CGNAT (Carrier-grade NAT) is network address translation performed by an internet service provider inside its own network, so that many subscribers share a small pool of public IPv4 addresses. In Internet addressing, it is the main stopgap that operators use to keep connecting new customers after IPv4 address exhaustion, while IPv6 deployment continues in parallel.
Unlike the NAT in a home router, which hides one household behind one public address, CGNAT adds a second translation layer at the provider. The result is often called NAT444: a private address in the home, a shared address in the provider network and a public address on the Internet.
How CGNAT translates subscriber traffic
Each subscriber router receives a WAN address from the shared address space 100.64.0.0/10, reserved for this purpose by RFC 6598. That block holds about 4.19 million addresses and was set aside so that providers would not collide with the private ranges that customers use at home.
When a subscriber opens a connection, the CGNAT device replaces the source address and port with a public address and a port from an allocated range, records the mapping in a session table, and reverses the translation for returning packets. Because the mapping exists only after outbound traffic, unsolicited inbound connections cannot reach the subscriber.
| Layer | Typical range | Assigned by |
|---|---|---|
| Home network | 192.168.0.0/16 or 10.0.0.0/8 | Customer router |
| Provider shared space | 100.64.0.0/10 | Internet provider |
| Public side | Globally routable IPv4 | Provider pool from its RIR |
Port allocation and key parameters
A single public IPv4 address offers about 64,000 usable ports per transport protocol. The sharing ratio decides how many of them each subscriber gets, and it is the central capacity trade-off of any CGNAT deployment.
| Parameter | Common range | Effect |
|---|---|---|
| Subscribers per public address | 8 to 64 | Higher ratios save addresses but limit ports |
| Ports per subscriber | 1,000 to 8,000 | Too few break heavy applications |
| Port block size | 64 to 2,048 ports | Larger blocks mean fewer log entries |
| UDP mapping timeout | At least 2 minutes, often 5 | Short values break voice and gaming |
| TCP established timeout | About 2 hours or more | Short values drop idle sessions |
Providers choose between dynamic per-session allocation, which uses ports efficiently but produces huge logs, and port block allocation, which reserves a range per subscriber and logs only when a block is assigned or released. Deterministic NAT goes further: a fixed formula maps each inside address to a known port range, so no per-session logging is needed at all.
Good implementations follow the behavioral requirements of RFC 6888, including endpoint-independent mapping, which keeps the same public port for one inside socket regardless of destination. This property is what allows peer-to-peer techniques such as STUN-based hole punching to work through the translator.
CGNAT compared with other address strategies
CGNAT is one of several ways to cope with scarce IPv4 addresses. Each option makes a different trade between cost, transparency and the amount of state the provider must keep.
| Approach | Public IPv4 per subscriber | Inbound reachability |
|---|---|---|
| Dedicated public IPv4 | One | Full, with port forwarding at home |
| CGNAT (NAT444) | Shared fraction | None without extra services |
| DS-Lite | Shared fraction, over IPv6 | None for IPv4, full for IPv6 |
| MAP-E or MAP-T | Shared, stateless port sets | Limited to the assigned ports |
| Native IPv6 with dual stack | Optional | Full over IPv6 |
The long-term answer is IPv6, which removes the need for address sharing. In practice, providers run CGNAT alongside dual stack, and every connection that moves to IPv6, such as traffic to large video and social platforms, reduces the load on the CGNAT devices.
Effects on users and services
For ordinary browsing and streaming, CGNAT is usually unnoticeable. Problems appear when a subscriber needs to accept incoming connections or when a remote service treats one IP address as one user.
- Port forwarding does not work, so home servers, some security cameras and self-hosted games are unreachable from outside.
- IP-based blocking and rate limits affect innocent neighbors who share the same public address.
- Geolocation and reputation become less precise, which can trigger extra verification prompts.
- Peer-to-peer applications may fall back to relayed connections, increasing latency.
- Long idle sessions can be dropped if timeouts are configured too aggressively.
Common workarounds include requesting a dedicated public IPv4 address from the provider, often for a monthly fee, using IPv6 for inbound access, or running an outbound tunnel to a cloud relay or VPN that exposes the service.
Logging, legal traceability and operations
Because many subscribers share an address, a public IP and a timestamp are no longer enough to identify a customer. Lawful requests and abuse reports must include the source port and an accurate time, and providers must keep translation logs for the retention period required by local law.
Operators therefore size CGNAT platforms not only for throughput but also for session table capacity and log volume. A busy deployment can hold tens of millions of concurrent sessions, and losing that state during a failover drops every active connection, so stateful redundancy between devices is a standard requirement.
Two further features matter in daily operation. Hairpinning lets two subscribers behind the same translator reach each other through their public addresses, which some applications assume will work. Application layer gateways rewrite addresses embedded inside protocols such as FTP or SIP, but they are a frequent source of subtle bugs, and many operators keep them disabled unless a specific service depends on them.
Capacity planning is usually based on peak concurrent sessions per subscriber, measured during evening hours, rather than on bandwidth alone. A modern household with several phones, televisions and smart devices can hold several hundred sessions open at once, and a single misbehaving device can exhaust its port allocation, which appears to the user as random connection failures.
In everyday language
Imagine an apartment building where all residents share one street address, and the reception desk sorts the mail by room number. CGNAT does the same with internet addresses: the provider gives many customers one public address and keeps track of which reply belongs to whom.
Sending and receiving everyday traffic works well. The limitation is that outsiders cannot knock on a specific door unless the resident has opened the conversation first.
Seen in the real world
A regional fiber provider adds 20,000 new customers but has only a small block of public IPv4 addresses left. It deploys CGNAT with 32 subscribers per public address and 2,000 ports each, uses port block allocation to keep logs manageable, and enables IPv6 for every customer at the same time.
Most users notice nothing. A small group of gamers and people running home security cameras report that port forwarding has stopped working. The provider offers them a dedicated public IPv4 address as an add-on, while measurements show that almost half of all traffic already travels over IPv6, which keeps the CGNAT equipment well below its capacity.