Donate
Donate

CGNAT Test

Check whether your ISP places you behind carrier-grade NAT, and what to do about it

Am I behind CGNAT?

Carrier-grade NAT (CGNAT) is why some connections cannot port forward, host a game server, or reach a home NAS from outside. This test detects your public IP and network automatically, then helps you classify your router WAN IP - the one piece of evidence that actually proves CGNAT - so you get a clear answer instead of a guess.

Your connection right now

Detecting your public IP...

Your browser can't see your router's WAN IP directly, so paste it once and we'll do the rest. It is classified on your device and never sent anywhere.

How this CGNAT test works

A browser cannot read your router's WAN IP on its own, so a fully automatic one-click verdict is not technically possible. The honest, accurate approach is a two-part check:

  1. Automatic: we detect the public IP the internet sees for you, plus its ASN, network owner, and reverse DNS hostname. If that public IP is itself inside 100.64.0.0/10, we flag the rare carrier-level CGNAT case immediately.
  2. One manual step: you paste your router WAN IP once. It is classified entirely on your device - CGNAT, private (RFC1918), public, loopback, or link-local - and compared with your detected public IP to produce a verdict.

The decisive signal is simple: if the router WAN IP is in 100.64.0.0/10 and your public IP is different, you are behind CGNAT. For the full background on that range, read the CGNAT IP range explainer.

Verify each layer

How to read your CGNAT test result

  • WAN IP in 100.64.0.0/10: you are behind CGNAT. Ordinary port forwarding will not reach you - use IPv6, a relay such as Tailscale, or ask your ISP for a public IPv4.
  • WAN IP equals your public IP: you have a public address and are not behind CGNAT. Inbound connections can work once firewall and port-forward rules allow them.
  • WAN IP is private (RFC1918) and differs: either CGNAT using private space or a second router upstream (double NAT). If port forwarding fails, ask your ISP whether the line is carrier-NAT.
  • WAN IP is public but differs from your visible IP: usually a VPN or proxy is active. Disconnect it and re-test.

Still stuck on inbound access after confirming CGNAT? The port forwarding under CGNAT guide walks through every realistic fix.

Fix and learn more

What to do after the test

Match the next step to your goal, whether that is reaching your own devices or hosting a public service.

1Next step
Verify

Test the forwarded TCP port

Run an outside-in port check to confirm whether your service is open, closed, or filtered after changing router and firewall rules.

Open port checker
2Next step
Diagnose

Confirm your network owner

Use the detected public IP to verify which ISP or carrier is announcing your route before contacting support.

Open ASN lookup
3Next step
Resolve

Fix port forwarding

If the test says CGNAT, this guide covers IPv6, relays, and asking your ISP for a public IPv4.

Read the fixes
4Next step
Learn

Understand the 100.64.0.0/10 range

Learn why this RFC 6598 block exists, how to read a WAN IP, and how CGNAT differs from a normal private network.

Read the explainer
5Next step
Verify

Re-check your public IP

Compare your visible IP again after changing networks, toggling a VPN, or asking your ISP for a public address.

Check IP

Related Articles

CGNAT IP Range: 100.64.0.0/10 Explained (RFC 6598)13 min read • January 17, 2026CGNAT Port Forwarding Not Working? Fix It in 20269 min read • June 3, 2026Public vs Private IP Addresses Explained13 min read • December 2, 2025What Is an ASN in Networking? Autonomous System Number Explained8 min read • January 9, 2026IPv4 vs IPv6: Understanding the Differences10 min read • April 26, 2026What Is a Router? Definition, Functions, and Types11 min read • April 5, 2026

Frequently asked questions

How do I know if I am behind CGNAT?
Compare your router WAN IP with the public IP websites see. If the router WAN IP is inside 100.64.0.0/10 and the public IP is different, you are behind carrier-grade NAT. This test detects your public IP automatically and classifies the WAN IP you paste in.
Can a website detect CGNAT automatically?
Not fully. A website only sees your public exit IP, not your router WAN IP, so it cannot prove CGNAT on its own. It can flag the rare case where the public IP itself is in 100.64.0.0/10, but the reliable check needs your router WAN IP, which you read from the router admin page.
Is 100.64.x.x a public IP?
No. 100.64.0.0/10 is RFC 6598 shared address space reserved for ISP carrier-grade NAT. It is not globally routable like a normal public IPv4 address.
Where do I find my router WAN IP?
Open your router admin page, usually 192.168.1.1 or 192.168.0.1, sign in, and look on the status or overview page for a field labelled WAN, Internet, or IPv4 address.
Does this CGNAT test store my IP address?
The WAN IP you paste is classified entirely in your browser and is never sent to our servers. Your public IP is looked up the same way any IP checker works, and is not retained beyond a short cache used to return results.
I am behind CGNAT - how do I get a public IP?
Ask your ISP for a public or static IPv4 (sometimes a small fee or business plan), use IPv6 if it is available, or use a relay such as Tailscale for private device access and a VPN with port forwarding or a VPS tunnel for public hosting.