Home / Guides / Self-hosting behind CGNAT

Home automation behind CGNAT: remote access to your hub

Lights and sensors keep working at home, but you can't open your self-hosted hub's dashboard from outside, and integrations that are supposed to call your hub never arrive. CGNAT is a common reason.

Why CGNAT gets in the way

Opening your hub's dashboard from outside, or letting an online service send updates to your hub (callbacks, also called webhooks), needs an incoming connection to your home. Behind CGNAT, those connections stop at the ISP's NAT, and your router's port forward never sees them (RFC 6269, section 5.2.1).

What works and what doesn't

Local control on your home network: unaffected.
Devices and hubs that connect out to an online service: they start the connection themselves, so they usually keep working.
Opening your own hub from outside over IPv4: blocked, unless your ISP gives you a public IPv4.
Callbacks and location updates sent to your hub from the internet: blocked over IPv4 for the same reason; over IPv6 they can work if the sender supports IPv6.

Check whether you're behind CGNAT

Compare your router's WAN address with your public IP using the CGNAT checker or the step-by-step guide. A WAN address between 100.64.0.0 and 100.127.255.255 is the CGNAT range (100.64.0.0/10 explained). If the two addresses match, CGNAT isn't your problem; check the port forward and any inbound port blocks your ISP lists.

What to ask your ISP

"Can you move my line off CGNAT and give me my own public IPv4?" Some ISPs do this for free on request; others only with a paid static IP.
"Do you sell a static IP on residential plans, and what does it cost?" Some ISPs only sell it on business plans.
"Is IPv6 available on my line, and is it turned on?" IPv6 doesn't go through the CGNAT, but the other side needs IPv6 too.
"Will my public IP stay the same?" Integrations and bookmarks break when your address changes. A static IP stays put; a public dynamic IP can change.

Which ISPs make this easier

Of the 41 ISPs we track, 12 give home customers a public IPv4 by default, 3 offer a free CGNAT opt-out and 8 sell a static IP on home plans, per our sources. See ISPs without CGNAT, ISPs that use CGNAT, or filter the ISPs without CGNAT that sell a static IP on home plans in your state. Each ISP page also quotes what the terms say about running servers at home.

FAQ

Why can't I reach my smart home hub from outside my home?

If your ISP uses CGNAT, your router doesn't have its own public IPv4 address, so incoming connections from the internet stop at the ISP's NAT and never reach your hub.

Will my smart home stop working behind CGNAT?

No. Local control works the same, and devices that connect out to an online service usually keep working. What breaks is reaching your own hub from outside and services calling into it.

What should I ask my ISP?

Ask whether it can move your line off CGNAT to a public IPv4, whether it sells a static IP on home plans, and whether IPv6 is available and turned on.

This site sticks to ISP facts. It doesn't review or recommend third-party products or services.