Donate
Donate

CGNAT Test

Check whether your ISP places you behind carrier-grade NAT, and what to do about it

Am I behind CGNAT?

Carrier-grade NAT (CGNAT) is why some connections cannot port forward, host a game server, or reach a home NAS from outside. This test detects your public IP and network automatically, then helps you classify your router WAN IP - the one piece of evidence that actually proves CGNAT - so you get a clear answer instead of a guess.

The same comparison works as a double NAT test. If your router WAN IP is a private address such as 192.168.x.x or 10.x.x.x, a second router sits in front of yours - usually the ISP modem - and it blocks port forwarding the same way CGNAT does, but you can fix it yourself.

Lily's network check

Compare both sides of the connection

The public IP is what the internet sees; your router WAN IP is what proves CGNAT. Compare them before changing port-forwarding rules.

Understand the CGNAT rangeTest a forwarded port
Lily checking a router and network connection

Your connection right now

Detecting your public IP...

Your browser can't see your router's WAN IP directly, so paste it once and we'll do the rest. It is classified on your device and never sent anywhere.

Opening ports or just hiding your IP?

For inbound access you need a VPN with port forwarding - a standard one hands you another shared address. For privacy alone, any trusted VPN hides your IP from the sites you visit.

See hide.me port forwardingCompare VPNs

Affiliate link. IP Trackers may earn a commission if you buy through it, at no extra cost to you. It does not change what we recommend - see our editorial policy.

Finding the CGNAT checker useful?

It is free with no sign-up. A small contribution helps keep the checker running and the troubleshooting guides current.

Support this tool

How this CGNAT test works

A browser cannot read your router's WAN IP on its own, so a fully automatic one-click verdict is not technically possible. The honest, accurate approach is a two-part check:

  1. Automatic: we detect the public IP the internet sees for you, plus its ASN, network owner, and reverse DNS hostname. If that public IP is itself inside 100.64.0.0/10, we flag the rare carrier-level CGNAT case immediately.
  2. One manual step: you paste your router WAN IP once. It is classified entirely on your device - CGNAT, private (RFC1918), public, loopback, or link-local - and compared with your detected public IP to produce a verdict.

The decisive signal is simple: if the router WAN IP is in 100.64.0.0/10 and your public IP is different, you are behind CGNAT. For the full background on that range, read the CGNAT IP range explainer.

Verify each layer

How to read your CGNAT test result

  • WAN IP in 100.64.0.0/10: you are behind CGNAT. Ordinary port forwarding will not reach you - use IPv6, a relay such as Tailscale, or ask your ISP for a public IPv4.
  • WAN IP equals your public IP: you have a public address and are not behind CGNAT. Inbound connections can work once firewall and port-forward rules allow them.
  • WAN IP is private (RFC1918) and differs: either CGNAT using private space or a second router upstream (double NAT). To tell them apart, open the ISP modem's own admin page: if its WAN IP is public, the double NAT is inside your home and bridge mode or IP passthrough on the modem removes it. If the modem's WAN IP is also private or in 100.64.0.0/10, the extra layer is the ISP's carrier NAT.
  • WAN IP is public but differs from your visible IP: usually a VPN or proxy is active. Disconnect it and re-test.

Still stuck on inbound access after confirming CGNAT? The port forwarding under CGNAT guide walks through every realistic fix.

Fix and learn more

What to do after the test

Match the next step to your goal, whether that is reaching your own devices or hosting a public service.

1Next step
Verify

Test the forwarded TCP port

Run an outside-in port check to confirm whether your service is open, closed, or filtered after changing router and firewall rules.

Open port checker
2Next step
Diagnose

Confirm your network owner

Use the detected public IP to verify which ISP or carrier is announcing your route before contacting support.

Open ASN lookup
3Next step
Resolve

Fix port forwarding

If the test says CGNAT, this guide covers IPv6, relays, and asking your ISP for a public IPv4.

Read the fixes
4Next step
Learn

Understand the 100.64.0.0/10 range

Learn why this RFC 6598 block exists, how to read a WAN IP, and how CGNAT differs from a normal private network.

Read the explainer
5Next step
Verify

Re-check your public IP

Compare your visible IP again after changing networks, toggling a VPN, or asking your ISP for a public address.

Check IP

Related Articles

CGNAT IP Range: 100.64.0.0/10 Explained (RFC 6598)13 min read • January 17, 2026CGNAT Port Forwarding Not Working? Fix It in 20269 min read • June 3, 2026What Is My ISP? How to Check Your Internet Provider and ASN15 min read • February 9, 2026Why Does My IP Address Keep Changing? How to Stop It12 min read • October 2, 2026Public vs Private IP: Differences, Ranges and Examples13 min read • August 1, 2026What Is an ASN? Autonomous System Number Explained8 min read • January 9, 2026IPv4 vs IPv6: Speed, Security and Key Differences10 min read • April 26, 2026What Is a Router? Definition, Functions, and Types11 min read • April 5, 2026

Frequently asked questions

How do I know if I am behind CGNAT?
Compare your router WAN IP with the public IP websites see. If the router WAN IP is inside 100.64.0.0/10 and the public IP is different, you are behind carrier-grade NAT. This test detects your public IP automatically and classifies the WAN IP you paste in.
Can this test detect double NAT?
Yes. If the router WAN IP you paste is a private address (192.168.x.x, 10.x.x.x, or 172.16-31.x.x) and differs from your public IP, another NAT layer sits upstream. Check the ISP modem: if its WAN IP is public, the double NAT is in your home and bridge mode or IP passthrough on the modem fixes it. If the modem WAN IP is private or in 100.64.0.0/10 too, the extra layer is your ISP's carrier-grade NAT.
Can a website detect CGNAT automatically?
Not fully. A website only sees your public exit IP, not your router WAN IP, so it cannot prove CGNAT on its own. It can flag the rare case where the public IP itself is in 100.64.0.0/10, but the reliable check needs your router WAN IP, which you read from the router admin page.
Is 100.64.x.x a public IP?
No. 100.64.0.0/10 is RFC 6598 shared address space reserved for ISP carrier-grade NAT. It is not globally routable like a normal public IPv4 address.
Where do I find my router WAN IP?
Open your router admin page, usually 192.168.1.1 or 192.168.0.1, sign in, and look on the status or overview page for a field labelled WAN, Internet, or IPv4 address.
Does this CGNAT test store my IP address?
The WAN IP you paste is classified entirely in your browser and is never sent to our servers. Your public IP is looked up the same way any IP checker works, and is not retained beyond a short cache used to return results.
I am behind CGNAT - how do I get a public IP?
Ask your ISP for a public or static IPv4 (sometimes a small fee or business plan), use IPv6 if it is available, or use a relay such as Tailscale for private device access and a VPN with port forwarding or a VPS tunnel for public hosting.