Behind CGNAT? How to reach your home network without a public IP

What CGNAT is

The internet ran out of IPv4 addresses years ago. To keep connecting new customers, many providers share one public address between dozens or hundreds of homes. They do it with an extra layer of address translation inside their own network, called Carrier-Grade NAT (CGNAT).

For browsing, you will not notice anything. The problem appears when you want to receive connections: a VPN server, a camera, a game server or remote access to your computer. The request reaches the provider's shared address and stops there, because the provider has no idea which of its customers it is meant for.

How to check if you are behind CGNAT

1. Open your router's settings page and look for the WAN or Internet IP address.
2. Check your public IP on our What is my IP page.
3. Compare them. If they are different, there is another NAT in between: you are behind CGNAT.

Why port forwarding stops working

When you open a port, you open it on your router. With CGNAT, incoming traffic never gets that far: it hits the provider's NAT first, and you cannot configure that one. That is why everything looks right on your side and still nothing answers from outside.

Ways around CGNAT

• Ask your provider for a public IP. Some give you one for free or for a small fee. On mobile, 4G/5G and satellite connections it is often not possible.
• Use IPv6. If your provider and the network you connect from both support it, it can work, but support is still far from universal.
• Use a relay. Your server opens an outgoing connection to a relay on the internet, and your devices reach it through there. Outgoing connections are never blocked, so this works on any connection, with nothing to change on the router.

How MiVPN solves it

MiVPN includes its own relay in the paid plans. Your home server goes out to meet it, and your phone or laptop connects through it. It switches on automatically when your connection needs it: there is nothing to configure.

The relay only forwards packets that are already encrypted between your device and your server. It cannot read them, just as a courier does not read what is inside the envelope.