CGNAT IP Range: 100.64.0.0/10 Explained (RFC 6598)
The CGNAT range is 100.64.0.0/10 (RFC 6598). Learn how to confirm CGNAT, why port forwarding fails, and what fixes are realistic.
The CGNAT IP address range is 100.64.0.0/10 (100.64.0.0 - 100.127.255.255), defined by RFC 6598 as shared address space for internet providers. CGNAT (Carrier-Grade NAT) uses this special IPv4 range to let many customers share a smaller pool of public IPv4 space. Knowing that block matters because it explains why some connections cannot port forward, why a router WAN IP does not match the internet IP shown by websites, and why a perfectly normal ISP setup can still feel confusing when you try to self-host or game online.
Follow the address through two NAT layers
Read the diagram from left to right: your home router translates first, then the ISP CGNAT gateway combines many customer connections behind a shared public IPv4 address.
TL;DR: CGNAT range, RFC 6598, and port forwarding
- The CGNAT range is 100.64.0.0/10, also written as 100.64.0.0 - 100.127.255.255.
- RFC 6598 defines this as shared address space for internet providers that need carrier-grade NAT.
- Carrier-grade NAT lets an ISP place many customers behind shared public IPv4 exits while each customer router receives a non-public WAN address.
- Port forwarding is usually not possible for customers behind CGNAT because inbound traffic stops at the ISP NAT layer before it reaches the home router.
- To confirm CGNAT, compare your router WAN IP with the public IP shown by the IP address checker. If the router WAN IP is in
100.64.0.0/10and the visible public IP is different, you are behind CGNAT.
Want a quick answer? Try the interactive CGNAT Test - it auto-detects your public IP and ASN, then classifies your router WAN IP to tell you whether you are behind carrier-grade NAT.
Fast answer: what is a CGNAT IP?
A CGNAT IP is the address your ISP gives your router inside the provider's shared translation network. If that router WAN address is in 100.64.0.0/10, it is in the dedicated carrier-grade NAT range. Websites still see a different public IP because the ISP translates many customers onto shared public exits.
How CGNAT works: multiple customers share one public IPv4
CGNAT normally adds two translation layers. Each home router translates its devices to a router WAN address, and the ISP translates many of those customer connections again through a carrier-grade NAT gateway. The colored paths in the diagram represent separate subscriber flows that leave through one shared public IPv4 endpoint.
- Devices in each home use private LAN addresses such as
192.168.1.10. - Each home router translates its local traffic to a WAN address. Under CGNAT, that WAN address can be inside
100.64.0.0/10. - The ISP tracks each subscriber flow and translates many customers through its carrier-grade NAT gateway.
- Websites see the shared public IPv4 exit, not the customer router WAN address or the device's private LAN address.
The same flow written as addresses:
Device (192.168.1.10)
-> NAT (home router)
Router WAN: 100.64.12.34 (RFC 6598 shared space)
-> NAT (ISP CGNAT gateway)
Public IP: 203.0.113.55 (example public IPv4, RFC 5737)
-> InternetWhat is the CGNAT IP address range?
The CGNAT range is defined in RFC 6598 and sits between private addresses and public internet space. It is not the same as RFC1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). Instead, it is a dedicated shared space reserved for ISPs to perform large-scale network address translation.
In other words, CGNAT is the provider version of the same address conservation idea your home router already uses internally. Your devices sit behind one NAT layer on the LAN, and the ISP adds another NAT layer before traffic reaches the public internet. RFC 6598 defines the block specifically for that shared provider-side role.
CGNAT address space (100.64.0.0/10)
The CGNAT address space spans 100.64.0.0 through 100.127.255.255. If your router WAN IP falls inside that range, your connection is almost certainly behind carrier NAT.
That block contains 4,194,304 IPv4 addresses, but the point is not to hand every customer a globally routable public address. The point is to let providers share scarce public IPv4 capacity while still delivering normal legacy internet access.
At a glance, here are the CGNAT IP range facts:
| Property | Value |
|---|---|
| CGNAT IP range | 100.64.0.0/10 |
| First address | 100.64.0.0 |
| Last address | 100.127.255.255 |
| Total addresses | 4,194,304 |
| CIDR prefix | /10 |
| Defined by | RFC 6598 (shared address space) |
| Type | Shared ISP space, not public and not RFC1918 private |
What does "CGNAT space" mean?
"CGNAT space" is simply shorthand for the same reserved shared range (100.64.0.0/10) used by internet providers for carrier-grade NAT. If you see someone say "my WAN is in CGNAT space," they usually mean the router got an address from that block rather than a true public IPv4.
Why ISPs use CGNAT
- IPv4 addresses are limited and expensive
- CGNAT lets an ISP share one public IP across many customers
- It reduces costs while keeping legacy IPv4 services working
This is especially common on mobile networks, budget residential plans, and access providers serving large customer bases where giving every line a clean public IPv4 would be expensive or impossible. The result is operationally normal for the ISP even if it is inconvenient for power users.
How to tell if you are behind CGNAT
If your router's WAN or Internet IP is in 100.64.0.0/10 and the external public IP is different, that is strong direct evidence of carrier NAT. Your devices still use private IPs internally, while the router itself sits behind another NAT layer at the ISP.
A practical workflow looks like this:
- Open the router admin page and note the WAN or Internet IP.
- Check the externally visible IP with the IP Address Lookup.
- If the two values differ, your connection is being translated somewhere upstream.
- If the router WAN address falls inside
100.64.0.0/10, CGNAT is the most likely explanation.
Related terms: CGNAT, ASN, and NAT.
How to check if your ISP uses CGNAT
If the router shows an RFC 1918 address instead of 100.64.0.0/10, the comparison proves upstream NAT but cannot identify who operates it. Disconnect any VPN or proxy, check whether a modem-router sits in front of your main router, and repeat the comparison before blaming the ISP.
Then confirm which provider and ASN carry the visible public route. CGNAT is a per-ISP and per-plan policy, so a provider can use it on one access product and issue public IPv4 on another. Our what is my ISP guide identifies both. If the WAN and external results still indicate upstream translation, ask support whether your line uses CGNAT and whether public IPv4 or native IPv6 is available. If they quote a monthly fee for a static or public IPv4 address, that answer is itself confirmation that the default plan is behind carrier NAT.
What your WAN and public IP results actually prove
The table below is the classification logic used by our CGNAT workflow. It separates strong CGNAT evidence from results that prove only upstream NAT. A failed port check, private traceroute hop, or WAN/public mismatch is useful context, but none of those symptoms proves CGNAT by itself.
| Router WAN observation | External IP result | What the result proves |
|---|---|---|
100.72.18.4 | A different globally routable IPv4 | Strong CGNAT evidence: the WAN address is inside 100.64.0.0/10 |
10.44.5.9 | A different globally routable IPv4 | Upstream NAT is present; CGNAT is possible but not proven |
| A globally routable IPv4 | The same address | Likely public IPv4; test firewall and port rules separately |
| A globally routable IPv4 | Different while a VPN or proxy is active | Disconnect the VPN or proxy and repeat the comparison |
Worked examples
- Router WAN
100.73.5.22, public IP198.51.100.20(example address). The WAN sits inside100.64.0.0/10and differs from the public exit, which is the strongest single indicator of carrier NAT. - Router WAN
192.168.100.2. This is the range ISP modem-routers typically hand out, so the usual cause is a second router in front of your own. That is local double NAT, not CGNAT, and unlike CGNAT you can fix it yourself by putting the modem into bridge mode. - Router WAN
10.15.2.8, public IP differs. This can still be carrier NAT: some ISPs run their translation layer in RFC1918 space rather than the dedicated RFC 6598 block.
The third case matters because "not in 100.64.0.0/10" does not reliably mean "not carrier NAT." The RFC 6598 block is the cleanest indicator, not the only one, so rule out a second router of your own before concluding either way.
After that comparison, use an ASN lookup to confirm the network operator behind the visible public route. Then use CIDR notation and the reserved IP ranges guide to understand whether the router address is public, private, or shared.
CGNAT vs public IP
The practical difference is inbound reachability. With a public IPv4, the address on your router is globally routable, so port forwarding can send incoming traffic to a device on your LAN. With CGNAT, your router is behind the ISP's translation layer, so unsolicited inbound traffic stops before it reaches your router.
- Public IP: router WAN IP matches the external public IP, and inbound connections can work if firewall and port forwarding rules allow them.
- CGNAT: a WAN address inside 100.64.0.0/10 plus a different external public IP is strong evidence that the ISP gateway sits in front of your router, so ordinary router port forwarding cannot expose services directly. An RFC1918 WAN address plus a mismatch proves upstream NAT, but not necessarily CGNAT.
CGNAT range vs RFC1918 private ranges
This distinction confuses many users because both look non-public. RFC1918 ranges are private address blocks used inside homes, offices, and private networks:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
CGNAT space is different. It is not meant for your LAN. It is reserved specifically for shared provider-side NAT between the customer edge and the public internet. That is why a router WAN address in 100.64.0.0/10 is such a strong hint that the ISP is translating upstream.
Where CGNAT matters in practice
- Game hosting: inbound player connections often fail without a true public IPv4 or an alternate tunnel solution
- Remote access: home-lab, CCTV, and NAS access become harder unless you use IPv6 or a relay/tunnel approach
- Reputation-sensitive sites: other users on the same public exit can influence abuse scores and rate limits
- Support confusion: users compare router and website IPs and assume something is broken when it is simply provider NAT
- VPN testing: a CGNAT base path can complicate how public IP changes look across different checks
Common problems with CGNAT
- Port forwarding often does not work
- Self-hosted servers and game hosting can be blocked
- Some services detect shared IPs as higher risk
- IP reputation can be affected by other users
The biggest practical problem is inbound reachability. If you are trying to host a game server, expose a NAS, run a camera system, or receive direct unsolicited connections from the public internet, the ISP-side NAT layer breaks the simple "forward a port on the router" model. Your router is no longer the last translation point.
Does CGNAT affect geolocation or abuse reports?
It can. A shared public IP means multiple customers appear as the same address. Abuse, rate-limits, or geolocation decisions can be influenced by other users behind the same CGNAT gateway. This is one reason shared exits sometimes feel unfair in fraud and reputation systems.
A consumer VPN can encrypt your traffic and replace that shared ISP exit with the VPN server's public IP. It does not, by itself, make a home server reachable or restore ordinary inbound port forwarding. That requires a public address, native IPv6, a reverse tunnel, or a VPN service that explicitly assigns a reachable inbound port.
ISP-specific CGNAT cases users often search for
CGNAT is not limited to one country or one access type. It is common on mobile networks, fixed wireless, budget fiber plans, and providers with large IPv4 pressure. The provider name in search results matters less than the same evidence pattern: a router WAN IP in shared/private space, a different public IP on the web, and inbound port forwarding that never reaches the customer router.
Singtel Singapore and Simba Singapore CGNAT checks
Searches for Singtel Singapore CGNAT, Simba Singapore CGNAT, or Simba port forwarding issues usually describe the same problem: the customer wants inbound access, but the access network may place the connection behind shared IPv4 infrastructure. Do not assume every plan behaves the same. Check the router WAN IP first, compare it with the public IP checker, and then ask support for a public IPv4, static IP, bridge-mode option, IPv6 availability, or a business plan if direct inbound access is required.
Comnet Uzbekistan and regional ISP CGNAT
Comnet Uzbekistan CGNAT searches often mention 100.64.0.0/10 because that block is the strongest visible sign of RFC 6598 shared address space. If a router WAN address lands in that range, the practical answer is the same: ordinary home router port forwarding cannot publish a server to the internet unless the provider gives the line a reachable public address or you use IPv6, a tunnel, or a relay.
China Mobile, China Unicom, and China Telecom shared exits
Large Chinese networks can surface confusing public IP and geolocation clues because traffic may leave through carrier gateways far from the subscriber. A public IP such as a China Mobile, China Unicom, or China Telecom gateway can identify the operator and approximate region, but it does not prove a customer-level endpoint. For CGNAT diagnosis, treat the public IP as the shared exit and focus on the router WAN IP, ASN, and whether inbound traffic can reach the customer router.
Reverse DNS and PTR clues for CGNAT ranges
Reverse DNS can help explain a suspicious public IP, but it does not prove CGNAT by itself. A PTR record may contain words like broadband, mobile, pool, dynamic, cgnat, nat, customer, or a city code. Those names are provider-controlled labels, not a guarantee. Some shared exits have clear PTR records; others have generic names or no reverse DNS at all.
Use the Reverse DNS Lookup on the visible public IP, not on the router's private or CGNAT WAN IP. Addresses inside 100.64.0.0/10 are not globally routed, so public reverse DNS for that internal address often tells you little. The public exit IP, ASN, WHOIS/RDAP owner, and router WAN comparison together form the useful evidence set.
If you want the deeper naming model, read the PTR record guide. PTR records are helpful for context, but the CGNAT decision still comes from address comparison and inbound reachability.
How to bypass CGNAT safely
You do not really "bypass" CGNAT from your router alone. You either get a reachable address, use IPv6, or place a relay/tunnel outside the ISP NAT layer. The right option depends on whether you need gaming NAT improvement, remote desktop, a self-hosted service, or a NAS reachable from outside the home.
If your goal is lower ping rather than inbound reachability, treat that as a separate diagnosis. CGNAT adds a translation hop and pushes games onto relay servers, but most high ping is lost closer to home - to WiFi, an overloaded router, or bufferbloat - and none of the workarounds below will help with those. Our guide to diagnosing and reducing ping shows how to tell which layer is actually costing you the milliseconds before you change anything.
- Ask the ISP for a public IPv4, static IPv4, or business plan with public addressing.
- Use IPv6 if your ISP and target service support it, then secure the firewall rules carefully.
- Use a managed tunnel such as Cloudflare Tunnel, Tailscale, ZeroTier, or a VPS reverse tunnel for private remote access.
- Use a VPN provider with port forwarding only when the use case fits and the provider supports it in your required region.
What can you do if you need a public IP?
- Ask your ISP for a static public IPv4 (often paid)
- Ask for a dynamic public IPv4 (sometimes available on request)
- Use IPv6 if your ISP supports it
- Use a VPN with port forwarding if allowed
IPv6 is often the cleanest technical answer if your service and router support it, but not every use case can rely on it yet. For gaming, home-lab access, or older software that assumes IPv4 inbound access, the practical answer may still be "request a public IPv4 from the ISP" or "use a tunnel or relay system designed for this job."
Common pitfalls and edge cases
- Confusing CGNAT with double NAT at home. A second router can also cause mismatch and forwarding failures.
- Assuming 100.64.0.0/10 is a normal LAN range. It is shared provider space, not a standard home subnet block.
- Ignoring IPv6 availability. Some users have no clean public IPv4 but do have usable global IPv6.
- Forgetting mobile carriers use CGNAT heavily. Mobile broadband often behaves this way by default.
- Assuming every WAN mismatch means a bug. Often it is simply the normal design of the ISP network.
Useful IP Trackers tools for CGNAT checks
- CGNAT Test compares the router WAN address with the public address and classifies shared or private ranges.
- Open Port Checker tests whether a listening service is reachable from outside your network.
- IP Address Lookup shows the public IP websites see from the outside.
- IP Location helps you compare geolocation and provider context for the visible exit IP.
- ASN Lookup shows which network operator is announcing the public route.
- Reverse DNS can show PTR hostnames that hint at mobile, broadband, or hosted exits.
- Port Forwarding Not Working explains the most common symptom in more detail.
Frequently asked questions
What is a CGNAT IP? A CGNAT IP is an address used between a customer router and an ISP carrier-grade NAT system. An address inside 100.64.0.0/10 is RFC 6598 shared space: it is not globally routable, and the ISP translates it to a shared public IPv4 address.
How do I check if my ISP uses CGNAT? Compare the WAN or Internet IP in your router with the public IP shown by an external checker. A WAN address inside 100.64.0.0/10 plus a different public IP is strong CGNAT evidence. A mismatch by itself proves only upstream translation; a second home router, modem, VPN, or ISP private routing can also cause it. Ask the ISP for confirmation when the WAN address is not in the RFC 6598 range.
CGNAT vs public IP, what is the difference? A public IPv4 address is globally routable and can receive inbound connections when firewall and forwarding rules permit them. A CGNAT address is internal to the ISP, shares a public exit with other subscribers, and cannot receive unsolicited inbound connections without ISP support or a separate reachable tunnel endpoint.
How do I bypass CGNAT safely? Ask your ISP for a public IPv4 address, use globally routable IPv6 when both ends support it, or use an outbound tunnel or relay such as Tailscale, ZeroTier, Cloudflare Tunnel, or a VPS reverse tunnel. A normal consumer VPN changes the browsing exit but does not restore inbound port forwarding unless it explicitly provides a reachable port.
What is CGNAT space? CGNAT space is the shared ISP address block 100.64.0.0/10 reserved by RFC 6598 for communication between customer routers and carrier-grade NAT infrastructure.
What is the CGNAT IP address range? The CGNAT IP address range is 100.64.0.0/10, spanning 100.64.0.0 through 100.127.255.255. It contains 4,194,304 addresses reserved as shared provider space by RFC 6598.
Does CGNAT block port forwarding? CGNAT normally prevents ordinary router port forwarding because unsolicited inbound traffic reaches the ISP NAT gateway before it can reach your router. A failed port-forwarding test is a symptom, not proof by itself; firewall rules, a closed service, or local double NAT can produce the same result.
What is RFC 6598 shared address space? RFC 6598 reserves 100.64.0.0/10 for shared address space used by service-provider NAT systems. It is separate from the RFC 1918 private ranges used inside homes and offices, and it is not normal public IPv4 space.
Can reverse DNS prove CGNAT? No. PTR records may hint at mobile, broadband, dynamic-pool, or NAT infrastructure, but provider-controlled hostnames are not proof. Compare the router WAN IP with the external public IP and check whether the WAN address is inside 100.64.0.0/10.
Does Tailscale work behind CGNAT? Yes. Tailscale, ZeroTier, and similar overlay networks usually work behind CGNAT because devices establish outbound connections. They are useful for private remote access; publishing a service to the entire internet still requires a public endpoint, globally routable IPv6, or a relay.
Do Singtel, Simba, Comnet, or China Mobile always use CGNAT? Not on every plan or in every region. Large providers can use different access models by product and location. Check the router WAN IP, compare it with the external public IP, inspect the ASN, and ask support whether the specific line receives public IPv4.
IPv6 and CGNAT
CGNAT only exists because IPv4 addresses are scarce. If your ISP offers IPv6, you may get a globally routable address without NAT, which makes hosting and inbound access easier with the right firewall rules. It is not universal, but it is often a better long-term answer than fighting for one more public IPv4. For a full breakdown of how the two protocols differ, see IPv4 vs IPv6.
Conclusion
The CGNAT range (100.64.0.0/10) is normal for many ISPs today. It helps keep IPv4 running, but it can limit inbound connections and port forwarding. If you need a true public IP, talk to your ISP or use IPv6, a relay, or a VPN option that fits your setup.
Next: read ASN in networking explained, review reserved IP address blocks, or continue with why port forwarding fails under CGNAT.
Primary sources
Standards, registries, and first-party references used to verify this guide:
- RFC 6598: Shared Address Space - IETF. Defines 100.64.0.0/10 for carrier-grade NAT.
- RFC 6888: Common Requirements for CGN - IETF. Documents operational requirements and limits for carrier-grade NAT.
