Home / Guides
How to tell if you're behind CGNAT
It takes about two minutes. You compare two addresses: the WAN IP your router was given, and the public IP the internet sees. Here's how, step by step.
1. Find your router's WAN IP
Open your router's admin page or app and look for a status page labeled WAN, Internet or Broadband. Write down the IPv4 address shown there. If your ISP's gateway is in front of your own router, check the gateway; your own router's WAN will just show the gateway's private address.
2. Find your public IPv4
Open the CGNAT checker. It shows the IPv4 (and IPv6) address that cgnat.wtf sees when your browser connects, along with your ISP's network name. No third-party service is involved and nothing is stored.
3. Compare them
| Router WAN IP | What it means |
|---|---|
| Same as your public IP | Public IP You're not behind CGNAT. Port forwarding can work, as long as your ISP's terms allow it. |
Between 100.64.0.0 and 100.127.255.255 | CGNAT This is the 100.64.0.0/10 shared address space that RFC 6598 sets aside for carrier-grade NAT. |
Starts with 10., 192.168., or 172.16. to 172.31. | Another NAT These are private ranges (RFC 1918). Usually there's another router in front of yours (often the ISP's gateway). Some ISPs also use these ranges for CGNAT. Check the device in front first. |
| A public address, but different from your public IP | Check again Your IP may have just changed, or traffic is leaving through a different address. Re-run the checker. |
| No IPv4 WAN address at all, only IPv6 | IPv6-only access Some networks give you only IPv6 and translate IPv4 traffic on the ISP side. That IPv4 address is shared, so it acts like CGNAT for incoming IPv4 connections. |
4. Optional: read a traceroute
Run traceroute -n example.com (macOS/Linux) or tracert -d example.com (Windows). The first hop is your router. If the next hop or two are in 100.64.0.0/10, that strongly suggests CGNAT, though some ISPs use those addresses inside their network without CGNAT. Steps 1 to 3 are the reliable test.
5. Check IPv6 separately
CGNAT only affects IPv4. If the checker shows a public IPv6 address, devices on your network can still be reached over IPv6 from networks that also have IPv6, if your router's IPv6 firewall allows it.
If you are behind CGNAT
- Look up your ISP in the ISP table. Each page says whether there's a free opt-out, a paid static IP or neither, with sources.
- See which providers use CGNAT and which don't.
- Found something we don't have yet? Submit a report.
This site sticks to ISP facts. It doesn't review or recommend third-party products or services.