VPN Behind CGNAT: What Works and What Doesn't

If you have ever tried to run a home server, host a game session or reach a camera from outside and found that nothing worked even though the settings looked right, there is a good chance your internet provider uses carrier-grade NAT, or CGNAT. It is increasingly common as the supply of public IPv4 addresses has run out, and it affects fixed broadband, mobile data and some building-wide networks.

The good news for VPN users is that CGNAT is not the obstacle many people fear. A VPN app and CGNAT get along reasonably well. The less good news is that some things people try to do alongside a VPN, such as hosting their own VPN server or opening ports, run straight into it. This article covers VPN with CGNAT: how to confirm you are behind it, what still works, what does not, and what to do about it.

What CGNAT is, in plain terms

Every home router already performs network address translation. Your phone, laptop and television each have a private address (the ranges in RFC 1918, such as 192.168.1.20), and the router swaps them for a single public address when traffic leaves. When a reply arrives, the router remembers which device asked and passes it on.

CGNAT does the same thing one level up. Your provider takes one public IPv4 address and shares it among dozens or hundreds of customers. Your router's own "public" address is then itself a private-looking address handed down by the provider. The shared range 100.64.0.0 to 100.127.255.255 is reserved for this exact purpose in RFC 6598, which is why seeing an address starting with 100.64 to 100.127 is a strong hint.

The key idea is that outgoing connections create a temporary entry in a table, so replies find their way back. A connection that starts from the outside has no entry and nowhere to go. Your home is reachable only for conversations you started.

Why do providers do this? There are only about four billion IPv4 addresses, far fewer than the devices that need them. IPv6 (RFC 8200) fixes the shortage, but adoption on home networks is uneven. Until it is universal, sharing addresses is the cheap workaround.

How to find out if you are behind CGNAT

You can check in about two minutes.

1. Log in to your router's admin page and find the WAN, Internet or Status screen. Note the IP address it lists for the internet side.
2. On any device in your home, open a page that tells you your public IP address.
3. Compare the two.

What you see	What it means
The two addresses are identical	You have your own public IPv4 address (not behind CGNAT)
Router shows an address starting 100.64 to 100.127	Shared address space from RFC 6598: you are behind CGNAT
Router shows 10.x.x.x, 172.16-31.x.x or 192.168.x.x	Private address on the WAN side: you are behind CGNAT or another router
Router shows a public-looking address that differs from the web page	Possible CGNAT or a proxy at your provider; ask the provider

On mobile data the check is trickier because phones do not show a WAN page. As a rule, treat mobile networks as CGNAT unless your carrier says otherwise. Also check for a second router in your own home: a mesh system or an old router upstream creates double NAT that looks similar but is under your control, not your provider's.

A public IPv6 address does not mean you escape CGNAT for IPv4 traffic. Many homes have IPv6 and CGNAT at once. The IPv4 side is still shared. Our overview of IPv4 and IPv6 with a VPN explains how the two interact.

Why a normal VPN app still works behind CGNAT

A VPN app that connects to a provider's server is an outbound client. Your device sends a packet to a known address on the internet, and the CGNAT device creates a table entry and forwards it. The server replies to that entry, and the reply returns. After that, the encrypted tunnel carries all your traffic through that one mapping.

That is the same mechanism web browsing relies on, so from CGNAT's point of view a VPN tunnel looks like any other long conversation. For everyday uses, such as protecting your traffic on shared networks, connecting from home or travelling, you do not need to do anything special.

Two small details matter for stability:

• Idle timeouts. The CGNAT device forgets entries after a period of silence. VPN software normally sends occasional keepalive packets to keep the entry alive. If your tunnel drops after being idle, a keepalive setting can help; if you cannot change it, the app's reconnect behaviour will pick up the slack.
• UDP vs TCP. UDP entries often expire faster than TCP ones. Where the app offers a choice, keep its default and only change it if support recommends a different one.

If the connection is flaky, improving VPN connection stability lists things you can check. And what a VPN tunnel is is a good background read if the idea of a "mapping" is new to you.

What stops working behind CGNAT

Anything that needs someone else to start the conversation with your home is affected. These are the common cases:

• Running a VPN server at home. A home server must accept incoming connections from outside. With no public address of your own, there is nowhere to receive them. Our article on self-hosted vs commercial VPNs covers the trade-offs of that route.
• Port forwarding on your router. The rule you set only affects the traffic reaching your router. If the packets are stopped one level up at the provider's shared device, the rule never sees them. See VPN port forwarding explained for how it works with and without a VPN.
• Remote access to cameras, storage and home automation by opening ports. Many such devices work through a cloud service instead, which is why they often still function.
• Hosting game servers or peer-to-peer sessions. Other players cannot reach you directly, so some games fall back to relays, which adds delay.
• Any service that needs a fixed or reachable address, such as a personal website or an email server.

What does not break is as important. Browsing, streaming, video calls, messaging, cloud storage, and a VPN app on your devices all continue to work, because you start each of those connections.

A table of what works and what does not

Task	Behind CGNAT?	Notes
Browsing and streaming	Works	Outbound traffic only
VPN app on phone or laptop	Works	Outbound tunnel; watch idle timeouts
Video calls and messaging	Works	May use relay servers when direct paths fail
Cloud-backed camera or smart device	Usually works	The device calls out to the vendor's cloud
Hosting a VPN server at home	Does not work	Needs inbound access
Port forwarding to a game or web server	Does not work	The shared device blocks inbound
Direct peer-to-peer file transfer	Often limited	Depends on both ends
Using IPv6 for inbound access	May work	If the provider routes IPv6 to your home and your firewall allows it

Fixes and alternatives if you need inbound access

If your goals are simply protecting your traffic and connecting from home, you need none of this. If you do need to reach something at home, there are four common routes.

1. Ask your provider for a public IPv4 address. Many providers will assign a dedicated one on request, sometimes for a small monthly fee. The wording varies, so ask for "a public IP address" or "opt out of CGNAT". It is the most direct fix.
2. Use IPv6. If your provider gives your home a public IPv6 range, you can reach devices over IPv6 from other IPv6 networks. Both ends need IPv6, and you must configure the router firewall deliberately, because every device is then reachable by default unless the firewall says otherwise.
3. Use a relay or overlay tool. Services and open-source tools can connect your devices through a coordination service, so neither end needs an open port. This is the category described in mesh VPNs explained. You still need to judge the trust you place in the coordinator.
4. Rent a small server with a public address. A cheap virtual server in a data centre can act as the meeting point. Your home device connects out to it and stays connected, and you connect in from elsewhere. It needs maintenance and updates, so only choose it if you are comfortable running a server.

Be careful with advice that tells you to "just forward the ports": on CGNAT that advice is wrong, and following it only wastes an evening. Equally, be wary of any tool that asks you to expose a service to the whole internet without authentication.

CGNAT and VPN addresses seen by websites

CGNAT affects which address websites see even without a VPN. Many customers share the one public address, so a site that sees repeated sign-in attempts, searches or purchases from it may apply stricter checks. You may meet CAPTCHAs more often, or occasionally an account sign-in asks for extra confirmation.

Adding a VPN swaps that shared address for the VPN server's address, which other users of the same server may also be using. Neither is a fault. Both are cases of many people behind one address, and sites respond with caution. If you meet many CAPTCHAs, websites not loading or showing CAPTCHAs walks through the usual remedies. Our article on shared vs dedicated VPN IPs explains why a shared address behaves this way.

Do not treat this as a reason to try tricks that break a site's rules. If a service blocks you, contact it through its official channel.

Three practical scenarios

The student in a shared dorm. Ploy's dorm gives each room a private address and shares one public address among the whole building. Her phone and laptop use a VPN app every day on the dorm Wi-Fi, and it works fine, because the connection is outbound. She wants to host a small game server for friends and finds that nobody can join. She learns that it is CGNAT and chooses a relay-based tool or a rented server rather than waiting for the dorm to change.

The remote worker on mobile data. Mark works from a rural area where a mobile hotspot is his only connection. His carrier shares addresses among customers. He connects to his employer's work VPN and his personal VPN app without trouble. He cannot reach his home camera system by port forwarding, but the camera's vendor cloud works, and he uses that.

The home lab hobbyist. Aom runs a small file server and wants to reach it on the road. Her provider confirms she is on CGNAT and offers a public address for an extra monthly fee. She compares that with a relay tool, decides the fee is not worth it for occasional access, and uses the relay. The takeaway is that the "best" fix depends on how often you need inbound access and how comfortable you are with the third party involved.

Common mistakes and limits

• Blaming the VPN when the real cause is CGNAT. If port forwarding fails and you do not have a public address, no VPN setting will fix it.
• Assuming a VPN gives you an inbound address. It gives websites a different address to see, nothing more. Some services offer port forwarding as an add-on, but that depends entirely on the provider. Do not assume yours has it.
• Exposing devices to IPv6 by accident. If your provider enables IPv6, check that your router firewall blocks unsolicited inbound connections.
• Using weak passwords on anything reachable from outside. An open service is probed constantly. Use strong, unique passwords and two-factor authentication where offered.
• Treating CGNAT as privacy. Sharing an address with neighbours does not hide you from your provider, which knows which customer used which mapping.

If you need to choose which setup fits you, building a simple threat model is a short exercise that helps decide whether you need inbound access at all.

Summary

CGNAT means your provider shares one public IPv4 address among many customers. A VPN app still works behind it because the tunnel is started from your side. What does not work is anything that needs a stranger to connect inward: home VPN servers, port forwarding, direct remote access and some game hosting. Confirm CGNAT by comparing your router's WAN address with your public address, and if you need inbound access, ask your provider for a public address, use IPv6 carefully, or choose a relay tool or rented server.

If you just want a VPN for your devices, a prepaid pass from the pricing page works with a CGNAT connection like any other outbound connection.