What Is NAT and CGNAT? Why Your Home Server Is Unreachable (And How to Fix It)

The Root Cause: IPv4 Address Exhaustion

To understand NAT and CGNAT, you first need to understand why they exist. Both were invented to solve the same problem: there are not enough IPv4 addresses for every device that needs one.

IPv4, the addressing system that the internet still primarily runs on in 2026, uses 32-bit addresses. A 32-bit number can represent exactly 4,294,967,296 unique values (about 4.3 billion). That sounds like a lot, but it is not. Of those 4.3 billion addresses, a significant portion is reserved for special purposes (multicast, loopback, documentation examples, and future use), leaving roughly 3.7 billion usable public addresses. The world has far more than 3.7 billion internet-connected devices.

The depletion of the global IPv4 address pool was not sudden. It was foreseen decades before it happened, and NAT was the primary mechanism invented to delay it. Here is how the exhaustion unfolded:

What Is NAT (Network Address Translation)?

NAT is a technique implemented in a router or gateway device that translates IP addresses in packet headers as traffic passes through. Its most common application is allowing many devices sharing private (non-routable) IP addresses to communicate with the internet using a single public (routable) IP address.

To understand why this is necessary, you need to understand the difference between private and public IP addresses.

Private IP address ranges (RFC 1918)

RFC 1918 defines three blocks of IPv4 address space as "private." These addresses are not routable on the public internet: no router on the internet's backbone will forward packets whose destination is a private address. They exist only inside private networks.

Every device on your home network has a private IP address (typically 192.168.x.x). Your laptop, phone, smart TV, and Raspberry Pi all have addresses in this range that are invisible and meaningless to anything on the public internet. When any of these devices needs to communicate with a server on the internet, NAT makes it possible.

How NAT works: PAT (Port Address Translation)

The most common type of NAT used in home routers is PAT (Port Address Translation), also called NAT overload or NAPT. It allows multiple private IP addresses to share a single public IP address by distinguishing each connection using port numbers. Here is what happens step by step when your laptop (192.168.1.50) loads a website:

Multiple devices can use the internet simultaneously because the router assigns different public-side port numbers to each device's connections. The NAT table tracks all active connections and routes return traffic to the correct device. When a connection ends, its entry is removed from the table.

Why Inbound Connections Fail Through NAT

NAT works perfectly for outbound connections (your devices reaching out to the internet) because the connection is initiated from inside the network. The router creates a NAT table entry when the connection starts, and uses that entry to route return traffic back.

The problem with inbound connections (someone on the internet trying to reach your home server) is that there is no NAT table entry. The external device sends a packet to your router's public IP address. The router receives the packet and looks in its NAT table. There is no entry for this packet because no outbound connection was made first. The router does not know which internal device this packet is intended for. It drops the packet.

Port Forwarding: The Traditional Solution

Port forwarding (also called Destination NAT or inbound NAT) is a router configuration that pre-maps an external port on the router's public IP to an internal device and port. When configured, inbound traffic matching that port is forwarded to the designated device without requiring a prior outbound connection.

With port forwarding configured and a static (or DDNS-tracked) public IP, home servers are accessible from the internet. This worked reliably for most home users for two decades. Then CGNAT arrived.

What Is CGNAT (Carrier Grade NAT)?

CGNAT (Carrier Grade NAT), also known as Large Scale NAT (LSN), is NAT implemented at the ISP level rather than at the home router level. Instead of giving each customer a real public IPv4 address, the ISP assigns customers addresses from the RFC 6598 range (100.64.0.0/10) and performs address translation on its own network before traffic reaches the public internet.

The result is NAT applied twice: once at the ISP's infrastructure (CGNAT) and once at your home router. This two-layer structure is called NAT444, because three separate IPv4 address spaces are involved:

How to Detect if You Are Behind CGNAT

There are two reliable methods to check whether your ISP uses CGNAT for your connection.

Method 1: Compare your router's WAN IP with your public IP

Method 2: Check for RFC 6598 addresses

If your router's WAN IP falls within the range 100.64.0.0 to 100.127.255.255, this is the RFC 6598 CGNAT address space. This is a definitive indicator of CGNAT. You are behind your ISP's NAT device, and the address you have is not routable on the public internet under any circumstances.

You can also check via the command line from any device on your network:

# Linux / macOS: trace the route to a public address and look at the first hops:
traceroute 8.8.8.8

# Windows:
tracert 8.8.8.8

If any of the early hops (the first two or three) show addresses in the 100.64.0.0/10 range, you are behind CGNAT and those are your ISP's internal network hops.

Why CGNAT Makes Port Forwarding Impossible

Port forwarding requires that you control the device performing NAT between your internal server and the public internet. Under CGNAT, there are two NAT layers:

You cannot configure the ISP's CGNAT device. You do not have access to it. Even if you forward every port on your home router, the ISP's NAT layer sits between your router and the internet, and it blocks all unsolicited inbound connections by default. Your port forwarding rules are completely irrelevant because the traffic never reaches your router in the first place.

Complete IPv4 Address Space Reference for Home Server Operators

Real-World Impact of CGNAT on Home Servers and Self-Hosting

CGNAT does not affect your ability to browse the internet, stream video, use social media, or do anything that involves your devices making outbound connections. Those all work normally because outbound connections create NAT table entries in both layers. The impact is entirely on inbound connections to services you want to host.

Solutions: How to Expose a Home Server Behind CGNAT

Despite being unable to receive unsolicited inbound connections, there are several ways to expose services running on your home network to the internet. All of them work around CGNAT by establishing an outbound connection first, which CGNAT allows, and then using that outbound connection to carry inbound traffic.

How Localtonet Bypasses CGNAT

The key insight is direction. CGNAT blocks unsolicited inbound connections but allows all outbound connections. Localtonet uses this asymmetry:

Frequently Asked Questions