Network

What is CGNAT?

Carrier-grade NAT is address translation performed by an ISP rather than in the customer's router, putting many subscribers behind one public IPv4 address. Mobile networks depend on it. Each customer holds a private or shared-range address, usually from 100.64.0.0/10, and the carrier rewrites the source address and port on every outbound flow.

The carrier assigns each subscriber an address from a private or shared range, most often 100.64.0.0/10, which was reserved for this purpose so it would not collide with the 192.168 and 10.x networks people already run at home. Traffic then crosses a large translator that rewrites the source address and port on the way out. Operators usually allocate a block of ports to each subscriber rather than one port per flow, because a fixed block keeps translation logs small enough to answer abuse complaints and legal requests months later.

Inbound connections stop working. Port forwarding, hosting a service from home and peer-to-peer applications that expect a reachable address all fail, and the usual workaround is a relay or a tunnel from a host that does hold a public address. Geolocation gets coarser as well, since the visible address belongs to the translator rather than to the subscriber. Mobile users routinely geolocate to whichever city holds the gateway, which can be a long way from the handset.

That shared address is what gives mobile IPs their unusual standing with detection systems. Hundreds or thousands of ordinary subscribers can sit behind one public address simultaneously, so a site that bans it takes out paying customers alongside whatever it was aiming at. Several accounts signing in from one mobile address reads as normal traffic rather than as a signal, and enforcement tends toward short blocks and challenges. A datacenter address earns none of that latitude, because it represents one tenant.

Addresses also move. When a device drops and re-establishes its radio connection, the carrier commonly issues a different public address from its pool, and that is the mechanism behind rotation on mobile proxies - cycling the modem rather than switching servers. PROXIES.SX runs its 4G/5G endpoints on carrier connections of this kind, with rotation included at no extra cost. The flip side is that a session can change address at a moment you did not choose, so anything stateful needs sticky handling.

Where you meet it

You run into CGNAT when something inbound refuses to work, or when an address behaves better than its numbers suggest. A broadband customer cannot open a port for a game server. A mobile session geolocates to a city the handset has never been near, and an account that gets flagged within minutes on a datacenter address runs for weeks on a mobile one. Each traces back to the same shared translation layer between subscriber and internet.

Common questions

How can I tell if my ISP puts me behind CGNAT?

Compare the WAN address shown in your router with the public address an IP checker reports. If they differ, you are being translated, and a WAN address inside 100.64.0.0/10 or a private range makes it near certain. Port forwarding that never accepts an inbound connection is the other reliable sign.

Why are mobile IPs harder for sites to block?

One mobile address stands in for many subscribers at once, so blocking it hits uninvolved customers. Detection systems weigh that collateral damage, favouring short blocks and challenges over permanent bans, and they treat several accounts from a single mobile address as ordinary rather than suspicious behaviour.

Does CGNAT give me privacy?

No. The carrier records which subscriber held which port range at which time, and that mapping identifies you on request. What CGNAT does is mix you into a crowd from the destination's point of view, which affects how a site scores the address, not who can find out it was yours.

Related terms

Mobile Proxy
A mobile proxy routes traffic through an IP address assigned by a cellular carrier, so requests appear to come from a handset or modem on a 4G or 5G network. Carriers share each public address among many subscribers, which gives mobile IPs a reputation that anti-bot systems are reluctant to block.
NAT
Network Address Translation rewrites the address and port fields of packets as they cross a router, letting many private hosts share one public IP. The router keeps a translation table, mapping each outbound flow to a free public port and reversing the rewrite on replies. Home routers do this for a household; carriers do it for whole regions.
IPv4
IPv4 is version 4 of the Internet Protocol, addressing hosts with 32 bits written as four dot-separated octets, which gives roughly 4.3 billion addresses. The top-level pool ran dry in 2011, pushing providers toward private addressing, carrier-grade NAT and a paid transfer market. Nearly all proxy traffic still runs over IPv4 because that is what target sites accept.
IP Address
An IP address is the numeric identifier a device presents on an IP network so packets can be routed to and from it. IPv4 writes 32 bits as four decimal octets, such as 203.0.113.7. IPv6 writes 128 bits as hexadecimal groups, such as 2001:db8::1. Every request a server logs is tied to one.
IPv6
IPv6 is version 6 of the Internet Protocol, addressing hosts with 128 bits written as eight hexadecimal groups, such as 2001:db8::1. The space is large enough that carriers assign each subscriber a whole subnet, usually a /64 or wider, so reputation systems score prefixes instead of single addresses. Adoption is broad but far from universal.
ASN
An Autonomous System Number identifies a network that announces its own IP address ranges to the rest of the internet through BGP. Every routable address sits inside a prefix announced by some AS, so the ASN behind an IP tells you who operates it - a mobile carrier, a hosting provider, a home ISP or a corporate network.
DNS
The Domain Name System turns a hostname such as example.com into the IP addresses a client can connect to. A stub resolver on the device asks a recursive resolver, which walks the root, TLD and authoritative name servers, then caches the answer for the record's TTL. Queries travel on port 53, or over TLS or HTTPS when encrypted.
DNS Leak
A DNS leak happens when a client sends its name lookups outside the proxy tunnel, so queries travel over the real ISP connection while the traffic itself exits on the proxy IP. The resolver operator, and any authoritative server it contacts, then sees a lookup tied to your actual network, region and provider.
WebRTC Leak
A WebRTC leak is a browser exposing your real IP address through its peer-to-peer connection API while page traffic goes through a proxy. WebRTC gathers ICE candidates over its own UDP sockets, which ignore the browser's proxy configuration, and any script on the page can read those candidates without asking permission.

Real 4G/5G mobile and residential IPs

PROXIES.SX runs carrier IPs in 100+ countries with HTTP and SOCKS5 on every endpoint. $4/GB down to $2.40/GB at volume, free endpoints and rotation, and your GB never expire.

View pricing Browse the glossary