CGNAT — why you can't port-forward, and what to do instead

Carrier-grade NAT shares one public address among many customers. Inbound connections can't reach you; Tailscale or a tunnel can.

What it is. Public IPv4 addresses ran out. Many ISPs (most mobile carriers, many fibre and cable providers) now give your router a *private* address from 100.64.0.0/10 and share one public address among hundreds of customers. Your router NATs you, then the ISP NATs you again.

How netscrew spots it. If the address your router calls its WAN address is in 100.64.0.0/10 — or differs from the address the internet sees you as — you're behind CGNAT.

What it breaks

• Port forwarding. You can open port 22 on your router all day; the ISP's NAT never sends anything to it.
• Self-hosting from home: game servers, a Plex/Jellyfin you reach from outside, SSH from work.
• Some peer-to-peer apps and console "NAT type strict" warnings.

What to do instead

• Tailscale / WireGuard mesh — outbound-only connections that punch through both NATs. n check and n bench know Tailscale addresses when they see them.
• Cloudflare Tunnel (or ngrok-style) — expose a web service without any inbound port.
• Ask the ISP for a public IPv4 — often a small monthly fee, sometimes free on request.
• IPv6 — if your ISP provides native [IPv6](ipv6), inbound works there with no NAT at all (mind the firewall).

Don't confuse: Tailscale also uses 100.64.0.0/10 for *its* addresses (100.x.y.z on the tailscale0 interface). That's the same range by design, and not CGNAT.