CGNAT: why port forwarding may not work

Recognize the upstream boundary

Open your router's Internet or WAN status page. Record its IPv4 address, then check your public IP without a VPN or browser proxy. If they differ, there is another address translation or proxy boundary somewhere along the path. The shared range 100.64.0.0–100.127.255.255 is a strong clue that the provider uses shared addressing.

A private WAN address such as 192.168.0.20 could instead come from a modem/router in your home. A mismatch alone does not distinguish CGNAT from double NAT. Ask the ISP whether your service has a directly reachable public IPv4 address, and compare the upstream device if you control it.

Compare the same address family. If the home page detects IPv6, use an explicit IPv4 request for the WAN comparison:

curl -4 https://thisismyip.com/ip

This requires a working IPv4 path to the site. An IPv4 WAN address and an IPv6 website result are different observations and cannot establish CGNAT by themselves.

Why the forwarding rule stops short

Consider a game server at 192.168.1.50:25565. Your router forwards that port on its WAN address, 100.72.8.9. The Internet sees a different public address owned by the provider. Incoming traffic to that public address still needs a provider-controlled mapping before it reaches your router; your local rule cannot create one.

Outgoing browsing can work normally because connections initiated inside the network create translation state. That does not imply unsolicited incoming connections will work. A successful connection from another device on your LAN also does not test the provider's incoming path.

Choose an option for the service

• Ask for public IPv4: the ISP may offer a dynamic or static address. Confirm costs, inbound restrictions, and whether the change removes CGNAT.
• Use IPv6: both ends need IPv6 connectivity, correct DNS, a listening service, and narrowly scoped firewall access.
• Use a supported relay or reverse tunnel: suitable for some remote-access services. Review authentication, provider trust, and exposure before enabling it.
• Host elsewhere: a VPS may fit a public service better than a home connection, but needs its own maintenance and security.

Verify after the ISP makes a change

Recheck the WAN/public comparison, confirm the server's fixed LAN address or DHCP reservation, and test from an external network. Start the intended service before testing its port. A timeout can also come from an ISP filter, host firewall, router firewall, or missing listener.

Avoid putting the whole computer in a router DMZ to diagnose CGNAT: broad local exposure will not remove the upstream boundary. Record which family and port you tested so an IPv6 success is not mistaken for proof that IPv4 forwarding works.