CGNAT

IPv4 ran out of addresses. Carriers responded by assigning private addresses to subscribers and translating them onto a much smaller pool of public ones at the network edge. From the outside, all those subscribers appear as a single address.

The address range it uses

RFC 6598 set aside 100.64.0.0/10 — about four million addresses — specifically as shared address space between the subscriber and the carrier NAT. It exists because the older private ranges were already in use inside customer homes, and a carrier handing out 192.168 addresses would collide with every router on its own network. Some carriers use 10.0.0.0/8 regardless. Either way, seeing an address in one of those ranges on the WAN side of your connection is the signature.

Ports are the scarce resource, not addresses

Each public address offers 65,536 TCP ports and as many UDP ones. The carrier allocates them in blocks — commonly 512 to 4,096 per subscriber — so one address serves roughly 16 to 128 subscribers at once, and considerably more over a day as idle blocks are reclaimed and handed to someone else. That recycling is why the public address you appear as can change while nothing on your device changed at all.

What becomes impossible

Everything inbound. There is no port forwarding, because the mapping that matters belongs to the carrier and no protocol lets you request one — UPnP and NAT-PMP negotiate with your own router, which is not the device doing the translation. So no hosting, no incoming connections, and no direct peer-to-peer: carrier NAT often behaves as symmetric NAT, assigning a different external port per destination, which defeats hole punching and forces traffic through a TURN relay.

Translation state also expires. Idle TCP mappings are commonly dropped after somewhere between two and thirty minutes, and UDP mappings much sooner. This is the reason mobile apps send keepalives every few minutes, and the reason a long-idle connection on a mobile link dies without either endpoint having closed it.

Checking whether you are behind it

Compare two numbers. Read the WAN address your router or the device itself reports, then ask an external echo what address the internet sees. If the local one falls inside 100.64.0.0/10 or 10.0.0.0/8 while the external one is a public address, there is a carrier NAT between them. A traceroute confirms it: an extra private hop appears before the first public router in the path.

This is also the answer to a question that comes up whenever someone builds a phone farm at home or in a small office on a mobile or fibre line that turns out to be CGNAT: ADB over the network cannot reach the devices from outside, and neither can any dashboard you host next to them. Nothing is misconfigured — there is simply no inbound path to forward. The workaround is a reverse tunnel initiated from inside, which is exactly what hosted device platforms do on your behalf.

Why it matters for proxies

CGNAT is the reason a shared mobile IP is not the liability it would be on a residential connection. On a home broadband line, an address usually maps to one household — several unrelated accounts on it is unusual. Behind CGNAT, an address legitimately carries dozens of unrelated users, so the same observation carries almost no information.

It also means blocking a mobile address has collateral cost. Cutting off one abusive user cuts off everyone else translated onto the same address, which makes outright bans a blunt instrument on mobile ranges and pushes platforms toward challenges rather than blocks.

The practical consequence

Do not treat a shared mobile IP as a failure of isolation. Sharing is the native state of the network. But do not read it as invisibility either: CGNAT removes the address as evidence, not the rest of the picture. Thirty accounts on one carrier address is ordinary; thirty accounts on one carrier address that all act within the same minute have announced their relationship through timing, and no amount of address sharing hides that.