CGNAT Port Forwarding

Why CGNAT changes the port-forwarding problem

Traditional IPv4 port forwarding assumes your router controls the public IPv4 address that receives the inbound connection. Carrier-grade NAT (CGNAT) adds a NAT layer inside the ISP network, so your home router receives a shared or non-public WAN address instead. A forwarding rule on your router cannot create a rule inside the ISP's upstream NAT.

How to check for CGNAT with evidence

Open your router's Internet/WAN status page and find its active IPv4 address. Then compare it with the public IPv4 detected by Connection Vitals CGNAT Test.

If the router WAN IPv4 is the same as the detected public IPv4, this comparison does not show upstream IPv4 NAT. If the WAN address is public-looking but different, re-check the active WAN interface before labeling it CGNAT; a mismatch alone is not a definitive diagnosis.

Why an external port probe usually fails behind CGNAT

An internet client connects to the ISP's public address, not directly to the private/shared WAN address on your router. Unless the ISP provides a mapping or a different inbound-connectivity product, the packet never reaches the forwarding rule you configured at home. That is why changing the internal destination, rebooting the router or recreating the same rule often produces no change.

What can actually solve it?

• Public IPv4 from the ISP: ask whether a public or static IPv4 option is available. This restores the traditional direct-forwarding model.
• Application relay: products such as media-server or NAS remote-access services may relay traffic without requiring a public inbound port.
• Overlay/VPN: an overlay can connect enrolled devices without exposing the service to the entire public internet.
• Reverse tunnel: some services create an outbound tunnel from the home network to a reachable endpoint. Suitability depends on protocol, performance and security requirements.
• IPv6: if both ends and the application support IPv6, direct IPv6 connectivity can avoid IPv4 CGNAT, but firewall policy still matters and IPv6 should be diagnosed separately rather than treated as IPv4 port forwarding.

CGNAT is not the same as double NAT

Double NAT means there are two routing/NAT devices in the path, often an ISP modem-router in front of your own router. If you control both layers, bridging one device or forwarding through both may solve the problem. With CGNAT, the upstream NAT is normally controlled by the ISP, so the available fixes are different.

Run CGNAT Test Check Double NAT

Confirm the address path first

Run the CGNAT Test before treating a failed inbound port as CGNAT. If the router WAN address is private rather than in shared CGNAT space, use the Double NAT Test to investigate the upstream gateway.