CGNAT Test
Use address evidence instead of guessing from a closed port.
CGNAT / upstream NAT check
Compare the router WAN IPv4 with the public IPv4 that reached Connection Vitals.
The public IP shown here is detected from this browser request. External probes are restricted to that same public IP.
The CGNAT signal is the shared-address range
100.64.0.0/10 is the Shared Address Space reserved by RFC 6598 for carrier-grade NAT use. If your router WAN IPv4 is in that range, Connection Vitals reports CGNAT evidence.
A private WAN address is not the same finding
10/8, 172.16/12 and 192.168/16 are RFC 1918 private ranges. Seeing one as the router WAN address proves another private NAT layer exists upstream, but it does not by itself prove carrier-grade NAT. Use the Double NAT Test for that path.
Why a closed port cannot diagnose CGNAT
A failed TCP connection can also be caused by a stopped service, firewall, wrong forwarding destination or application binding. This page bases its CGNAT verdict on address evidence, not the port result.
If CGNAT is indicated and you need inbound access, see CGNAT and port forwarding.