The 100.64.0.0/10 Shared Address Space: CGNAT Explained

You are used to RFC 1918 private address ranges — 10.x.x.x, 172.16.x.x, 192.168.x.x. But there is a fourth private-like range that many engineers are unaware of: 100.64.0.0/10, covering 100.64.0.0 to 100.127.255.255. RFC 6598 reserves this range specifically for Carrier-Grade NAT (CGNAT) — NAT performed by ISPs rather than home routers. See our reserved IP ranges guide for the full list of special-purpose blocks.

What Carrier-Grade NAT Is

A typical home broadband connection assigns you one public IP address. Your router performs NAT between your private 192.168.x.x network and that public IP. CGNAT adds another layer: the ISP assigns your router an address from the 100.64.0.0/10 range (not a public IP) and then performs NAT again from that 100.x.x.x address to a real public IP shared by thousands of customers. The result is two layers of NAT — hence "double-NAT."

Why ISPs Use CGNAT

IPv4 address exhaustion is real. Regional Internet Registries in most regions have exhausted their free pools. ISPs that cannot obtain enough public IPv4 addresses — or choose not to pay for IPv4 transfers — use CGNAT to share a smaller pool of public IPs among many subscribers. CGNAT allows an ISP to serve thousands of residential customers with a fraction of the public IPs that would otherwise be required.

How to Detect CGNAT

If your router's WAN IP is in the 100.64.0.0/10 range (100.64.0.0 to 100.127.255.255), your ISP is using CGNAT. You can check by logging into your router admin page and looking at the WAN/internet IP address. Alternatively, compare what your router shows as its WAN IP to what external services like ifconfig.me report — if they differ, you are behind CGNAT.

Practical Implications

CGNAT has significant implications for some use cases:

• Port forwarding: You cannot port-forward through CGNAT because the ISP's NAT device sits between you and the internet. Hosting a game server, web server, or VPN endpoint from home is not possible without a workaround.
• VPNs: Site-to-site VPNs that require a public IP on both ends will not work. You need a VPN provider that supports incoming connections through a relay.
• Peer-to-peer: Applications that require direct peer connections (some gaming protocols, certain VoIP tools) may fail or require STUN/TURN relay servers.
• IP-based logging: Multiple customers share a public IP, so IP-based attribution is unreliable.

The Solution: IPv6

CGNAT is a stopgap. The proper long-term fix for IPv4 exhaustion is IPv6, which provides enough addresses to give every device on earth a unique public address. Many ISPs that use CGNAT for IPv4 now offer native IPv6, which bypasses CGNAT entirely for IPv6 traffic. Dual-stack connectivity — IPv4 via CGNAT, IPv6 natively — is increasingly common on modern broadband connections.