CGNAT on Indian ISPs: Why Port Forwarding Fails and What to Do
You set up port forwarding on your router, double-checked the rule, and the port still shows as closed from outside. Your CCTV app can’t reach the DVR, your home server is invisible, your game host can’t accept connections. On many Indian broadband and mobile connections, the router is usually not the problem. Your ISP is.
What CGNAT is
Your home router already does NAT (Network Address Translation): all your devices share one public IP address, and the router keeps track of which device asked for what. CGNAT (carrier-grade NAT) is the same trick performed one level up, by your ISP. Instead of giving each customer their own public IPv4 address, the ISP puts many customers behind one shared public address.
That works fine for browsing, because your device starts every connection from the inside. It breaks anything that needs the outside world to start a connection to you: port forwarding, self-hosting, remote access to cameras and NAS boxes, and some peer-to-peer apps and games.
Why it’s so common in India
The reason is IPv4 exhaustion. There are only about 4.3 billion IPv4 addresses, and India adds an enormous number of new connections every year. As early as 2014, network engineer Anurag Bhatia documented Airtel’s 3G network using carrier-level NAT, noting the operator had run out of unique public addresses. His phone’s address fell in 100.64.0.0/10, a block that RFC 6598 reserves specifically for this purpose.
We can’t tell you what any particular ISP does today. Policies differ by operator, by plan, and by region, and they change. What we can tell you is how to check your own connection in about a minute.
How to check if you’re behind CGNAT
The test is a comparison of two addresses:
- Your public IP - what websites see. Our What’s My IP tool shows it (see also how to find your public IP address).
- Your router’s WAN IP - the address your router has on the ISP side. You’ll find it on the router’s Status or Internet page.
Then read the result:
| Router WAN IP | Meaning |
|---|---|
Between 100.64.0.0 and 100.127.255.255 | CGNAT, for certain |
A private address (10.x, 172.16-31.x, 192.168.x) | Another NAT sits in front of your router - CGNAT, or an ISP modem in router mode |
| Public, and identical to your public IP | You have a real public IP - not behind CGNAT |
| Public, but different from your public IP | Your ISP is translating your address upstream |
You don’t have to do the comparison by hand: our CGNAT Checker does it and explains the result. Turn off any VPN first, or the public IP it sees will be the VPN’s.
What you can do about it
CGNAT can’t be fixed from your router. Rearranging port forwarding rules, enabling DMZ or UPnP won’t change what your ISP does upstream. The real options are:
- Ask your ISP for a public IP. Some ISPs offer a public or static IPv4 address on request, often paid or limited to certain plans. Availability and pricing vary and change, so ask support directly and get the answer in writing.
- Use IPv6. Native IPv6 doesn’t need NAT at all. APNIC measured India’s IPv6 capability at around 79% in early 2026, and it notes Reliance Jio deployed IPv6 from the start. If your router has a global IPv6 address and the thing you’re hosting supports IPv6, remote access can work without any IPv4 port forwarding, as long as the device connecting to you also has IPv6 and your router’s IPv6 firewall allows the traffic.
- Use a tunnel. Tools like Cloudflare Tunnel and Tailscale make an outbound connection from your network, so CGNAT doesn’t matter. Both have free tiers at the time of writing, but check their current terms.
- Relay through a cheap cloud server. Connect your home machine to a small VPS with a VPN or SSH tunnel, and let the VPS accept the public connections.
- Check for double NAT. If your ISP gave you a separate modem or ONT and you plugged your own router into it, the ISP device may be doing NAT too. Look for a bridge mode, or ask your ISP.
After you have a public IP, the port can still be closed
A public IP means connections can reach your router, not that they’ll get through. Your router firewall, the device firewall, and ISP-level filtering of certain ports all still apply. Use our Open Port Checker to test a specific port from outside, and remember that a public IP from a home connection is usually dynamic unless you’ve paid for a static one.