If you use Starlink, T-Mobile Home Internet, or almost any mobile data provider, you might have noticed that traditional port forwarding simply doesn't work. This is due to Carrier-Grade NAT (CGNAT).
The IPv4 Exhaustion Problem
The world ran out of free IPv4 addresses years ago. Instead of giving every customer a unique public IP, ISPs now place thousands of users behind a single shared public IP address using CGNAT (also known as LSN - Large Scale NAT).
Why CGNAT Breaks Things
- No Inbound Connections: Since you don't have a dedicated public IP, there is no way for the outside world to "find" your router directly.
- Double NAT: Your router performs NAT, and then the ISP performs NAT again, causing issues for gaming and VPNs.
- Shared Reputation: If another user on the same CGNAT pool gets banned from a site, you might be blocked too.
How to Bypass CGNAT
If you need to host a server or access local devices, consider these alternatives:
- IPv6: Most CGNAT providers offer native IPv6, which provides a globally unique address.
- Cloudflare Tunnel: Securely expose your local services via Cloudflare's edge without opening ports.
- Tailscale / ZeroTier: Peer-to-peer overlay networks that punch through NAT effortlessly.