CGNAT vs Public IPv4

Your customers buy connections that let them work, host and grow. CGNAT helps an ISP serve more subscribers from a shared public IPv4 pool. Dedicated public IPv4 gives business customers an address of their own for servers, remote access and trusted API connections. Build your service around what each customer needs to do.

CGNAT vs public IPv4: choose the service your customers need

Carrier-Grade NAT translates traffic inside the provider network so multiple subscribers can share a public IPv4 address. A dedicated public address separates one customer's public identity from that shared pool. A static assignment keeps that address stable over time: public, dedicated and static describe different things.

Address choices and the customer experience

Customer need	CGNAT service	Dedicated public IPv4 service
Browsing and streaming	Shares capacity efficiently for outbound connections.	Also supports these everyday uses.
Host a server or receive connections	Depends on provider mapping or an application relay.	Supports a direct inbound path with routing and firewall rules configured.
API or firewall allowlists	Other subscribers can appear under the same source address.	A dedicated, static assignment gives the customer a consistent source to allowlist.
Reputation and rate limits	Unrelated subscribers share the public-IP signal.	Separates the customer's address from that shared pool.
Port and session capacity	The operator manages shared ports and translation state.	Removes the provider CGN sharing layer for this service.
Subscriber troubleshooting	Correlate the public address, port, protocol and time.	An address assignment gives a more direct starting point.

Public IPv4 turns business demand into services you can sell

A customer hosting an application needs people to reach it. A business connecting to a partner API needs a recognizable source. A managed network needs remote access its team can control. Dedicated public IPv4 lets you build offers around those valuable outcomes.

Use a stable assignment for allowlists, VPN gateways and predictable public egress. Use routed address capacity for hosting and infrastructure customers. Configure routes, access rules and applications together so the service delivers the connection the customer expects.

Where CGNAT fits your access service

Residential broadband, mobile access, public Wi-Fi and outbound IoT can share public IPv4 efficiently. Where customers mainly browse, stream or initiate connections, CGNAT can make your existing pool go further.

Offer a clear upgrade path for customers who need their own public address. You can serve shared-access customers and business-IP customers on the same network without forcing one addressing model onto everyone.

Why ISPs use CGNAT

CGNAT reduces public IPv4 consumption per subscriber. Instead of assigning an address to every access line, you share a pool across many lines and manage the translations between them.

That improves utilization; it does not create new addresses. Keep capacity for the CGN's public side, dedicated customer services and new sales. Our guide to how ISPs manage IPv4 shortages places these choices in a wider network plan.

How CGNAT works

With ordinary home NAT, devices use private addresses and the customer's router translates their traffic onto its WAN connection. With CGNAT, the provider performs another translation before traffic reaches the public Internet. The customer controls the home router; the operator controls the CGN. RFC 6888 describes this provider-managed function.

One public address, different port mappings

In a documentation example, one connection from 100.64.10.20:50001 maps to 203.0.113.20:22001; another from 100.64.20.30:51002 maps to 203.0.113.20:22002. Both appear under the same public address. Different translated ports and the CGN's session state let returning traffic reach the right connection.

What is the 100.64.0.0/10 range?

100.64.0.0/10 spans 100.64.0.0 to 100.127.255.255. It is Shared Address Space for provider networks, defined in RFC 6598. It is neither globally routable public space nor the familiar RFC1918 ranges 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16.

Seeing this range on a router's WAN interface is a useful clue. Compare that address with the IPv4 seen by an external service, then confirm the connection type with the provider. A mismatch can also come from another upstream NAT.

CGNAT vs customer NAT

Who controls the translation?

Network task	Customer NAT	CGNAT
Operate the translator	The customer manages its router.	The provider manages the CGN.
Share an address	Devices within one customer network.	Independent subscriber networks.
Set inbound mappings	The customer can configure its own NAT.	The public-side mapping also needs provider support.
Trace a connection	Use local device and router records.	Join subscriber records with public-side translation records.

A port-forwarding rule on a home router controls that router only. It does not create an inbound mapping at the provider's CGN. See the NAT guide for the underlying translation model.

Resolve subscriber issues with the right connection details

When many subscribers share an address, the public IP alone cannot reliably identify a connection. Give your support team the public source address, translated source port, protocol and precise timestamp so they can correlate the session with a subscriber.

For example, 203.0.113.20, TCP port 22002 at 14:35:27 UTC is more useful than an address and an approximate minute. Accurate clocks and usable translation records help your team solve the customer's problem faster.

The CGNAT trade-offs customers notice

Inbound access

Servers, remote-access systems, cameras, peer-to-peer applications and some VPN or gaming modes need a path back into the customer's network. Relays and NAT traversal can help. A dedicated public-IP service gives you a straightforward product for customers who need to control that path.

Busy-hour ports and sessions

Plan the sharing ratio against concurrent sessions, usable ports and translator capacity. An address pool can look large enough while a busy CGN runs short of mappings. Monitor both so new subscribers do not crowd out the experience of existing customers.

Shared reputation

A shared source IP can also share blocks, CAPTCHA prompts or rate limits triggered by another subscriber. A dedicated address separates that identity, while reputation monitoring and abuse handling keep serving their own purpose. RFC 6269 discusses address-sharing effects.

Grow beyond the limits of a shared pool

Your CGN still needs public IPv4 to reach the Internet. Business-IP upgrades, hosting demand and customer growth need capacity too. Expanding IPv6 services does not remove the IPv4 requirements of the services your customers use today.

Build that growth with Unlimited IPv4 from LARUS. Direct supply and Continuity put address capacity, routing support, rDNS, RPKI/ROA readiness and renewal into one ongoing service relationship. Choose the plan for the network you want to build, with room for shared access and dedicated public-IP products.

For the wider capacity decision, read our IPv4 scarcity guide. Heng Lu's Note29 explains the commercial case for putting IPv4 to work for operators.

Your network deserves a strong foundation behind its addresses. Cloud Innovation's court-ordered AFRINIC shareholder position supports the estate operated through LARUS; its exclusive mandate appoints LARUS as the commercial, operational and technical platform for those customers. The shareholder-rights record and LARUS mandate show the foundation behind that direct relationship.

Compare the operating cost, not just the address count

Account for translation equipment, session capacity, logs, storage, time synchronization, support investigations and customer exceptions. Then compare that work with the revenue and customer experience of a dedicated public-IP offer.

That gives you a business decision grounded in service value. The BTW analysis of CGNAT logging costs explores one part of this operating burden.

CGNAT questions from customers

Is 100.64.0.0/10 a public IP range?

No. It is provider Shared Address Space. For an address reachable through the public Internet, ask for a public-IP service and set up the routing and access rules for your application.

How do I know whether my connection uses CGNAT?

Compare the router's WAN IPv4 with the address an external service sees. A different address, especially a WAN address in 100.64.0.0/10, suggests upstream translation. Your provider can confirm whether it is CGNAT and offer the public-IP option you need.

Can I forward ports through CGNAT?

A home-router rule does not control the CGN. Ask the provider about supported inbound mappings or a dedicated public address. For a server you manage, the public-IP route gives you clearer control over the service.

Will games, VPNs and peer-to-peer apps work?

Many work normally. Those needing direct inbound sessions or particular port mappings can behave differently. Test the application you sell or support; use a public-IP service when its connection model calls for it.

Does CGNAT solve IPv4 exhaustion?

It makes a public pool serve more subscribers. It does not create address supply. LARUS gives your network Unlimited IPv4 and a direct Continuity path for its next stage of growth.