ROUTER SETUP
How to Check If Your ISP Uses CGNAT
If you're planning to host a VPN server at home, there's one question to answer before you touch a single setting: is your connection behind…
✓The 30-second test: router WAN IP✓What the result means for hosting✓Your options if you are behind
Quick Answer
Compare your router’s WAN IP with your public IP from an online “what is my IP” check: a match means a public IP and working port forwarding, while a mismatch, or a WAN IP in the 100.64.0.0/10 range, means your ISP uses CGNAT.
- Test: router admin panel shows the WAN IP, an IP-check site shows the public IP; disable any VPN first.
- Shortcut: a WAN IP in 100.64.0.0/10 is address space reserved for CGNAT; that’s proof, no comparison needed.
- Double NAT: if the mismatch is your own ISP modem feeding your router, bridge it or forward through both devices; that’s fixable.
- Behind CGNAT: ask the ISP, use Tailscale or Headscale, or relay via VPS. HomeIPVPN‘s VPN audit picks the right workaround for your situation.
If you're planning to host a VPN server at home, there's one question to answer before you touch a single setting: is your connection behind Carrier-Grade NAT? Learning how to check if you're behind CGNAT takes about thirty seconds, and the answer determines whether port forwarding will work at all, or whether you need a completely different approach. Here's the definitive test, what the result means, and your options either way.
The 30-second test: router WAN IP vs public IP
Step 1. Find your router's WAN IP. Log in to your home router's admin panel and look at the internet/WAN status page. Note the IPv4 address shown as the WAN or internet IP. (On GL.iNet routers, it's on the main internet status screen.)
Step 2. Find your public IP. On a device connected to your home network, search "what is my IP" or visit an IP-checking site. Note the IPv4 address it reports.
Step 3. Compare.
- They match: your router holds a public IP. Port forwarding will work, and you can host a VPN server the standard way.
- They differ: something sits between your router and the public internet. Almost always, that's your ISP's Carrier-Grade NAT.
The shortcut check: if your router's WAN IP starts with 100.64. through 100.127. (the 100.64.0.0/10 range), that's address space reserved specifically for CGNAT. You're behind it, no comparison needed. Other private ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x) on the WAN side also indicate NAT upstream, which could be CGNAT or could be a second router in your own home (double NAT: fixable on your end).
One caution: run the test from a device on your home network with any VPN turned off. An active VPN will show the VPN's IP as your "public" IP and give you a false mismatch.
What the result means for hosting a VPN server
Public IP (no CGNAT): you're in the straightforward scenario. Forward the VPN port (UDP) from your router to your VPN server, set up DDNS for your changing address, and your travel devices can connect directly. This is the classic, lowest-latency home IP VPN setup.
CGNAT: inbound connections from the internet cannot reach your home network, period. It's not a configuration problem. There's simply no public address pointing at you. Port forwarding rules on your router forward ports on an address nobody can reach. Any tutorial that starts with "forward port 51820" will fail for you, and no amount of tweaking changes that.
This is more common than people expect: many mobile carriers, a growing number of fiber providers, and most 4G/5G home internet services use CGNAT. If your home internet comes through a cellular connection, assume CGNAT until proven otherwise.
Double NAT (your own equipment): if the mismatch is caused by your ISP's modem-router combo feeding your own router, you can fix it yourself: put the ISP device in bridge/passthrough mode or forward ports through both devices. Only the ISP-side CGNAT case is unfixable by configuration.
| WAN IP vs public IP | Meaning | Can you port forward? |
|---|---|---|
| Match | Public IP, no CGNAT | Yes, standard setup |
| Differ, WAN in 100.64.0.0/10 | ISP CGNAT | No, need alternatives |
| Differ, WAN is other private range | CGNAT or double NAT | Only if it's your own double NAT |
| IPv6 only / no IPv4 WAN | IPv4 CGNAT or IPv6-only | Depends, check with ISP |
Your options if you are behind CGNAT
Option 1: Ask your ISP for a public IP. Some ISPs will move you off CGNAT on request, sometimes free, sometimes as a paid add-on, sometimes only on business plans. It's the simplest fix when available: one call or support ticket, and the standard setup works. Always ask first.
Option 2: Use a relay/mesh VPN. Tools like Tailscale (or self-hosted Headscale) establish outbound connections from your home server to a coordination service, punching through CGNAT without any inbound ports. Your travel devices join the same mesh and reach home through it. Slightly more moving parts, but it works behind any NAT.
Option 3: VPS relay. Rent a small virtual server with a public IP, run WireGuard on it, and have your home server maintain an outbound tunnel to the VPS. Travel devices connect to the VPS, which forwards them home. Your exit IP becomes the VPS's datacenter address, though, so this sacrifices the "residential home IP" benefit unless the relay only handles the connection and traffic still exits at home (an advanced configuration).
Option 4: IPv6. If your ISP offers real public IPv6 addresses (many CGNAT'd IPv4 ISPs do), you can run the VPN server over IPv6 and connect to it directly. The catch: the networks you connect from (hotels, cafés) must also have working IPv6, which is still hit-or-miss while traveling.
FAQ
What does CGNAT stand for?
Why do ISPs use CGNAT?
Can a VPN service bypass CGNAT?
Will switching routers fix CGNAT?
How do I ask my ISP to remove CGNAT?
Does CGNAT affect my internet speed or gaming?
Need help setting this up?
Found out you're behind CGNAT and not sure which workaround fits your situation? That's exactly the kind of thing our VPN audit untangles: we look at your ISP, your hardware, and how you travel, then recommend the cleanest path to a working home IP. Details at https://homeipvpn.com.
