Carrier-Grade NAT and Shared Public Addresses

ByIpsaya Editorial

TL;DR: Carrier-grade NAT means your ISP puts many customers behind one public IPv4 address. Your router can show a private-looking WAN address while the internet sees a different, shared one. Inbound hosting breaks, abuse reports get muddy, and a lookup is how you see the address the outside actually uses. Compare the two on Ipsaya the next time a port-forward “should have worked.”

The camera that never appeared on a phone

A shop owner forwarded port 443 on a new router to a security camera, following a video that assumed the router’s WAN address was the public internet. From inside the shop, the camera page loaded. From a phone on cellular, it timed out. The WAN row read 100.64.12.8. A lookup from the shop PC showed 151.101. something else entirely, owned by the ISP’s general pool. The 100.64 address sits in a range reserved for carrier-grade NAT. It is a hallway between the shop and the ISP, not a door the phone can knock on. Every packet from the shop was translated a second time at the carrier. The phone was knocking on a shared door that does not know what to do with an unsolicited visit.

The two translations

At home, your router already translates private hallway addresses into one WAN address. That is ordinary NAT. Carrier-grade NAT adds another translator inside the ISP because there are not enough IPv4 addresses for every customer to have a unique one. The ISP assigns your router something from 100.64.0.0/10, then shares a smaller pool of real public addresses among many routers. Outbound browsing still works. A website sees the shared public address. A friend cannot start a connection to your camera, because the carrier has no unique place to send it.

  • Router WAN in 100.64.0.0 through 100.127.255.255: strong sign of CGNAT.
  • Lookup address different from that WAN: the lookup is the one the world sees.
  • Lookup matches WAN and friends still cannot connect: a firewall or a closed port, not necessarily CGNAT.
  • IPv6 present and working: sometimes a way around the IPv4 sharing, if both ends actually use it.

What the shared address does to blame and bans

If the public address is shared, a ban aimed at one customer lands on others. Forums, games, and mail systems that block “the IP” may be blocking a slice of the ISP. When a site tells you your address was abusive at 3 a.m. and you were asleep, CGNAT is one of the non-dramatic explanations, along with a compromised device in your own house. Note the time. Ask the ISP if they share addresses. Do not assume a stranger across town has your name just because you shared a number for an afternoon.

Support agents who ask for “the IP from your router” may write down 100.64 and then fail to find you in a log that recorded the public pool address. Give them the lookup value and mention the WAN row if it differs. The pair is the diagnosis. Either number alone sends the ticket in circles.

Mobile networks do this even more casually

Phones on cellular are often behind carrier NAT or IPv6 transition gear. The address a lookup shows can be shared and can change as you drive. Hosting a service from a phone hotspot inherits that limitation. If a laptop tethered to a phone cannot receive inbound connections, you have not mis-clicked the laptop firewall. You are a guest of the carrier’s translator.

Options that are real and options that are theater

Asking the ISP for a public IPv4 address sometimes works and sometimes costs money. Using IPv6 works when the camera, the router, and the cousin’s phone all speak it. A relay or a tunnel service works when you only need one viewer and you trust the relay. Clicking “DMZ” on the router does not punch through the carrier’s second NAT. Repeating the port-forward video louder does not either. Confirm the address mismatch first so you stop paying a technician to configure a door that is not on the street.

A VPN will change the lookup address to the VPN’s exit. That does not give the camera a public inbound port unless the VPN product specifically offers one. Read the product as a tunnel for outbound traffic until it says otherwise.

Write the WAN row and the lookup row in the same note with the time. If a technician later asks you to reboot, you will know whether the public pool address moved. A moving pool address with a stable 100.64 WAN row is still CGNAT. A WAN row that suddenly becomes a normal public address means the ISP took you off the sharing layer. Those are different victories, and only the pair of numbers tells them apart.

Compare the rows before you buy more hardware

The shop owner almost ordered a second router. The lookup versus the 100.64 WAN row explained the timeout in one minute. Write both addresses down the next time inbound access fails from cellular and works from the sofa. If they differ and the WAN sits in 100.64, stop forwarding ports and start a conversation with the ISP or with an IPv6 setup. The camera was fine. The door everyone was knocking on was a service corridor.

Similar Posts