Network topology

CGNAT vs Double NAT

Both can place another translation layer in front of your router, but they are not the same problem. The address shown on the router WAN side and the devices in your network path help determine which explanation is more likely.

Compare your IPs Find the WAN IP

CGNAT path

The ISP controls the shared NAT layer

device -> home router -> ISP shared NAT -> internet

With carrier-grade NAT, multiple customer connections can share public IPv4 capacity through translation operated inside the provider network. A router WAN address inside 100.64.0.0/10 is a strong sign of this kind of shared-address path.

A forwarding rule on your own router cannot normally create a matching rule in an ISP-controlled NAT system. The practical first question is whether the provider can supply a public IPv4 address or another supported inbound-connectivity option.

Double-NAT path

Two routers translate traffic locally

device -> personal router -> ISP gateway -> internet

Double NAT commonly appears when an ISP modem-router remains in router mode while your own router also performs NAT. The personal router may then receive a WAN address such as 192.168.x.x, 10.x.x.x, or 172.16-31.x.x from the outer gateway.

Depending on the equipment and support guidance, the local fix may be bridge or modem mode, access-point mode, removing an unnecessary router, or forwarding through both devices. Double NAT is not automatically evidence that the ISP also uses CGNAT.

CGNAT and double NAT compared

These are common patterns, not guarantees. Managed gateways and unusual provider designs can require additional verification.

Question	CGNAT	Double NAT
Who controls the extra NAT?	Usually the ISP or upstream provider.	Usually two routers or gateways in the local path.
Typical WAN clue	100.64.0.0 through 100.127.255.255.	10.x.x.x, 172.16-31.x.x, or 192.168.x.x.
Can your router forward through it?	Not through the provider NAT layer you do not control.	Sometimes, if both local devices are configured correctly.
First practical action	Ask the ISP about shared IPv4 and public IPv4 availability.	Map the devices and review bridge, access-point, or dual-forwarding options.

Decision structure

Start with the WAN value, then inspect the path

WAN = 100.72.x.x

Strong shared-address evidence

Ask the ISP whether the connection uses CGNAT or shared IPv4 and whether a public IPv4 option exists.

WAN = 192.168.0.x

Private upstream NAT

Look for an ISP gateway or second router before concluding that ISP-level CGNAT is involved.

WAN = Public and matches

No strong standard-CGNAT signal

Move on to the service, firewall, forwarding rule, and local network configuration.

WAN = Public but different

Upstream mismatch needs investigation

Check the outer gateway, managed router, proxy, or other device that may be changing the public path.

How to confirm local double NAT

Identify the device that your computer uses as its router.
Read that router's separately labelled WAN or Internet IPv4.
If it is private, check whether an ISP gateway or another router sits upstream.
Read the outer device's WAN address and compare it with the public IPv4 online.
Use manufacturer or ISP guidance before changing bridge or access-point modes.

What the checker can and cannot settle

The CGNAT checker can identify these address patterns and compare public values. It cannot see every router in the path or prove why a provider assigned a particular address. If you need the input first, use the router WAN-IP guide.

Even after the NAT path is understood, a service, firewall, or forwarding-rule problem can still block inbound traffic. Continue with port-forwarding troubleshooting rather than treating every failure as address-related.