- Definite CGNAT (RFC 6598): If your router WAN IP falls between
100.64.0.0and100.127.255.255, your ISP shares your public IP across dozens of subscribers via Large-Scale NAT (LSN). Port forwarding fails 100% of the time. - Double NAT Conflict (RFC 1918): If your router WAN IP begins with
10.x.x.x,172.16-31.x.x, or192.168.x.x, your router is plugged into another active combo modem or ONT. Fix by enabling Bridge Mode or IP Passthrough on the upstream unit. - WAN DHCP Failure (RFC 3927): If your WAN IP is
169.254.x.x(APIPA), your router failed to receive a DHCP response from your modem or fiber ONT, indicating an unplugged cable or ISP authentication error. - Direct Public IPv4 (Single NAT): When your Router WAN IP equals your observed public IP, your network operates under a single NAT layer. Inbound port forwarding will succeed immediately.
Definite Carrier-Grade NAT (CGNAT) Detected
Your router WAN IP falls squarely within the RFC 6598 Shared Address Space (100.64.0.0/10). Your ISP is translating your traffic through an upstream carrier NAT cluster.
RFC 6598 addresses (100.64.0.0 – 100.127.255.255) are assigned by ISPs to multiplex thousands of customers behind a shared public IPv4 pool. Inbound packets destined for your public IP are rejected at the ISP edge because no reverse translation state exists.
Inbound Packet Flow & NAT Translation Path
Carrier-Grade NAT (CGNAT) Gateway
The NAT translation barrier is active here. Your ISP's large-scale NAT router intercepts outbound traffic and translates your router's 100.64.0.0/10 address to a shared public IP. Inbound unsolicited packets directed to your public IP are rejected.
4 Proven Blueprints to Bypass CGNAT & Double NAT
When traditional router port forwarding fails due to upstream carrier NAT or cascading gateways, deploy one of these four field-tested workarounds:
Blueprint A: Tailscale Funnel (WireGuard Encrypted Outbound Mesh)
Why It Bypasses CGNAT: Tailscale uses WireGuard to establish an outbound encrypted UDP tunnel from your server to Tailscale's global DERP relay infrastructure. Because your server initiates the outbound connection, your router and your ISP's CGNAT firewall permit the stateful traffic without requiring open inbound ports.
- Install Tailscale on your host machine (Linux, macOS, or Windows).
- Authenticate and activate your node:
sudo tailscale up. - Enable Funnel to expose your local port (e.g., TCP 8080 or game server) to the global internet under a secure
.ts.netDNS endpoint.
# 1. Install Tailscale
curl -fsSL https://tailscale.com/install.sh | sh
# 2. Authenticate and bring node online
sudo tailscale up
# 3. Expose local service port (e.g. 8080) to the public internet via Tailscale Funnel
sudo tailscale funnel --bg 8080
# 4. View your public HTTPS endpoint URL
sudo tailscale funnel statusSection 1: The Anatomy of IPv4 Exhaustion, RFC 6598 and Carrier-Grade NAT
When the Internet Assigned Numbers Authority (IANA) allocated the final unassigned IPv4 /8 address blocks to Regional Internet Registries in February 2011, internet service providers faced an existential challenge: global subscriber counts were surging while routable public IPv4 address reserves had effectively flatlined. The comprehensive long-term solution—IPv6 migration—progressed slowly across legacy consumer hardware.
To prevent connection halts, the IETF ratified RFC 6598 in April 2012, reserving the IPv4 prefix 100.64.0.0/10 specifically for Carrier-Grade NAT (CGNAT / Large-Scale NAT / LSN). This allocated exactly 4,194,304 addresses (spanning 100.64.0.0 through 100.127.255.255) intended solely for service-provider routing domains.
In a standard residential deployment, an ISP assigns your home router an RFC 6598 address on its WAN port. When you browse the web, your home router executes Source NAT (NAT44 Layer 1), and the ISP's upstream Broadband Remote Access Server (BRAS) executes a second Source NAT (NAT44 Layer 2) before dispatching packets onto the global internet. This dual-translation paradigm is known as NAT444.
Section 2: Why Port Forwarding Fails on CGNAT and Double NAT
Port forwarding (Destination NAT / DNAT) is inherently a stateful pinholing operation. In a healthy single-NAT environment, a remote client dispatches a packet to your public IP (e.g., 73.189.44.12:25565). Your router intercepts the frame, inspects its forwarding table, rewrites the destination IP to your LAN server (192.168.1.100:25565), and passes the packet through.
Under CGNAT, however, your observed public IP (73.189.44.12) does not belong to your router—it belongs to the ISP's carrier-grade routing cluster and is simultaneously shared with up to 256 or 512 other households using Port Control Protocol (PCP) port multiplexing. When a remote gamer sends a packet to 73.189.44.12:25565, the ISP's carrier router has no record indicating which of the 512 households should receive it. Consequently, the carrier firewall drops the packet silently. No setting configured inside your personal router can override an upstream carrier firewall.
Section 3: Verified Reference Tables: IP Address Allocations & Router WAN Menu Locations
Table 1: IPv4 Address Classification & Port Forwarding Diagnostic Matrix
| Subnet / Prefix Range | RFC Specification | Network Classification | NAT Layers Active | Port Forwarding Feasibility |
|---|---|---|---|---|
100.64.0.0/10 (100.64.0.0–100.127.255.255) |
RFC 6598 | Carrier-Grade NAT (CGNAT Shared Space) | 2 (NAT444) | 100% Blocked (Requires Tunnel/Static IP) |
192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12 |
RFC 1918 | Private Cascading LAN (Double NAT) | 2 (Double NAT) | Blocked at Gateway (Fixable via Bridge Mode) |
169.254.0.0/16 |
RFC 3927 | Link-Local Self-Assigned (APIPA) | 0 | No Route (Modem/ONT DHCP Failure) |
| Globally Routable Public IPv4 (Matches Egress IP) | RFC 791 / IANA | Direct Public IPv4 | 1 (Single NAT) | 100% Viable (Standard Port Forwarding) |
| Public IPv4 (Differs from Egress IP) | RFC 791 / Non-RFC6598 | Carrier Proxy / Public-Pool CGNAT | 2 | Blocked Upstream (Carrier Inbound Filter) |
Table 2: Where to Find Router WAN IP on Leading Router Interfaces
| Router Brand / System | Default Admin URL | Exact Menu Location for Router WAN / Internet IP |
|---|---|---|
| ASUS (Asuswrt / ROG Merlin) | router.asus.com (192.168.50.1) | Network Map → Internet Status → WAN IP (or Advanced → WAN → Internet Connection) |
| TP-Link (Archer / AX Series) | tplinkwifi.net (192.168.0.1) | Basic → Internet → Internet IP Address (or Advanced → Status → Internet) |
| TP-Link Deco (Mesh System) | Deco Mobile App | More → Advanced → IPv4 → WAN IP Address |
| Netgear (Nighthawk / Orbi) | routerlogin.net (192.168.1.1) | ADVANCED Homepage → Internet Port → IP Address |
| Xfinity (xFi XB6 / XB7 / XB8) | 10.0.0.1 (Admin GUI) | Gateway → At a Glance → Internet (Check WAN IPv4 IP) |
| AT&T Fiber (BGW320 / BGW210) | 192.168.1.254 | Broadband → Status → Broadband IPv4 Address |
| OpenWrt (LuCI Web GUI) | 192.168.1.1 | Status → Overview → Network → IPv4 WAN Status |
IANA IPv4 Special-Purpose & Private Address Allocation Matrix
| RFC Standard | Address Range | CIDR Block | Total Addresses | Routability Scope | Architectural Purpose |
|---|---|---|---|---|---|
| RFC 1918 Class A | 10.0.0.0 – 10.255.255.255 | 10.0.0.0/8 | 16,777,216 IPs | Private LAN Only | Large enterprise networks, Comcast/Rogers home gateways |
| RFC 1918 Class B | 172.16.0.0 – 172.31.255.255 | 172.16.0.0/12 | 1,048,576 IPs | Private LAN Only | Medium campus networks, Docker/container bridges |
| RFC 1918 Class C | 192.168.0.0 – 192.168.255.255 | 192.168.0.0/16 | 65,536 IPs | Private LAN Only | Global consumer home Wi-Fi routers (192.168.1.1, 192.168.0.1) |
| RFC 6598 Shared Space | 100.64.0.0 – 100.127.255.255 | 100.64.0.0/10 | 4,194,304 IPs | ISP Carrier Only (Non-Routable WAN) | Carrier-Grade NAT (CGNAT) multiplexing subscribers upstream |
| RFC 3927 Link-Local | 169.254.0.0 – 169.254.255.255 | 169.254.0.0/16 | 65,536 IPs | Single Segment Link-Local | Automatic Private IP Addressing (APIPA) on DHCP failure |
| RFC 1122 Loopback | 127.0.0.0 – 127.255.255.255 | 127.0.0.0/8 | 16,777,216 IPs | Host-Internal Only | Localhost inter-process communication (IPC) |
| RFC 5737 Documentation | 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 | /24 subnets | 768 IPs | Non-Routable Example Space | Technical documentation examples (TEST-NET-1, 2, 3) |
| RFC 3171 Multicast | 224.0.0.0 – 239.255.255.255 | 224.0.0.0/4 | 268,435,456 IPs | Multicast Group Scope | mDNS (224.0.0.251), SSDP UPnP (239.255.255.250), OSPF |
Major ISP Gateway Bypass, Native Bridge Mode & IP Passthrough Capabilities
| Internet Service Provider | Supplied Gateway Model | Native Bridge Mode | Bypass Architecture Solution | Gateway Local IP | Key Administrative Setting |
|---|---|---|---|---|---|
| AT&T Fiber | BGW320-500 / BGW210 | No (Hardcoded 802.1X certificate) | IP Passthrough (DHCPS-fixed to router MAC) | 192.168.1.254 | Firewall → IP Passthrough → Allocation Mode: DHCPS-fixed |
| Comcast Xfinity | xFi Gateway XB6 / XB7 / XB8 | Yes | Bridge Mode toggle via local web GUI | 10.0.0.1 | Gateway → At a Glance → Bridge Mode: Enable |
| BT UK Broadband | BT Smart Hub 2 | No | DMZ Host + Turn off Smart Hub Wi-Fi | 192.168.1.254 | Advanced Settings → Firewall → DMZ: Enter retail router IP |
| Virgin Media UK | Hub 3 / Hub 4 / Hub 5 | Yes | Modem Mode (Gateway changes to 192.168.100.1) | 192.168.0.1 (Modem: 192.168.100.1) | Modem Mode → Enable Modem Mode → Connect to Port 1 |
| Charter Spectrum | D3.1 Standalone eMTA Modem | Native (Pure Bridge by design) | Direct WAN handoff to retail router | 192.168.100.1 (Diagnostics only) | Power-cycle modem upon connecting custom router to bind MAC |
| Verizon Fios | CR1000A / G3100 | No (ONT directly delivers WAN) | Direct Ethernet from ONT (Bypass router completely) | 192.168.1.1 | Run Ethernet directly from Fios ONT to custom router WAN port |
| CenturyLink / Quantum | C4000XG / Calix SmartOS | Yes | Transparent Bridge Mode + VLAN 201 tagging | 192.168.0.1 | Advanced Setup → WAN Settings → Transparent Bridging (VLAN 201) |
Frequently asked questions
What is the difference between CGNAT and Double NAT?
In Double NAT, the secondary NAT layer exists on hardware inside your home (for example, plugging a retail ASUS or TP-Link router into an ISP combo modem without enabling Bridge Mode). You have physical administrative control over both routers and can resolve Double NAT yourself by putting the ISP modem into Bridge Mode or IP Passthrough. In Carrier-Grade NAT (CGNAT), the secondary NAT layer exists on massive carrier-grade routing hardware operated by your Internet Service Provider. You have zero administrative control over the carrier equipment and cannot open ports yourself.
Can a VPN bypass CGNAT for gaming and hosting?
A standard commercial outbound VPN (like NordVPN or ExpressVPN) changes your outbound public IP but does not permit unsolicited inbound port forwarding because they block inbound listener ports across their shared egress gateways. However, specialized mesh VPNs like Tailscale (using Tailscale Funnel) or reverse tunnel services (like Playit.gg and Cloudflare Tunnels) specifically bypass CGNAT by establishing persistent outbound cryptographic tunnels that forward inbound traffic back to your machine.
Why does my Xbox or PlayStation say "Strict NAT" or "Moderate NAT" on CGNAT?
Consoles require direct peer-to-peer (P2P) UDP communication with other players across the globe for multiplayer matchmaking and party voice chat. Under CGNAT, your console cannot establish a direct UDP listening socket on the public internet, forcing traffic through symmetric NAT port mapping that changes with every transmission. This triggers a Strict NAT (Type 3) or Moderate NAT (Type 2) failure on Xbox Live and PlayStation Network.
Does IPv6 completely solve CGNAT without paying for a static IP?
Yes! IPv6 completely eliminates Network Address Translation. On an IPv6 connection, every computer, phone, and console on your home LAN receives a globally unique, publicly reachable IPv6 address. To host servers on IPv6, you do not forward ports; you simply create an IPv6 Firewall Rule (Pinholing) inside your router to permit inbound traffic to your host device. Note that remote players must also have an active IPv6 connection to connect directly.
Will my ISP remove me from CGNAT for free if I call them?
Policies vary by provider. Many fiber and DSL ISPs (such as Aussie Broadband, Hyperoptic, and smaller regional telcos) will remove customer accounts from the CGNAT pool and assign a dynamic public IPv4 address for free simply upon customer request citing home office VPN needs or gaming issues. Major mobile 5G home internet carriers (T-Mobile Home Internet, Verizon 5G Home) and satellite providers (Starlink) use CGNAT universally and do not offer public IPv4 on residential tiers; on those networks, Tailscale, Cloudflare Tunnels, or IPv6 are the mandatory workarounds.
Our networking steps are lab-tested against standard RFC 1918 private networking protocols across Windows 11 (24H2), macOS Sequoia (15.1), iOS 18, and Android 15. We verify physical device labels and firmware release documentation before publishing gateway instructions. Router Portal is strictly read-only and never requests, intercepts, or logs router passwords.