CGNAT and Shared IP Addresses: Why One IP Can Represent Many Users

Carrier-grade NAT lets an ISP or mobile carrier place many subscribers behind a smaller pool of public IPv4 addresses. It is common because IPv4 space is limited.

Your home router already translates your devices' private addresses to the one address it holds. Carrier-grade NAT adds a second translation inside the ISP's network: a large NAT device, whose common requirements RFC 6888 describes, maps the traffic of hundreds or thousands of customer routers onto a much smaller set of public addresses, using port numbers to keep the customers apart. To a website, many unrelated users may appear to come from the same public IP address even though they are on different devices, in different homes, with different accounts.

The reason is arithmetic. IPv4 has about 4.3 billion addresses; IANA handed out the last of its free blocks in February 2011, and the regional registries' pools followed over the next few years. New addresses now come from a transfer market at a price per address, so a carrier with millions of subscribers cannot give each one a public IPv4 address without an enormous outlay. Sharing lets it serve them with a fraction of the addresses, and lets a fixed-line ISP keep growing after its allocation is spent.

It was meant as a bridge: IPv6 removes the shortage, but as long as some destinations are reachable only over IPv4, subscribers need an IPv4 path, and sharing is the cheapest way to provide one.

The link between the carrier's NAT and your router needs addresses too, and neither private nor public space fits: RFC 1918 ranges are already in use inside customers' homes, so reusing them on the carrier side risks collisions, and public space is exactly what the carrier is short of. RFC 6598 reserved 100.64.0.0/10, the range 100.64.0.0 to 100.127.255.255, as shared address space for this one purpose. IANA lists it in the IPv4 special-purpose registry; it is not routable on the public internet and should never appear inside a home network.

That makes it a fingerprint. An address in 100.64.0.0/10 on the WAN side of your router means a carrier-grade NAT sits between you and the internet.

Compare two addresses. Your router's admin page shows the WAN address it received from the ISP; an IP lookup shows the address websites actually see. If they match, your router holds the public address and there is no carrier NAT. If the WAN address is in 100.64.0.0/10, you are behind CGNAT almost certainly. If it is in a private range such as 10.x.x.x, another layer of translation sits above you, which may be the ISP's gateway or its CGNAT.

Other signs point the same way: a traceroute shows a hop in shared or private space before public addresses appear; the ISP sells a 'public' or 'static' IP as an add-on; port forwarding rules on your router have no effect from outside. Satellite and mobile services make heavy use of it; Starlink satellite internet, for example, serves its standard plans through carrier-grade NAT.

Port forwarding and self-hosting. An inbound connection arrives at the shared public address, and the carrier's NAT has no mapping that leads to your router, so it is dropped before your own forwarding rules can act. Game servers, cameras, remote desktop and anything else that expects to be reachable from outside stop working. RFC 7021 assessed the impact of carrier-grade NAT on applications and found this pattern: some fail, others degrade. The ways around it are IPv6, a public IPv4 address from the ISP, or a relay or tunnel service that terminates on a public address.

IP bans. A block aimed at one abusive subscriber lands on everyone who shares the address, which can be hundreds of households. RFC 6269, on the issues with IP address sharing, spells out the consequences: reputation, blacklisting, geolocation and logging all assume that an address is one party, and sharing breaks that assumption.

Fraud and risk systems. A shared address accumulates the behavior of everyone behind it. A fraud score for such an address describes the crowd, not the person, and a velocity counter that sees many accounts from one address is measuring how many people the carrier put behind it.

Rate limits and CAPTCHAs. Per-address rate limits are consumed by the aggregate traffic of every subscriber on the address, so ordinary users hit them without doing anything unusual, and challenge systems that weigh address reputation and velocity show mobile users more CAPTCHAs for the same reason.

Logging and investigations. A timestamp and an address no longer identify a subscriber; that takes the source port as well, plus the carrier's translation logs. RFC 6888 devotes a section to the logging these devices need so that a mapping can be traced back to a subscriber, and RFC 6269 explains why investigators depend on it.

Blocking one shared IP can accidentally affect legitimate users. This is especially risky for mobile networks, public Wi-Fi, schools, offices, and large residential ISPs. Fraud systems should treat shared-IP behavior differently from a dedicated server IP that sends automated traffic.

Use IP reputation with account, device, session, and behavior signals. Apply rate limits carefully, and prefer step-up verification over broad IP blocks when users may be sharing an address. When a lookup shows a consumer or mobile network, widen the unit of analysis from the address to the account and device, give mobile networks more generous per-address limits, and if a block is unavoidable keep it short and revisit it; the firewall blocking guide covers scoping and expiring such rules. Crafzo IP Lookup helps you identify when an IP looks like consumer or carrier traffic so you can avoid overreacting.

IPv6 removes the reason for sharing. Its address space is large enough for every device to hold a globally reachable address, so there is nothing to translate and no pool to ration. Many carriers already run IPv6 alongside their carrier-grade NAT for IPv4, and some mobile networks are IPv6-only internally, translating only for the IPv4 destinations that remain. When both ends of a connection speak IPv6, the connection bypasses the carrier's NAT: inbound connections work again, and the address identifies one connection rather than a crowd.

The IPv6 lookup shows whether your connection has a public IPv6 address of its own, and the IPv4 versus IPv6 guide covers what that changes for privacy and geolocation.