Port forwarding behind CGNAT: what works

Your forwarding rule is probably fine; behind CGNAT your router may not hold a public address at all. The address it reaches the internet through is shared with other customers, behind a translator you cannot configure.

CGNAT

Carrier-grade NAT: a network address translator run by the ISP that lets many customers share public IPv4 addresses, so no single customer's router holds one.

Why does port forwarding not work behind CGNAT?

Because the translator that decides which packets get in is at your ISP, not in your living room. A forwarding rule tells your router "send traffic for this port to that computer"; that only works if the traffic reaches your router in the first place.

Behind carrier-grade NAT it does not. Nothing arrives. An inbound packet arrives at the ISP's translator, which has no mapping created by an outgoing connection from you, and drops it. RFC 6888 sets out the common requirements for these translators, and the mapping logic is the same as at home: state is created by traffic going out, not coming in.

So no better rule on your router will help by default. A few ISPs support PCP on their translator, which lets a router request an inbound mapping (RFC 6887), but the ISP decides that. Otherwise you obtain an address that arrives at your router, or both ends of the conversation connect outward.

How do I know if I am behind CGNAT?

Compare two addresses with a VPN switched off on the router and the device you test from. Tunnel addresses can sit in the same range as CGNAT ones, and a VPN left on will fool the check.

1. Open your router's status page and read its WAN address (sometimes called the internet or external address).
2. Look up the public address your connection shows to the outside, using any address-lookup page.
3. Compare. If the two differ, there is another translator between you and the internet.

A WAN address between 100.64.0.0 and 100.127.255.255 is in the shared address space that RFC 6598 reserves as 100.64.0.0/10. Carriers use it to number the links between their translators and your equipment.

One public example of the pattern: a GL.iNet forum thread dated 2026-04-05 describes a user on a 5G home connection whose address started with 100 and who found that forwarding WireGuard's port did nothing. A WAN address in the private ranges of RFC 1918 (10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16) means another NAT sits in front of your router, which usually blocks inbound traffic the same way.

What can I use instead of port forwarding behind CGNAT?

There are four alternatives, and they differ in what each end must have. Read the far-end column first; it usually decides.

The first two keep the old model: someone connects to a port you opened. The last two replace it: the home side connects out, so nothing needs to be opened by hand on your router. (For the device link, the app may still ask the router for a temporary mapping, as described below.)

Can I get a public IP from my ISP?

Sometimes. The only way to find out is to ask. Ask for a public IPv4 address rather than a static one; those are different requests, and the ISP decides terms and whether it is available on your line.

After the change, repeat the three-step check. The WAN address should now match what the lookup page shows and sit outside 100.64.0.0/10. If it does, a normal forwarding rule will work, and you are back to the usual exposure questions covered below.

Does IPv6 fix CGNAT?

It fixes the address shortage, not the filter. That distinction matters. Under IPv6 your devices can have global addresses of their own, so nothing is shared and there is no translator to cross.

Home routers still keep inbound traffic out by default. RFC 6092 recommends that gateways require filter state to be activated by traffic originating at interior nodes, and allow manually configured exceptions. You add the exception, which is again a port open to the internet. The second condition is on the far side: whoever connects needs IPv6 as well, and many networks still do not have it.

How does a tunnel service work behind CGNAT?

A tunnel service gives your home side something to connect out to. The service holds a public address, your home end opens a connection to it, and visitors reach the service.

Pinggy's own page, read on 2026-10-16 (updated 2026-08-20), describes its answer to CGNAT as an SSH reverse tunnel to its hosted endpoint, with a sign-in for permanent URLs and custom domains. That is one vendor selling one service, and we make no claim about it beyond what its page says. A VPS you rent and run yourself plays the same role, at the price of keeping that server patched. Either way, the traffic passes through a machine someone else operates.

A peer behind CGNAT that must receive while idle needs PersistentKeepalive.

Can two devices connect with no open port at all?

Yes. It works when both ends connect out and the NAT in front of each lets the replies back in. This is what the term NAT traversal covers, and RFC 5128 surveys the techniques, including the hole punching used between two peers that both sit behind a NAT. Sharing an exit with a person you name rides on the same idea; see sharing a VPN with family.

• A cone NAT reuses one outside port for every destination a device talks to, so a peer can be told where to send.
• A symmetric NAT picks a new port per destination, which defeats that.
• Hole punching is both peers sending outward at once, so each NAT opens a path for the other.

RFC 6886 defines NAT-PMP, a protocol that lets a device ask its router for a port mapping.

This is how ForestVPN's My exits works. On the home computer you turn on Use as an exit; on your phone or laptop you pick that computer under My exits. No port forwarding and no router setup is involved. While the home computer serves as an exit, the app asks a router that offers UPnP, PCP or NAT-PMP for a temporary UDP mapping.

Anything on the home network that can run ForestVPN is reachable while you are connected through that exit. Details and limits are on the home anywhere page, including that the home computer has to be on and that home upload speed is the ceiling.

Sharing a device with a named person is on the family sharing page, and the mesh comparison sets it beside Tailscale, a mesh VPN service. Every plan includes it, the Free plan too; the limits on exits and people are on the home anywhere page.

Which path two devices end up on depends on the NATs in front of them, so we built three topologies and ran each once.

What happened in our network-fault lab?

In the first two topologies the router offered no mapping protocol and the pair still connected, direct in the cone run and relayed in the symmetric run.

Symmetric NAT is the hard case for any peer-to-peer technique. It worked here only by staying on the relay: data flowed, but through a middleman.

Cone went direct, though we expected about 5 seconds and it took 16. In the third run the router handed out a NAT-PMP mapping on request.

Is an open port safe?

An open port is a service the whole internet can try, so it is only as safe as the software behind it and how fast you patch it.

CISA's home network guidance advises disabling unnecessary services to shrink the attack surface, and turning off UPnP unless there is a specific need, because, CISA warns, malware inside your network can use UPnP to weaken the router's firewall and let attackers control devices remotely.

The app asks for a mapping through any of UPnP, PCP or NAT-PMP, so switching UPnP off alone may not stop it; a router that answers none of them leaves the pair on hole punching or the relay. The outbound shapes in the table are not risk-free either: the home device runs a client, so keep it updated.

What should I do if I am behind CGNAT?

Run the three-step check. If the WAN address is outside 100.64.0.0/10 and matches the lookup page, forward as usual. If it is inside, write to the ISP once for a public IPv4 address; if that fails or you would rather open nothing, make the home side connect out. If you were weighing a rented server instead, self-hosted WireGuard vs a VPN service times that build.

For reaching your own devices, that means one app on each end and no router login.