What is CGNAT, and why your home internet has no real IP address

You look up your IP, add it to a whitelist, and it still doesn't work. Or it works for a day. If your internet is behind CGNAT, the address you see isn't really yours.

Last updated 29 October 2026 · 4 min read

CGNAT stands for carrier-grade NAT. Your ISP puts many customers behind one shared public IP address, the same way your home router puts your phone and laptop behind one address. You still get internet, but you don't get a public IP of your own. For browsing and streaming you'd never notice. For anything that checks your IP, like an API allowlist, it causes trouble. If that's why you're here, a static IP for API whitelisting gives your outgoing calls an address that is yours. First, how to tell whether CGNAT is your problem.

How CGNAT works, in plain terms

At home, your router already does NAT. Every device gets a private address like 192.168.1.5, and the router swaps it for one public address on the way out.

With CGNAT the ISP adds a second layer. Your router no longer gets a public address on its WAN side. It gets another private-looking address, and the ISP's equipment swaps that for a public address shared with lots of other customers. So there are two translations between you and the internet, and the last one is shared.

ISPs do this because there aren't enough IPv4 addresses to give every connection its own. There's even a block set aside for it. RFC 6598 reserves 100.64.0.0/10 as shared address space for carrier-grade NAT.

How to check if you're behind CGNAT

It takes two minutes.

1. Open your router's admin page (often 192.168.1.1 or 192.168.0.1, or the address printed on the router's label) and find the WAN or internet IP on the status page.
2. On a device on the same Wi-Fi, run curl -4 https://ifconfig.co, or open our what's my IP tool.
3. Compare the two.

If the router's WAN address is between 100.64.0.0 and 100.127.255.255, you're behind CGNAT. If the WAN address is something else private, like 10.x.x.x, and doesn't match what the website shows, there's also NAT upstream of you. If the two match, you have a public IP. It may still be dynamic, but at least it's yours while you have it.

What CGNAT breaks

IP allowlists

When you whitelist "your" IP with a broker, a payout API or an exchange, you're actually whitelisting the ISP's shared address. Other customers' traffic leaves from it too. And the ISP can move you to a different shared address whenever it likes, so the whitelist breaks without warning. This is the most common reason people find this article.

Reaching anything at home from outside

Port forwarding on your router does nothing, because the connection never reaches your router. CCTV apps, a home NAS or a game server can't be reached directly. Many devices fall back to cloud relays for exactly this reason.

Being treated like your neighbours

Some websites rate-limit or block by IP. If someone else on your shared address misbehaves, you can get the captcha or the block.

Is IPv6 the way out?

Sometimes. Many Indian ISPs now hand out IPv6 alongside IPv4, and with IPv6 there's no shortage, so your devices often get addresses of their own. Run curl -6 https://ifconfig.co. If it prints an address, you have IPv6.

Two catches. Plenty of platforms don't accept IPv6 in their allowlists yet, and home IPv6 addresses can change too, often when the router restarts. So IPv6 helps, but on its own it doesn't give you a fixed address to whitelist.

How to get a real, fixed IP

Ask your ISP for a public or static IP

Some ISPs will take you off CGNAT if you ask, sometimes for a fee. A static IP usually means a business plan. ACT, for example, lists a free static IP on business plans starting at ₹5,999 a month plus GST, and JioBusiness plans include a public static IP. That fixes things for that one connection, at that one address. It doesn't follow you to the office, a server or a laptop on the move.

Run the work on a server with its own IP

If what needs the fixed IP is a script or a bot, you can move it to a cloud server with a fixed public address. That works, and it's a common route. You pay for the server and manage it.

Send the traffic that matters through a dedicated static IP

This is what TrueIP does. You get a dedicated IPv4 or IPv6 in Mumbai with its own proxy login. Point the app or script that talks to the whitelisted service at it, and those requests leave from your fixed address, even from a CGNAT connection at home. Everything else on your network carries on as normal.

One thing to be clear about: this is for outgoing connections. It gives your requests a fixed address. It doesn't make your CCTV or NAS reachable from outside, because TrueIP doesn't accept incoming connections. For that you need a public IP from your ISP or the device maker's cloud service.

Quick checklist

• Check your router's WAN address. 100.64 to 100.127 means CGNAT.
• Don't whitelist a CGNAT address. It's shared, and it moves.
• Check for IPv6 with curl -6 https://ifconfig.co, and check whether the platform accepts IPv6 before relying on it.
• For something at home that must be reachable from outside, ask your ISP for a public IP.
• For outgoing calls that need a whitelisted address, use a server with a fixed IP or a static IP for API whitelisting.

Keep reading