Plus" for 1 EUR/month, and MásMóvil/Pepephone deactivate CGNAT upon phone request.
Method 2: Use Cloudflare Tunnels (Zero Trust)
Install Cloudflare's lightweight daemon cloudflared on your local server. It creates an outbound HTTPS connection to Cloudflare's global edge network. Incoming visitors hit your custom domain on Cloudflare, which forwards traffic over the established outbound tunnel, bypassing ISP CGNAT completely with 0 open router ports.
Method 3: Tailscale or WireGuard Mesh Overlays
Tailscale uses STUN (Session Traversal Utilities for NAT) hole-punching and DERP relays to connect your laptops, phones, and home servers directly in an encrypted peer-to-peer WireGuard mesh without requiring an open public IPv4 port.
Method 4: Transition to IPv6 Dual-Stack
IPv6 completely eliminates the concept of NAT. With IPv6 enabled on your router and ISP line, every home device receives a globally unique, publicly addressable IPv6 address (/64 prefix), allowing direct peer-to-peer communication governed only by local firewall rules.