Why You Can't Port Forward: CGNAT Explained and How to Get Around It

You did everything right. The rule is saved, the console has a static IP, and the ports match the game's list. Then you test from outside and nothing connects. The camera app works at home and dies the moment you switch to mobile data.

Here's the uncomfortable part. On a lot of internet plans, no router setting can fix this. Your ISP runs something called carrier-grade NAT, usually shortened to CGNAT, and it blocks inbound connections before they ever reach your house.

One NAT in your house, another at your ISP

Your router already does NAT. It shares one public IP address across every phone, laptop, and TV in your home. We've explained how NAT works in plain English, so I won't repeat it here.

CGNAT is the same trick done a second time, inside your ISP's network. The ISP takes one public IPv4 address and shares it across hundreds of customers. Your whole house becomes just one device on a much bigger shared network.

That's why inbound connections die. Traffic aimed at your camera arrives at the ISP's shared address, and the ISP's equipment has no idea which customer wants it. So it drops the connection. Your port forward rule sits downstream and never sees a single packet.

If this sounds like double NAT, you've got the right idea. The difference is location. Double NAT lives inside your house, and you can fix it in an afternoon. CGNAT lives in your ISP's network, and you can't touch it.

ISPs don't do this to annoy you. The world ran out of fresh IPv4 addresses years ago, and buying more is expensive. Sharing each address across many homes is how newer networks cope with the shortage.

The two-minute check for CGNAT

You don't need to guess. Comparing two numbers tells you exactly what's going on.

Log into your router's admin panel, usually at 192.168.1.1, and find the WAN or Internet IP address. TP-Link shows it under Advanced > Status. Asus puts it on the Network Map. Netgear lists it on the ADVANCED tab as the Internet Port IP.
Open our what is my IP tool in a browser on the same connection.
Compare the two addresses.

If they match, you have a real public IP and CGNAT isn't your problem. Go recheck your firewall rules and the device's internal IP instead. If they don't match, someone upstream of your router is running another layer of NAT.

There's also an instant giveaway. Any WAN address between 100.64.0.0 and 100.127.255.255 comes from the address space reserved specifically for carrier-grade NAT. If your WAN IP starts with 100.64 through 100.127, the question is settled. You're behind CGNAT.

A WAN address starting with 192.168, 10, or 172.16 through 172.31 points somewhere else. That usually means a second router inside your own home, which is the fixable double NAT case. Different problem, happier ending.

What CGNAT quietly breaks

Port forwarding is just the loudest failure. The same shared address causes a family of problems that look unrelated until you know the cause.

Your Xbox or PlayStation reports Strict NAT no matter what you change. You can follow every step of our port forwarding for gaming guide perfectly and the NAT type won't budge. The console is telling the truth. Inbound connections genuinely can't reach it.

Dynamic DNS becomes pointless. The service faithfully tracks an address that hundreds of other households are using at the same moment. Anyone who connects to it reaches the ISP's equipment, not your network.

Security camera apps show the classic symptom. Everything works on your home WiFi, then the feed dies on mobile data. Same story for Plex remote streaming, remote desktop, and hosting a Minecraft server for friends.

T-Mobile, Starlink, and probably your fiber ISP

T-Mobile Home Internet doesn't support port forwarding at all. There's no hidden menu, and swapping the gateway won't add it. The whole network runs on CGNAT, so there's nothing for a setting to do.

Starlink is the same story on its standard residential plans. A public IPv4 address is only offered on the Priority and Mobile Priority plans, which are aimed at business users. A regular home dish sits behind CGNAT, which is why searches for a Starlink CGNAT bypass are so common.

The practice is even more widespread outside the US. Many fiber and mobile providers in the Philippines, India, and Latin America put every home customer behind CGNAT by default. IPv4 scarcity hit hardest in regions that came online later. The detection steps above work the same everywhere.

Workarounds that actually work

None of these are free lunches. Each one trades money, effort, or compatibility. Still, all four beat staring at a port forward rule that will never fire.

Ask your ISP for a public IP

Start with a phone call or a support chat. Many ISPs sell a public or static IP as a monthly add-on, and a few will move you off CGNAT for free if you ask. Fiber providers tend to be the most flexible here.

On Starlink, the official route is upgrading to a Priority plan. On T-Mobile Home Internet there's no add-on to buy, so skip the call and keep reading.

Use IPv6 where both ends support it

IPv6 sidesteps the whole problem because there are enough addresses for every device on Earth. Starlink lists IPv6 availability on several of its plans, and plenty of mobile networks hand it out too.

The catch is that both ends need it. Your camera, its app, and the network you're connecting from all have to speak IPv6. In 2026 that's still hit and miss, so test it before you rely on it.

A VPN service with port forwarding

Some paid VPN services offer port forwarding through their servers. Your device makes an outbound connection to the VPN, which CGNAT happily allows. The VPN then passes a port on its own public address back down the tunnel to you.

This works well for game servers and file sharing. The downsides are extra latency and one more subscription. Confirm the provider still offers port forwarding before paying, because several have dropped the feature.

Outbound tunnels, the fix I'd actually use

For cameras, home servers, and remote access, mesh VPNs and tunnel services are the cleanest answer. Tailscale-style tools build a private network between your own devices. Cloudflare Tunnel does a similar job for web services you want to publish. Everything connects outward, so CGNAT never gets a vote.

Setup is friendlier than it sounds. Install the client on a home PC or the camera server, then on your phone. Both sides call out to the coordination service, and traffic flows between them. No open ports, no public IP, no awkward ISP conversation.

What won't work, so you can skip it

DMZ won't help. It only decides what your router does with traffic that has already arrived, and under CGNAT the traffic never arrives. UPnP fails for exactly the same reason.

Buying a fancier router won't help either. The block sits upstream of any hardware you can own. Bridge mode, new firmware, and factory resets don't touch it. If your WAN IP sits in that 100.64 range, save yourself the evenings of router surgery.

Where to start tonight

Run the two-minute check before anything else. If your router's WAN IP matches the public checker, CGNAT is innocent and the fix lives in your router. Recheck the rule, the protocol, and the device's internal IP.

If the addresses don't match, pick a path based on what you're trying to do. Gamers chasing Open NAT should ask the ISP about a public IP first, since consoles don't play nicely with tunnels. Camera and server people should try a mesh VPN, and the popular ones are free for personal use.

And if you're on T-Mobile Home Internet, don't burn an hour on support chat asking for port forwarding. The answer is no, and it's not the agent's fault. The tunnel route is the real fix there, and honestly, it's the fix I'd pick on any CGNAT connection.