Your router says you are online. Your provider may be quietly sharing that one front door with half the street.
The short answer
CGNAT (carrier-grade NAT) means your internet provider performs network address translation on its side, so many customers share one public IPv4 address [2]. Outgoing connections work as usual. Connections from the internet to your home server do not arrive, because no public address belongs to you alone. Our assessment: if you want to host something at home over IPv4, rule out CGNAT first.
How it works
- Double translation. Your router already translates your private addresses (RFC 1918: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 [3]) into one outside address. With CGN the provider translates a second time, so your traffic passes two NAT devices [2][5]. A forwarding rule on your own router only opens the first door.
- Addresses that give it away. RFC 6598 reserved the block 100.64.0.0/10 as "shared address space" for providers that run CGN [1]. AVM's help page lists address ranges that show a FRITZ!Box has no public IPv4 address, among them 100.64.0.0 to 100.127.255.255 [7].
- DS-Lite is a close relative. With DS-Lite your connection gets IPv6, and IPv4 travels through a tunnel to a provider-side device (the AFTR) that does the translation [4]. The effect for you is similar: the IPv4 address is shared. AVM explains DS-Lite and what it means for services you want to reach from outside [8].
- What breaks. Everything that waits for an incoming connection: a game server, a web server, remote desktop, a VPN back home. RFC 7021 analyses how CGN affects applications [5]. Our assessment: anything that only connects outwards, such as browsing or streaming, usually keeps working.
- Rules for the provider. RFC 6888 lists requirements for CGNs, for example on how they treat ports [2]. It does not promise you an inbound path.
- Ways out, only named. You can ask your provider about a public IPv4 address, use IPv6 where both ends support it, or let your server connect outwards to a relay. A protocol called PCP (RFC 6887) lets a host request a mapping from a CGN, but only if the provider supports it [6]. Whether yours does is unverified. The solution paths belong in our guide on home servers behind CGNAT (see Related pages).
A homelab example
The Bytearium homelab runs rack servers (HPE ProLiant DL360 Gen9 and DL380 Gen10) and a QNAP NAS, as of 14 to 18 Oct 2026. We have not recorded whether our connection uses CGNAT, so we say nothing about it here. What follows is a general test for your own line. Open the router's status page and read the IPv4 address on the internet side. Then ask an external "what is my IP" service for your address. If the two differ, or the router's address lies in 100.64.0.0/10, you are most likely behind CGN [1][7]. Our assessment: write both values down with the date, because providers can change the setup.
Checklist
- Read the IPv4 address on your router's internet side and note the date.
- Compare it with the address an external service reports.
- Check whether it lies in 100.64.0.0 to 100.127.255.255 or in a private range [1][3].
- Look at your router's connection overview for the words DS-Lite or "shared address".
- Ask your provider whether a public IPv4 address is available and what it costs.
- Test whether your router also has an IPv6 address.
- Avoid planning a home server over IPv4 until the first three checks are clear.