What is CGNAT, and why does it get innocent users blocked?

CGNAT, short for carrier-grade NAT, is a translator that an internet provider runs to put many customers behind one public IPv4 address. Your router gets an address from a shared range, often 100.64.0.0/10, and the provider swaps it for a public address on the way out. Websites then see one address for many people. When one of them misbehaves, a block on that address reaches everyone behind it.

#How does CGNAT work?

A home router already shares one public address among the devices in one home. CGNAT adds a second layer at the provider, so one public address serves several homes or small firms at the same time (RFC 6269).

1. Your provider gives your router an address from shared space such as 100.64.0.0/10, a block reserved for these devices in 2012 (RFC 6598).
2. Your router translates your devices to that address, as home routers always have.
3. The provider's CGNAT translates again and maps each connection to a public address and a port.
4. Replies come back to that address and port, and the CGNAT sends them on to your router.

Each public address has 65,536 port numbers, and the provider divides them among its subscribers. In the worked example of RFC 7422, the ports of one address are split 16 ways, and each subscriber gets a block of 4,032.

Providers turned to CGNAT as the regional registries ran out of new IPv4 addresses. By 2016, four of the five registries had run out. The two that ran out first, in Asia-Pacific and Europe, showed more than twice the CGN rate of the others (Richter et al., IMC 2016).

#How common is CGNAT?

On mobile data it is close to universal. A 2016 study found CGN in 161 of the 171 cellular networks it could test, or 94.2 percent. On fixed lines it was rarer, at 11.2 to 18.7 percent of networks depending on the test (Richter et al., IMC 2016).

Test A is the Netalyzr app and test B is a crawl of BitTorrent peers. Newer data points the same way. Cloudflare wrote in 2025 that one IPv4 address may now stand for hundreds or even thousands of users. It found the most users per address in large parts of Africa and South Asia.

#Why does CGNAT get innocent users blocked?

Blocklists and rate limits have long assumed that one address means one user (Cloudflare research, 2025). Behind CGNAT that assumption fails. The IETF warned in 2011 that IP blocking for abuse "will cause collateral damage" (RFC 6269). One user who fails logins on a shared address can lock out others on their first try.

Reputation is shared the same way, and so is the IP fraud score built on it. In the words of the 2016 study, "by sharing IP addresses among users the reputation is also shared and can cause problems for some users".

Cloudflare found the median bot rate nearly the same for CGNAT addresses, at 4.8 percent, and for other addresses, at 4.7 percent. The mean was lower for CGNAT, 7 percent against 13.1. Its customers still rate limited CGNAT addresses three times more often than others (Cloudflare research, October 29, 2025).

#How do I know if I am behind CGNAT?

1. Open your router's status page and note its WAN or internet address.
2. Open what is my IP and note the public address that websites see.
3. If the two differ, a second NAT sits between your router and the internet, either another router at home or the provider's CGNAT.
4. If the router's address falls between 100.64.0.0 and 100.127.255.255, it comes from the CGNAT range of RFC 6598.

On mobile data, expect CGNAT in most cases, given the 94.2 percent found in 2016. Scoring services can see the shared range too. On October 23, 2026, FFraud's API answered 100.64.0.1 with the connection type Private Network, shared_connection: true and a score of 0.

curl https://api.ffraud.com/public/ip/100.64.0.1

#What should a website do with a CGNAT address?

• Log the port and the time. RFC 6302 asks every internet-facing server to log the source port and an accurate timestamp with the address. Without them, a provider cannot tell which subscriber was behind an abuse report.
• Challenge before you block. Use a CAPTCHA or a second login step on a shared address, and keep hard blocks for confirmed, recent abuse.
• Limit per account as well as per address. A rate limit on the account or session reaches the one abuser, not the whole gateway.
• Read the shared flag. FFraud puts a ceiling on shared connections such as mobile carrier NAT (how we score), and its API returns a shared_connection field.

#What is CGNAT confused with?

Several setups put many people behind one address. They differ in who shares the address and who chose it.

A VPN or proxy makes requests look as if they came from its own address (RFC 7239). Apple's Private Relay works in a similar way. Its second relay hands out a temporary IP address, and Apple warns that some websites may then ask for extra steps (Apple support, 2023).

FFraud's API scored one of Apple's published relay addresses, 172.224.226.1, at 10 with the relay and shared flags set, although half of its /24 network was flagged (October 23, 2026). The ceiling for shared addresses kept the score low, as an IP reputation check of that address shows.

#Questions people ask

To see the address websites get from your connection, and how it scores, open the free what is my IP check.