Explainer
Carrier-grade NAT lets an ISP share limited public IPv4 addresses across many customers. That makes address management easier for the ISP, but it can complicate inbound connections.
Public IPv4 space is limited. CGNAT lets an ISP share a smaller pool of public IPv4 addresses across many customers instead of assigning a unique public IPv4 to every line.
That can work fine for normal web browsing, but it often gets in the way when you want unsolicited inbound traffic to reach your own network directly.
The block 100.64.0.0/10 means 100.64.0.0 through 100.127.255.255. It is reserved as shared address space for service-provider NAT, so seeing a WAN IP inside that range is a much stronger CGNAT or shared-IPv4 signal than seeing an ordinary private home-network range. The IPv4 address guide shows the full private and shared ranges side by side.
A WAN IP in 10.x.x.x, 172.16-31.x.x, or 192.168.x.x still means another NAT layer exists upstream, but that does not automatically prove ISP-level CGNAT. It can simply mean your own router is sitting behind an ISP gateway or another router at home.
That distinction matters because the fix can be very different. Sometimes you need to ask the ISP for a public IPv4. Other times you just need to bridge the gateway, remove a second NAT layer, or make sure you are checking the right router. Use the CGNAT versus double NAT guide to follow those paths separately.
What CGNAT changes
Outbound sessions can still work because the provider tracks their return traffic. Unsolicited inbound traffic is different: it reaches provider-controlled translation before it could reach the forwarding rule on your router.
What CGNAT does not explain
A stopped service, wrong protocol, stale LAN target, firewall rule, or second router can produce the same symptom. The exact checker branches and evidence requirements live on the methodology page.
Self-hosting, remote desktop, game hosting, camera access, peer-to-peer apps, and other inbound connectivity tasks can all become harder when the public IPv4 path stops before traffic reaches your own router.
If you want a practical next step, find the correct WAN IP, run the CGNAT Checker, then narrow the symptom with the Port Checker or NAT Type Check page before you move on to workaround options.
Need options?
Some users need a tunnel, a private-access overlay, a public IPv4 option, or a VPS relay. Others only need to fix double NAT or bridge mode. The solutions page keeps those paths in one place without pretending every paid option works for every protocol. If the basic path still looks wrong, read why port forwarding fails before you spend money.
For a transparent explanation of the address comparison itself, read how CGNATCheck works.
Compare solutions