What is Carrier-Grade NAT (CGNAT)?
Learn what CGNAT is, why ISPs use 100.64.0.0/10, and how it affects port forwarding and inbound connections — with interview Q&A.
Expected Interview Answer
Carrier-Grade NAT (CGNAT) is a large-scale form of network address translation that an ISP runs in its own network to share a small pool of public IPv4 addresses across thousands of subscribers, stacking an extra NAT layer on top of the NAT already running in each customer router.
A home router already does NAT, translating many private LAN addresses to one public address handed out by the ISP. With CGNAT, that address the ISP hands out is itself private (typically from the shared 100.64.0.0/10 range), so the ISP performs a second NAT translation at its edge, mapping thousands of customers onto a much smaller pool of truly public IPv4 addresses using distinct port ranges per subscriber. This lets an ISP delay IPv4 exhaustion without giving every customer a real public address, but it breaks assumptions that used to hold with one NAT hop: inbound connections, port forwarding, and some peer-to-peer or gaming traffic become unreliable because many customers now share one visible public IP distinguished only by port range. It also complicates abuse tracking, since a single public IP in logs may represent hundreds of unrelated subscribers at once. IPv6 deployment is the long-term fix, since it removes the address scarcity that makes CGNAT necessary in the first place.
- Extends usable IPv4 address life for an ISP with limited public space
- Requires no changes to subscriber home routers or equipment
- Reduces cost versus buying additional public IPv4 blocks
- Buys time for gradual IPv6 rollout across the access network
AI Mentor Explanation
CGNAT is like a stadium that only has a handful of turnstile lanes but sells tickets to far more fans than lanes can individually track, so it groups fans into numbered queues sharing each lane and records which queue-slot let each fan through. A steward outside cannot tell two fans in different queues apart just from the lane number, only from the lane-plus-slot combination. Trying to send a fan a personal message using only the lane number fails, because hundreds of unrelated fans share that same lane at once, which mirrors why inbound connections struggle to reach a specific device behind CGNAT.
Step-by-Step Explanation
Step 1
Subscriber assignment
The ISP hands each customer router a private address from the shared CGNAT range (100.64.0.0/10) instead of a public one.
Step 2
Second translation
At the ISP edge, an additional NAT device maps many subscriber private addresses to a smaller pool of real public IPv4 addresses.
Step 3
Port range allocation
Each subscriber is given a distinct range of source ports on a shared public IP so return traffic can be routed back correctly.
Step 4
Logging for accountability
The CGNAT device logs IP-and-port-to-subscriber mappings so abuse or legal requests can be traced back to the right customer.
What Interviewer Expects
- Explains CGNAT as a second, ISP-level NAT layered above home NAT
- Knows the 100.64.0.0/10 shared address space and why it exists
- Identifies the downside: broken inbound connections and P2P/gaming issues
- Connects CGNAT to IPv4 exhaustion and positions IPv6 as the real fix
Common Mistakes
- Confusing CGNAT with ordinary home-router NAT (only one layer)
- Assuming CGNAT gives every subscriber a unique public IP
- Not knowing port forwarding generally fails for CGNAT subscribers
- Thinking CGNAT is a permanent replacement for IPv6 rather than a stopgap
Best Answer (HR Friendly)
“Carrier-grade NAT is a trick ISPs use to stretch a limited supply of public internet addresses across way more customers than they have addresses for, by sharing one public address among many households using different port ranges. It saves the ISP money and buys time, but it can make things like hosting a game server or forwarding a port from home trickier, because your address is not really yours alone anymore.”
Code Example
# Compare your router’s WAN IP to what the internet sees
ip -4 addr show eth0 | grep inet
# inet 100.72.14.9/10 <- shared CGNAT range (100.64.0.0/10)
curl -s https://api.ipify.org
# 203.0.113.55 <- the real public IP many subscribers may share
# If the WAN IP falls inside 100.64.0.0/10, you are behind CGNAT
python3 -c "
import ipaddress
wan = ipaddress.ip_address('100.72.14.9')
print(wan in ipaddress.ip_network('100.64.0.0/10'))
"Follow-up Questions
- Why was 100.64.0.0/10 chosen instead of a normal private range for CGNAT?
- How does CGNAT affect port forwarding and self-hosted services?
- What is a Port Control Protocol (PCP) and how does it help behind CGNAT?
- How does IPv6 removing the need for CGNAT change ISP infrastructure costs?
MCQ Practice
1. What address range is commonly reserved for the ISP-facing side of CGNAT?
100.64.0.0/10 is the shared address space defined for carrier-grade NAT, separate from RFC 1918 private ranges.
2. What is the main downside of CGNAT for subscribers?
Because many subscribers share one public IP distinguished only by port range, unsolicited inbound connections often cannot be routed correctly.
3. What is the primary long-term solution CGNAT is meant to bridge toward?
CGNAT is a stopgap that extends IPv4 life; IPv6 removes address scarcity entirely, eliminating the need for it.
Flash Cards
What is CGNAT? — A second, ISP-level NAT that shares a small pool of public IPv4 addresses across many subscribers.
What address range does CGNAT use? — 100.64.0.0/10, reserved specifically for carrier-grade NAT.
Main downside of CGNAT? — Inbound connections and port forwarding become unreliable since many subscribers share one public IP.
Long-term fix for needing CGNAT? — IPv6 adoption, which removes IPv4 address scarcity.