# What is carrier-grade NAT?

Carrier-grade NAT places address translation inside an internet provider’s network.

Website: https://zenshield.com/glossary/cgnat

Canonical URL: https://zenshield.com/glossary/cgnat

Page reviewed: 2026-09-09

Carrier-grade NAT places address translation inside an internet provider’s network. Multiple customers can share public IPv4 address space. This is different from only having a private address behind your own home router, and it can matter when an application needs an incoming connection.

## A practical example

If you forward a port on a home router but an external connection still cannot reach the device, a second translation layer is one possibility. It is not the only explanation: firewall rules, the application and the test itself also matter.

## What to check

Ask the provider whether your service uses shared addressing and what options it offers for the task you need. RFC 6598 reserves 100.64.0.0/10 as shared address space, but an address observation alone should not replace confirmation of the provider’s setup. Explain whether you are hosting a service, joining a game or simply browsing.

## What it does not tell you

A VPN subscription does not automatically provide an incoming public address or port forwarding. Check that exact feature before choosing a service. Zenshield does not claim a verified port-forwarding capability here.

Read the [technical reference](https://www.rfc-editor.org/info/rfc6598/) for the underlying definition. For a connection that is failing now, use the [troubleshooting guide](https://zenshield.com/help/connection-problems). To choose an app, follow the [VPN selection worksheet](https://zenshield.com/learn/choosing-a-vpn).

## Sources
- https://www.rfc-editor.org/info/rfc6598/