Skip to content
ScanMyPrivacy
Menu

Privacy and leak tests

Full Privacy ScanDNS Leak TestWebRTC Leak TestBrowser Fingerprint TestAm I Using a VPN?HTTP Headers ViewerUser Agent CheckerOpen Port Checker

Online safety assistant

Website Safety CheckerSuspicious Link CheckerScam and Phishing Message CheckerBrowser Security GuideMobile App Safety CheckPersonal Security Checkup

IP and network lookups

IP LookupMy IP LocationWhat Is My Public IP?What Is My IPv6 Address?Reverse DNS LookupDNS Lookup
Online safety Guides API About

IP basics

What Is CGNAT (Carrier-Grade NAT)?

Updated · 2 min read

Written by the ScanMyPrivacy team. How we write and check guides · Report a correction

Try it yourself:Open Port CheckerAm I Using a VPN?

Carrier-grade NAT (CGNAT) is when your internet provider puts many customers behind a single public IPv4 address, in the same way your router shares one address between your devices. It exists because the supply of IPv4 addresses has run out.

How it works

Without CGNAT, your router gets a public address and translates your devices to it. With CGNAT, your router gets a private address from the provider (often in the shared range 100.64.0.0/10), and the provider translates thousands of such customers onto a few public addresses. There are two layers of NAT, and you do not control the outer one.

How to check whether you are behind CGNAT

  1. Log in to your router and find the WAN or Internet IP address.
  2. Open our home page and compare it with the address shown there.
  3. If they are different, or the router shows an address starting 100.64 to 100.127, 10., 172.16 to 172.31 or 192.168., you are behind CGNAT.

Mobile connections are almost always behind CGNAT, so a phone's address is shared with many other users. Fixed-line practice varies by provider and plan, and some providers will give you a public IPv4 address on request or for a fee. If you are in India or elsewhere, ask your ISP rather than assume.

What CGNAT changes for you

  • No port forwarding. Incoming connections cannot reach your home, which breaks self-hosting, some game hosting and remote camera access. The port checker will show everything closed regardless of router settings.
  • Shared reputation. If another customer on your address misbehaves, sites may block or CAPTCHA you.
  • Less precise location. The address maps to the provider's gateway, so IP geolocation can put you in a different city.
  • Mild privacy gain. Because many people share one address, it identifies you less than a dedicated one. It is not anonymity: the provider keeps logs linking addresses and ports to subscribers.

Workarounds

Ask your provider for a public or static IPv4 address; use IPv6 if both ends support it (it needs no CGNAT); or use a tunnel or reverse-proxy service so outside connections reach you through an outbound link. A VPN with port forwarding can also work.

Keep reading

Public vs Private IP AddressPublic vs private IP addresses: the private ranges, how NAT connects them and why your router shows a different address than websites see.IPv4 vs IPv6IPv4 vs IPv6 explained: address formats, why we need IPv6, how dual stack works and why a VPN that ignores IPv6 can reveal your real location.Static vs Dynamic IP AddressStatic IPs stay the same, dynamic IPs change. How each works, why providers use dynamic addresses, and what it means for privacy and hosting.Why Does My IP Address Show the Wrong Location?IP geolocation is an estimate, not a GPS fix. Learn why sites show the wrong city or even country for your IP address, and what you can do about it.ISP Blocking and DNS in India: What Works and What Doesn'tHow Indian ISPs block sites (DNS, SNI, IP), why changing DNS only sometimes helps, and how to check if a block is DNS-level. Privacy trade-offs.Is public Wi-Fi safe? What actually protects youPublic Wi-Fi is less risky than it used to be, but not risk-free. Learn what other people on the network can see, which habits matter, and when a VPN helps.

Frequently asked questions

Is CGNAT bad for privacy?

It makes your public address less unique, but your provider can still tie activity to you. It does not replace a VPN.

Why does my IP location show the wrong city?

With CGNAT the visible address belongs to your provider's gateway, which may be in a different city.

Does IPv6 avoid CGNAT?

Yes. IPv6 has enough addresses that every device can have its own, so CGNAT is not needed for it.