What Is Carrier-Grade NAT (CGNAT)?

1. Why IETF Reserved 100.64.0.0/10 (RFC 6598) Specifically for CGNAT

When ISPs first began placing carrier-scale NAT gateways in front of residential routers, they needed an internal IPv4 range for the link between the customer's home router (CPE) and the ISP's core NAT box. Using standard RFC 1918 private space (192.168.0.0/16 or 10.0.0.0/8) caused routing collisions whenever a customer also used that same 10.x.x.x range inside their own home or office LAN.

To solve this, the IETF published RFC 6598, allocating the 4.19-million-address block 100.64.0.0/10 (100.64.0.0 – 100.127.255.255) as Shared Address Space exclusively for Service Provider CGNAT deployments. You can test any 100.64.x.x address in our IP Validator or Subnet Calculator.

2. Practical Implications: Web Browsing vs. Port Forwarding

Not every customer of any given ISP is necessarily behind CGNAT—configurations vary by plan type (business vs. residential), region, and whether a static IP add-on is provisioned. When a connection is behind CGNAT:

• Outbound web browsing, streaming, and cloud apps work normally: Standard HTTPS websites, video calls, and outbound connections are unaffected.
• Inbound IPv4 port forwarding does not work: Because you do not control the ISP's upstream CGNAT box, opening a port on your home router cannot forward unsolicited inbound IPv4 traffic from the internet to a home NAS, game server, or CCTV NVR.
• Solutions for self-hosting: Connect over native IPv6 (where supported by both ends), use an outbound encrypted mesh tunnel (such as WireGuard/Tailscale or Cloudflare Tunnel), or request a static public IPv4 plan from your provider.