What carrier-grade NAT is
Your home router normally translates many private addresses to one public address. Carrier-grade NAT adds a second translation inside the ISP, so many homes share one public address. RFC 6598, published in April 2012, reserves 100.64.0.0/10 as Shared Address Space for numbering the links between CGN equipment and customer routers. It describes the block as not globally routable. Tailscale's NAT traversal write-up puts the motive plainly: ISPs can no longer afford one public IPv4 address per home. [1][4]
The effect is simple. Nothing on the internet can start a connection to your home, because your router never holds a public address. You cannot reconfigure the ISP's NAT either. [4]
Detect it in three steps
One trap: Tailscale assigns device addresses from the same 100.64.0.0/10 block, so a 100.x address on a laptop running Tailscale proves nothing about your ISP. Read the WAN address on the router. [3]
- Open your router's status page and note the WAN or Internet IPv4 address.
- Compare it with the ranges below. A WAN address in 100.64.0.0/10 points to carrier-grade NAT; one in an RFC 1918 private range means another router or the ISP is translating ahead of you. [1][2]
- Compare the WAN address with the address a what-is-my-IP site shows. If they differ, something upstream is translating. GL.iNet's DDNS test does something similar: it compares the address your DDNS name resolves to with the router's WAN IP and warns that a mismatch likely means NAT. [6]
| WAN address range | Defined by | What it suggests |
|---|---|---|
| 100.64.0.0 to 100.127.255.255 | RFC 6598 Shared Address Space [1] | Carrier-grade NAT at the ISP |
| 10.0.0.0 to 10.255.255.255 | RFC 1918 [2] | Private: ISP NAT or another router upstream |
| 172.16.0.0 to 172.31.255.255 | RFC 1918 [2] | Private: ISP NAT or another router upstream |
| 192.168.0.0 to 192.168.255.255 | RFC 1918 [2] | Often an upstream router in your home: see our double NAT guide |
| Anything else, matching what-is-my-IP | Public address | Not CGNAT; port forwarding can work |
Why port forwarding and DDNS fail
Port forwarding opens a port on your router's public address. Behind CGNAT, the router has no public address, so the ISP's NAT drops inbound traffic before it reaches you. GL.iNet's DDNS page says an internet public IP is required for dynamic DNS, and a public IP is required for its HTTPS and SSH remote access. Behind CGNAT a DDNS name would point at a shared ISP address you do not control. [6]
Tailscale's write-up also explains why router tricks do not help. Port-mapping protocols such as UPnP, NAT-PMP and PCP act on the NAT layer closest to you, not the ISP's, and CGNAT ISPs often disable them anyway. [4]
What still works: connect outward
Every method that survives CGNAT has your home device make an outbound connection first. A mesh VPN such as Tailscale tries a direct connection and falls back to a peer relay or a DERP relay. Run tailscale status to see whether a peer is direct or relayed. ZeroTier falls back to a TCP relay if UDP is blocked. [5][11]
Device vendors build in the same idea. GL.iNet says its KVMs need no open ports or public IP. JetKVM Cloud relays through Cloudflare TURN servers when a firewall or carrier-grade NAT blocks a direct path. For a web service you host, Cloudflare Tunnel's connector makes outbound connections to Cloudflare, needs no publicly routable IP, and lets you block inbound traffic at your firewall. [10][8][7]
| Method | Works behind CGNAT? | Trade-off |
|---|---|---|
| Port forwarding | No | Needs a public address on your router |
| Dynamic DNS for inbound access | No | Public IP required, per GL.iNet [6] |
| Mesh VPN (Tailscale, ZeroTier) | Yes | May relay with more latency [5][11] |
| Vendor relay (for example a KVM cloud) | Yes | Trust the vendor account [8][10] |
| Outbound tunnel (Cloudflare Tunnel) | Yes | Suited to web services; adds a provider [7] |
| Public IPv4 from the ISP | Removes CGNAT | Depends on the ISP's offer |
| IPv6 | Often avoids the address shortage | Firewalls still apply; both ends need IPv6 [4] |
One router for the whole house
Rather than installing a VPN app on every device, you can run it on the router and expose your home network. GL.iNet firmware 4.2 and later includes a beta Tailscale app on supported models, including Flint 2 (GL-MT6000). It can advertise LAN subnets, which you then approve in the Tailscale admin console. That lets a phone on the road reach a printer, NAS or KVM at home through one router, without port forwarding. GL.iNet advises against running it alongside other VPN clients on the same router. [9]
If you already have a router that can do this, there is nothing to buy. If not, see our Flint 2 guide before replacing your ISP's router, and our double NAT guide if your WAN address is in 192.168.x.
Decision table
| You want to... | Do this behind CGNAT |
|---|---|
| Reach a NAS, printer or KVM from your own devices | Mesh VPN on the router or on the device [9][5] |
| Use a product that has its own app or cloud | Use its relay; secure the account [8][10] |
| Publish a website or webhook to the public | Outbound tunnel such as Cloudflare Tunnel [7] |
| Run a game server or anything needing open ports for strangers | Ask the ISP for a public IPv4 address |
| Confirm a connection is not relayed | Run tailscale status or tailscale ping [5] |
Questions before you decide
My Tailscale address starts with 100. Does that mean I am behind CGNAT?
No. Tailscale assigns its own device addresses from 100.64.0.0/10, the same block RFC 6598 reserves for carrier-grade NAT. Check the WAN address on your router's status page, not the Tailscale address.
Will dynamic DNS work behind CGNAT?
Not for inbound access. GL.iNet's DDNS page says a public IP address is required for DDNS, and for HTTPS or SSH remote access to the router. Behind CGNAT your router never holds the public address the DDNS name would point to.
Does a mesh VPN always connect directly behind CGNAT?
Not always. Tailscale's write-up on NAT traversal says CGNAT is a form of double NAT that defeats port-mapping protocols, and that relaying is the fallback when hairpinning and port mapping both fail. A relayed connection still works, just with more latency.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- RFC 6598: IANA-Reserved IPv4 Prefix for Shared Address Space Accessed 30 Oct 2026
- RFC 1918: Address Allocation for Private Internets Accessed 30 Oct 2026
- Tailscale Docs: What are these 100.x.y.z addresses? Accessed 30 Oct 2026
- Tailscale blog: How NAT traversal works Accessed 30 Oct 2026
- Tailscale Docs: Connection types Accessed 30 Oct 2026
- GL.iNet Router Docs (firmware 4): Dynamic DNS Accessed 30 Oct 2026
- Cloudflare Docs: Cloudflare Tunnel Accessed 30 Oct 2026
- JetKVM Docs: JetKVM Cloud Accessed 30 Oct 2026
- GL.iNet Router Docs (firmware 4): Tailscale Accessed 30 Oct 2026
- GL.iNet KVM Docs: Quick FAQs about GL.iNet KVM Accessed 30 Oct 2026
- ZeroTier Docs: Relay Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.