What is CGNAT?

CGNAT (Carrier-Grade NAT) is network address translation run by an ISP, so many customers share a small pool of public IPv4 addresses instead of each getting one.

Without CGNAT, a home router gets a public address on its WAN side and translates the private LAN behind it. With CGNAT, the ISP gives the customer's router an address from the shared address space 100.64.0.0/10 (RFC 6598), which is not routed on the internet, and the ISP's own NAT devices translate those addresses again to public ones. Because there are often two translations in a row (private LAN to 100.64.0.0/10, then to a public address), this is sometimes called NAT444. Each public address is shared between many subscribers, with the CGNAT box handing out blocks of source ports to each one, so it works like PAT on a very large scale. ISPs adopted it because the regional registries ran out of fresh IPv4 addresses and it stretches what they have.

The most visible effect is that inbound connections can't reach you. A port forward on your home router does nothing, because the ISP's NAT in front of it has no mapping for unsolicited traffic, which breaks self-hosted servers, some games and some VPNs. If your router's WAN address is in 100.64.0.0/10, or differs from the address a "what is my IP" site reports, you are behind CGNAT. It also complicates abuse handling, since one public address represents many customers, so ISPs have to log port allocations. The usual ways around it are asking the ISP for a public address, an outbound tunnel to a server elsewhere, or IPv6, which needs no NAT at all. See NAT for the general idea, and the Setting up VyOS with NAT lesson for NAT on your own router.