How to Check If You Have CGNAT (Fast, Accurate Methods)

February 20, 2026

If port forwarding never works, game NAT stays strict, and remote access fails even with correct router settings, you may be behind CGNAT (Carrier-Grade NAT).

This guide gives you a fast way to verify it with confidence.

Quick Answer

You are likely behind CGNAT if:

  • Your router WAN IP is private (for example 10.x.x.x, 172.16-31.x.x, 192.168.x.x, or 100.64-100.127.x.x)
  • Your public IP shown online is different from your router WAN IP
  • Port forwarding rules never open externally

If all three are true, CGNAT is very likely.

Method 1: Compare Router WAN IP vs Public IP (Best First Test)

  1. Open your router admin page and find WAN IP / Internet IP
  2. Visit a public IP checker (or use your ISP app)
  3. Compare the two addresses

Interpret the result

  • Same IP → usually not CGNAT
  • Different IPs → likely CGNAT or upstream NAT
  • Router WAN IP is in RFC6598 range (100.64.0.0/10) → very strong CGNAT signal

Tip: if you also have two routers at home, read CGNAT vs Double NAT to avoid misdiagnosis.

Method 2: Test an Inbound Port from Outside

  1. Set a static LAN IP for your target device
  2. Add one clean port-forwarding rule on your router
  3. Temporarily allow that port in device firewall
  4. Test from mobile data or an external network

If the port remains closed despite correct setup, CGNAT is a common cause.

Method 3: Ask ISP for Your IP Assignment Type

The most reliable confirmation is direct ISP confirmation.

Ask support:

  • "Is my line behind carrier-grade NAT?"
  • "Do I have a dedicated public IPv4?"
  • "Can you provide static or dynamic public IPv4?"

If they confirm shared IPv4, you are on CGNAT.

Common False Positives (Important)

Before concluding CGNAT, rule out:

  • Double NAT (modem/router + your own router)
  • Broken or duplicate port-forwarding rules
  • Local firewall blocks
  • ISP blocked inbound ports on specific plans

For a broader fix flow, see NAT Type Troubleshooting Guide.

What to Do If You Confirm CGNAT

1) Request Public IPv4 from ISP (Best)

Many ISPs offer public IPv4 as:

  • free by request,
  • paid add-on,
  • or business tier feature.

2) Use IPv6 Where Supported

If your game/app supports IPv6 natively, some connectivity issues improve without IPv4 inbound mapping.

3) Use a Tunnel/VPN with Port Forwarding

Useful when ISP cannot provide public IPv4. Choose providers that explicitly support inbound forwarding.

4) For Gaming, Prioritize Relay-Friendly Titles

Some games rely more on dedicated servers and are less impacted by strict inbound constraints.

Final Checklist

  • [ ] Router WAN IP recorded
  • [ ] Public IP recorded
  • [ ] IP mismatch verified
  • [ ] External port test completed
  • [ ] Double NAT ruled out
  • [ ] ISP confirmation requested

If you want, start by checking your NAT behavior on the homepage tool and then continue with this workflow.