The short version
CGNAT (carrier-grade NAT) means your internet provider shares one public IP address across many customers, so your home never gets an address of its own. It’s standard on T-Mobile Home Internet, Starlink Residential and many Verizon 5G Home lines. Browsing, streaming and a VPN router connecting to your VPN provider all work fine. What you lose is anything that needs to reach into your home: port forwarding, hosting, and remote access to your cameras, files or home VPN server. You can’t turn CGNAT off on your own equipment, but there are good workarounds.
If you’ve tried to set up port forwarding on 5G home internet or Starlink and nothing happens, or your router shows an internet address starting with 100, you’ve met CGNAT. It isn’t a fault in your router. It’s how your provider has built its network, and knowing that saves hours of changing settings that can’t help.
Key takeaways
- CGNAT puts your home behind a provider-level router that many customers share.
- Your gateway or router gets a WAN IP between 100.64.x.x and 100.127.x.x, a range reserved for carrier NAT.
- Outbound traffic, including a VPN router’s tunnel, works normally.
- Inbound traffic doesn’t: port forwarding and UPnP can’t work, because the blocking happens upstream of your equipment.
- Workarounds: a public IP from your provider, a mesh tool like Tailscale, a VPN with port forwarding, or IPv6 where your provider allows it.
What is CGNAT?
There aren’t enough IPv4 addresses for every home to have its own. Carrier-grade NAT, also called CGNAT or CGN, is how providers stretch them: instead of giving your home a public address, the provider runs a giant NAT router inside its own network and puts many customers behind each public address. Your home network gets a private address from a special range, and the provider translates it on the way out.
For outgoing traffic you’d never notice. The difference shows up when something on the internet tries to connect to you. With a normal connection, your own router decides what to let in. With CGNAT, the request reaches your provider’s shared router first, which has no idea which of its customers it’s meant for, so it drops it.
Why the 100.64 address?
The block 100.64.0.0 to 100.127.255.255 is set aside specifically for carrier NAT (RFC 6598). It’s not used on the public internet or inside ordinary home networks, so if your router’s WAN address falls in that range, your provider is using CGNAT.
Which providers use CGNAT?
Mostly the newer kinds of home internet, where the provider’s network was built when IPv4 addresses were already scarce. Policies can vary by plan and location, so always confirm with the WAN IP check below.
| Provider | CGNAT? | Notes |
|---|---|---|
| T-Mobile 5G Home Internet | Yes, for IPv4 | Port forwarding isn’t supported, and the gateway has no bridge mode. Setup: T-Mobile guide. |
| Starlink Residential / Roam | Yes, for IPv4 | Priority plans can add an optional public IPv4 address from the account dashboard; it can still change. Setup: Starlink guide. |
| Verizon 5G Home | On many lines | The gateway has a port forwarding page, but it does nothing on lines behind CGNAT. Check your WAN IP. |
| Cable and fiber (Xfinity, Spectrum, AT&T Fiber, Fios) | Usually not | These usually give you a public IPv4 address. If ports won’t open, you more likely have double NAT. |
How to tell if you’re behind CGNAT
1Find your router’s WAN IP
Open your router’s status or internet page (or your provider’s gateway app) and note the WAN, internet or public IP it shows. On a 5G gateway, check the gateway itself.
2Compare it with your real public IP
Search “what is my IP” from any device at home. If that address doesn’t match the router’s WAN IP, something upstream is translating.
3Check the range
A WAN IP between 100.64.0.0 and 100.127.255.255 confirms CGNAT. A 192.168.x.x or 10.x.x.x WAN IP means your router is behind another router in your home instead, which is double NAT and usually fixable on your side.
One caution: tools like Tailscale give your computer a 100.x address of their own. That’s a virtual adapter, not your internet connection. Only the router’s WAN address counts.
Does CGNAT affect a VPN router?
Not for normal VPN use. A VPN router opens its tunnel outward to your VPN provider, exactly like a web request, so WireGuard and OpenVPN connections come up normally behind CGNAT. Every device on the router is still covered. Plugging a VPN router in behind a T-Mobile, Verizon 5G or Starlink gateway is a setup that works.
What CGNAT blocks is the reverse direction: running a VPN server at home so you can connect back in from outside. Without a reachable public address, there’s nothing for your phone or laptop to connect to. The workarounds below handle that.
How to work around CGNAT
You can’t remove CGNAT from your side. These are the ways around it, from simplest to most involved.
1Ask your provider for a public IP
Some providers offer one on certain plans or as an add-on. Starlink Priority plans include an optional public IPv4 address you can enable in the account dashboard; it’s public but can still change. 5G home providers generally don’t offer one on residential plans, so ask about business plans if you need it.
2Use a mesh VPN like Tailscale for remote access
Tailscale and similar WireGuard-based tools have both ends connect outward to coordinate, so they work behind CGNAT with no ports to open. It’s the easiest way to reach your home cameras, files or router from anywhere. See how to set up Tailscale on a router.
3Use a VPN provider that offers port forwarding
A few VPN services can give you a forwarded port on their server, so inbound connections arrive through your VPN tunnel. Proton VPN offers it on paid plans; Mullvad removed the feature in 2023. Support on routers varies, so check your provider’s router instructions before you rely on it.
4Use IPv6 where your provider allows it
Providers behind IPv4 CGNAT often give each home public IPv6 addresses. That can help some games and apps connect, but many providers, including T-Mobile, filter incoming IPv6, so it isn’t a reliable way to host anything.
CGNAT vs double NAT
They cause the same symptoms, strict NAT and dead port forwards, but sit in different places. Double NAT is two routers inside your home; you can fix it with bridge mode, IP Passthrough or a DMZ. CGNAT is at your provider; nothing in your home can switch it off. And you can have both: a VPN router plugged in behind a 5G gateway that’s itself behind CGNAT is three layers deep. That’s fine for browsing, streaming and VPN use, and it’s why remote access on these connections should go through a mesh tool rather than port forwarding. Our double NAT guide covers the in-home layer.
Works behind 5G and Starlink gateways
See the best VPN routers of 2026
CGNAT doesn’t stop a VPN router from protecting every device in your home. Our routers ship pre-flashed and tested at our offices, with VPN pre-configuration available as an add-on at checkout, and plug in behind T-Mobile, Verizon 5G Home and Starlink gateways.
Compare the best routers of 2026 →Not sure which model fits your setup? Take the 60-second router quiz and we’ll match you to the right one.
Frequently asked questions
What is CGNAT?
CGNAT, or carrier-grade NAT, is when an internet provider shares one public IPv4 address among many customers instead of giving each home its own. Outgoing traffic works normally, but incoming connections such as port forwarding and remote access are blocked at the provider.
How do I know if I’m behind CGNAT?
Check the WAN or internet IP on your router or gateway. If it falls between 100.64.0.0 and 100.127.255.255, or doesn’t match the address shown by a “what is my IP” search, your provider is using CGNAT.
Does T-Mobile Home Internet use CGNAT?
Yes. T-Mobile 5G Home Internet puts IPv4 traffic behind CGNAT and doesn’t support port forwarding. A VPN router plugged in behind the gateway still connects to your VPN provider normally.
Does Starlink use CGNAT?
Starlink Residential and Roam use CGNAT for IPv4. Priority plans can enable an optional public IPv4 address from the account dashboard, though it can change. Starlink also provides IPv6.
Can a VPN get around CGNAT?
A regular VPN connection works normally behind CGNAT, but it doesn’t make your home reachable from outside on its own. For that you need a VPN provider that offers port forwarding, or a mesh tool like Tailscale for remote access.
Can I turn off CGNAT?
Not from your own equipment. Only your provider can give you a public IP address, and only some offer one, often on business or premium plans. Otherwise, use a mesh tool like Tailscale or a VPN with port forwarding to work around it.
CGNAT can’t stop a VPN router
Whole-home VPN protection behind 5G and satellite gateways, pre-flashed and tested before it ships.
Compare the best routers of 2026 →Not sure which fits? Take the 60-second router quiz
100,000+ Routers Shipped · 15+ Years of VPN Expertise · Official NordVPN Partner · US-Based Experts
What Is CGNAT? Starlink, T-Mobile & 5G Home Internet Guide