CGNAT (Carrier Grade NAT, also called large scale NAT) is when your internet provider shares one public IPv4 address between many customers. Your router does not get its own public IP, so nothing on the internet can connect in to your network. This free CGNAT checker compares the WAN IP of your router with the public IP that websites see and tells you in one click if you are behind CGNAT.
How to Use the CGNAT Checker
- Open your router admin page in a browser, usually 192.168.1.1 or 192.168.0.1, and log in.
- On the status or internet page, find the WAN IP, Internet IP or IPv4 address of the internet connection.
- Paste that address in the box above and click Check. Use the same network and switch off any VPN, so the public IP we see is really yours.
If you use Tailscale, your devices also have a 100.x.x.x address from Tailscale itself. Enter the WAN IP from the router, not the Tailscale one.
How to Read the Result
| Router WAN IP | What it means |
|---|---|
| 100.64.0.0 to 100.127.255.255 | You are behind CGNAT. This range (RFC 6598) is reserved for internet providers |
| 10.x, 172.16.x to 172.31.x or 192.168.x | Double NAT. Another router or your provider NAT sits in front of your router |
| Same as your public IP | No CGNAT. Your router has its own public IP |
| A different public IP | Very likely CGNAT. Some providers use public ranges for CGNAT too |
What Problems Does CGNAT Cause?
Normal browsing, streaming and video calls work fine behind CGNAT. Problems start when something from outside needs to reach you:
- Port forwarding does not work, so you cannot host a game server, reach a home NAS or Plex server, or view CCTV and DVR cameras from outside.
- Online games may show a strict or moderate NAT type, which can cause matchmaking and voice chat issues.
- Shared IP reputation. Other users share your public IP, so you may see more CAPTCHAs or blocks. Check it with our IP Blacklist Checker.
- IP allowlists break, because your public IP is not yours alone and can change.
How to Get Around CGNAT
- Ask your provider for a public IP. Some providers give one free on request, many offer a static public IP as a paid add-on. This is the cleanest fix.
- Use IPv6. CGNAT only affects IPv4. If your provider gives IPv6, your devices may be reachable directly over IPv6 once you allow it in the router firewall.
- Use a tunnel instead of port forwarding. Tools such as Tailscale, ZeroTier or Cloudflare Tunnel make an outgoing connection, so they work behind CGNAT with no open ports.
- Use a VPN that offers port forwarding, which gives you a reachable port on the VPN server.
Check CGNAT With Traceroute
You can confirm the result by hand. Run tracert 8.8.8.8 on Windows or traceroute 8.8.8.8 on Mac and Linux. If the hop right after your router has an address between 100.64.0.0 and 100.127.255.255, your connection goes through CGNAT.
To see the public IP websites see, use What Is My IP. To find the local address of your device, read What Is My Private IP Address?