CGNAT: when your internet address isn't really yours

You followed the port forwarding guide. You double-checked UDP. You turned the Windows firewall off just to see. Nothing.

And then you notice your router's "internet address" is something like 100.72.14.9, which doesn't match what "what is my IP" says at all. That mismatch is the whole story. The address the internet sees isn't yours. It's your ISP's.

What your ISP is doing

IPv4 addresses ran out years ago, and buying them now is expensive. So a lot of ISPs do to their customers exactly what your router does to your devices: put a bunch of homes behind one public address, with a big NAT in the middle.

That's "carrier-grade" NAT. Same trick, run by the carrier, at the scale of a neighborhood. Your router gets a private address from the ISP's NAT, the way your laptop gets one from your router. Its "public" address is only public as far as the ISP's network goes.

How to tell if you're behind it

1. Log in to your router and find its WAN or internet address on the status page.
2. Search "what is my IP" from any device on the same network.
3. Compare. If the router's WAN address is anywhere from 100.64.0.0 to 100.127.255.255, you're behind CGNAT. That block (100.64.0.0/10) was set aside in 2012 for exactly this, so nothing else should be using it.

If the WAN address is a regular private one instead, like 192.168.1.143 or 10.0.0.5, there's another router in front of yours. That's usually double NAT, which you can fix yourself, though a few ISPs run CGNAT on those ranges too. Checking the ISP box's own status page settles it.

Who does this

It's standard on phone networks, so if you're hosting from a hotspot, you're behind it. It's very common on 4G and 5G home internet and on satellite internet. And a growing number of cable and fiber ISPs do it quietly, sometimes only to some customers, sometimes only after they've switched you to new equipment. It's rarely mentioned when you sign up.

What you can actually do

First, the honest bit: no setting on your own router changes this. The wall is upstream of you. Here's what's left:

• Ask your ISP for a public IPv4 address. Some will move you off CGNAT for free if you ask. Some charge for a static IP. Some say no. It costs one support chat to find out, and it's the only fix that makes port forwarding work again.
• Use IPv6. CGNAT is an IPv4 thing, so if your ISP gives you IPv6, your server may be reachable over it. But every player needs working IPv6 too, and so does the game. Worth checking, hard to rely on.
• Put everyone on a VPN like Tailscale or ZeroTier. Works through CGNAT, but every player installs it and joins your network.
• Rent a server somewhere with a real address, and pay for it every month.
• Use a relay. Your server dials out (which CGNAT allows, it has to, or nothing would work), and players connect to the relay's public address instead. That's how Void Sluice works.

If you've spent an evening on this already: it was never your fault, and no amount of fiddling on your end was going to fix it.