Home / Guides / Self-hosting behind CGNAT

Game server behind CGNAT: why friends can't join

You set up a game server at home, forwarded the port, and your friends still time out. If your ISP uses CGNAT, the port forward on your router never sees their connection.

Why CGNAT gets in the way

Players joining your server connect into your network on the game's port. Behind CGNAT, your public IPv4 address is shared, and incoming connections stop at the ISP's NAT unless the ISP opens a port for you (RFC 6269, section 5.2.1). Services that expect a fixed, well-known port are the hardest case: with address sharing, inbound connections to those ports "will not work in the general case" (RFC 6269, section 5.2.2).

Peer-to-peer play has trouble too. In an operator test of CGNAT, direct peer-to-peer gaming between two homes on the same ISP failed (RFC 7021, section 3.1). That's also why a console or game may report a strict or moderate NAT type: what NAT type means.

What works and what doesn't

Joining someone else's server: that's an outgoing connection, so it usually works.
Playing on your home network (LAN): unaffected.
Friends joining a server you host, over IPv4: blocked, unless your ISP gives you a public IPv4.
Friends joining over IPv6: can work if the game supports IPv6, both sides have IPv6, and your router's IPv6 firewall allows the port.

Check whether you're behind CGNAT

Compare your router's WAN address with your public IP using the CGNAT checker or the step-by-step guide. A WAN address between 100.64.0.0 and 100.127.255.255 is the CGNAT range (100.64.0.0/10 explained). If the two addresses match, CGNAT isn't your problem; check the port forward and any inbound port blocks your ISP lists.

What to ask your ISP

"Can you move my line off CGNAT and give me my own public IPv4?" Some ISPs do this for free on request; others only with a paid static IP.
"Do you sell a static IP on residential plans, and what does it cost?" Some ISPs only sell it on business plans.
"Is IPv6 available on my line, and is it turned on?" IPv6 doesn't go through the CGNAT, but the other side needs IPv6 too.
"Do you block or filter any inbound ports on home plans?" Even with a public IP, a blocked port stops players. Each ISP page lists the inbound ports we've verified.

Which ISPs make this easier

Of the 41 ISPs we track, 12 give home customers a public IPv4 by default, 3 offer a free CGNAT opt-out and 8 sell a static IP on home plans, per our sources. See ISPs without CGNAT, ISPs that use CGNAT, or filter the ISPs without CGNAT in your state. Each ISP page also quotes what the terms say about running servers at home.

FAQ

Why can't my friends join the game server I host?

If your ISP uses CGNAT, your router doesn't have its own public IPv4 address. Incoming connections from players stop at the ISP's NAT, so forwarding the port on your router isn't enough.

Can I still play online behind CGNAT?

Usually, yes. Joining servers run by others is an outgoing connection. Hosting a server and some peer-to-peer connections are what break.

What should I ask my ISP to host a game server?

Ask whether it can move your line off CGNAT to a public IPv4, whether it sells a static IP on home plans, whether IPv6 is available, and whether it blocks any inbound ports.

Does IPv6 fix hosting behind CGNAT?

Only partly. IPv6 skips the CGNAT, but every player also needs IPv6 and the game has to support it. A public IPv4 from your ISP avoids that dependency.

This site sticks to ISP facts. It doesn't review or recommend third-party products or services.