CGNAT Explained: How ISPs Stretch IPv4 Addresses
New IPv4 addresses are effectively unavailable from registries, yet ISPs keep adding subscribers. Carrier-grade NAT (CGNAT) solves this by letting many customers share a pool of public IPv4 addresses.
How it works
Subscribers receive private addresses — often from the 100.64.0.0/10 shared address space reserved for this purpose. The CGNAT device translates their traffic to a public IP and a range of ports, so dozens of subscribers can share one public address.
Side effects to plan for
- Inbound connections do not work by default — affecting home servers, some cameras and certain games.
- Abuse tracing needs logs of public IP, port range and time for each subscriber.
- Shared reputation: one abusive user can get a shared IP blocklisted.
- Capacity: CGNAT devices must handle huge numbers of sessions.
Best practices
- Allocate port blocks per subscriber to reduce logging volume.
- Offer public IPs to business customers who need inbound access.
- Deploy IPv6 alongside: traffic to IPv6-enabled services bypasses CGNAT entirely, reducing load.
- Keep translation logs for the period required by your licence conditions.
We help ISPs plan address space, CGNAT and IPv6. See our IPAM service or get in touch.
