What is carrier-grade NAT?
A second translation you do not control, and the reason some things at home simply cannot be made to work.
The ten-second test
Do this before reading anything else, because it decides whether the rest applies to you.
- Open your router's status page and find its WAN or internet address. How to get in.
- Compare it with the address on our front page.
If the router shows an address between 100.64.x.x and 100.127.x.x and it does not match ours, you are behind carrier-grade NAT. That range is 100.64.0.0/10, reserved by RFC 6598 for exactly this purpose.
What is actually happening
Normally your router holds a real public address and performs one translation between your private network and the internet. Under carrier-grade NAT your router holds a shared address instead, and your provider performs a second translation before your traffic reaches the internet.
The reason is straightforward: there are not enough IPv4 addresses left for every customer to have one. Sharing a single public address among many subscribers stretches the supply, in exactly the way your own router stretches one address across your household.
What it breaks, and what it does not
| Activity | Works? |
|---|---|
| Browsing, streaming, email, video calls | Yes. Anything you initiate is unaffected |
| Online gaming | Mostly yes, but NAT type will report Strict |
| Port forwarding | No. There is no inbound path to forward |
| Hosting a game or web server at home | No, not directly |
| Reaching a camera or NAS from outside | No, not directly |
| Dynamic DNS | No. It solves a moving address, not a missing path |
| Being on an allowlist a vendor gave you | Unreliable. The address is shared and can change |
It is the most common wrong answer. Dynamic DNS keeps a hostname pointing at an address that changes. Under carrier-grade NAT the problem is not that the address moves, it is that nothing can connect inward to it at all. A name that resolves to a shared provider gateway does not help.
Four ways around it
1. Ask for a public address
The simplest, and more often available than people expect. Many providers will move you off carrier-grade NAT on request, free or for a small monthly fee, especially if you say you need to reach a device at home. Worth one phone call before doing anything more complicated.
2. Use IPv6
Carrier-grade NAT is an IPv4 problem. If your provider offers IPv6, your devices likely have real, globally routable IPv6 addresses with no translation at all, and inbound connections work if your firewall permits them. The catch is that whoever is connecting also needs IPv6, which is not yet a safe assumption.
3. Connect outward instead of inward
The approach that sidesteps the problem rather than fighting it. A mesh VPN or a relay service has your home device make an outgoing connection to a coordination server, and your phone connects to the same place. Outgoing connections always work, even through two layers of translation, so nothing needs forwarding and nothing is exposed. For most people wanting to reach a home server, this is the best answer available, and several options are free at small scale.
4. Rent a small server
A cloud instance with a real address that your home connects out to, and which forwards traffic back down the tunnel. More work than the previous option and more control.
Why providers do it, and why it is spreading
Not to inconvenience anyone. IANA handed out the last free IPv4 blocks in 2011, and the regional registries exhausted theirs over the following years. A provider adding customers today has no free pool to draw from, so it can buy addresses on a transfer market at real cost, deploy IPv6 and hope everything else follows, or share what it already holds. Most do the third and some of the second.
Mobile networks have worked this way for years, which is why a phone on cellular data almost never has a reachable address. It is now common on fixed-line connections too, particularly with newer providers who never had a large historical allocation.