How do I know if I’m behind CGNAT?

Compare the router’s Internet/WAN IPv4 with your public IPv4. An address inside 100.64.0.0/10 is strong evidence of CGNAT. A private WAN address or two different addresses means there is another translation layer that should be checked.

How do I check if I have CGNAT?

Use the two-address check on this page, disconnect any VPN first, and then confirm with your ISP. The full CGNAT guide also helps separate carrier NAT from an ordinary second router.

What is CGNAT and how can I fix it?

CGNAT lets an ISP share public IPv4 addresses across customers. The native fix is public IPv4 or reachable IPv6. A mesh VPN, VPN port forwarding, or a public server can create an alternative reachable path when the ISP option is unavailable.

Yes. You can use public addressing from the ISP, private mesh access, a VPN-provided incoming port, or a public server with an outbound tunnel. The right choice depends on who connects and how many ports the service needs.

How do I port forward behind CGNAT?

A home-router rule cannot cross the ISP gateway by itself. Use Proton VPN for one configurable public port, PureVPN for 2–15 selected ports, or a Vultr/DMIT server when you want a fixed endpoint and broader TCP/UDP control.

Do reverse proxies work with CGNAT?

Yes, when the home service starts an outbound connection to a reachable proxy or server. Web reverse proxies are excellent for HTTP and HTTPS; a WireGuard or FRP server is more flexible for arbitrary TCP and UDP services.

Does a NAS work behind CGNAT?

Yes. For your own devices, a private mesh VPN is usually the easiest option. If a NAS service must be public, place authentication and HTTPS in front of it and expose only the required service—not the NAS administration panel.

Does a VPN work over CGNAT?

Yes, because the VPN connection starts outbound, which CGNAT normally permits. Meshnet provides private access, while Proton VPN and PureVPN can provide documented incoming-port options for compatible public services.

Guide

18 min readJul 28, 2026

How to Bypass CGNAT (Choose the Right Method)

CGNAT blocks unsolicited inbound connections before they reach your router. Here is how to confirm the block, choose a reachable path, and make sure the connection really works.

The short answer

You cannot remove ISP-level CGNAT with a router setting. First ask your ISP for public IPv4 or use reachable IPv6. For private access, use a mesh VPN. For one public port, use Proton VPN; for 2–15 ports, use PureVPN. For a fixed public entry, UDP, or more control, use a Vultr or DMIT VPS with an outbound WireGuard or reverse tunnel.

Compare the VPN options Compare public servers

Can You Really Bypass CGNAT?

Yes—but first decide what “bypass” means for you. Removing CGNAT, creating a reachable inbound path, and improving a game’s NAT result are three different jobs.

Turn off or remove CGNAT

Only your ISP can move the line to public IPv4 or provide reachable IPv6. A router setting cannot remove carrier-side NAT.

Reach a service from the internet

A mesh VPN, a VPN-provided port, or an outbound tunnel to a VPS creates a new path around the blocked ISP entry.

Improve a game’s NAT type

Start with public IPv4, reachable IPv6, UPnP or the game’s relay support. The result depends on the game and the full connection path.

A normal VPN connection does not automatically change the NAT type on your home router. It only helps when the VPN provides the specific private-access or incoming-port feature your setup needs.

Start with proof, not guesses

Confirm CGNAT Before You Change Anything

Let’s make sure the ISP is really the layer blocking you. Compare the IPv4 address on your router’s Internet or WAN page with the public IPv4 shown from the same connection.

Compare the two IPv4 addresses

Open your router’s Internet or WAN page, note its IPv4 address, then compare it with the public IPv4 shown while the VPN is disconnected.

Look for 100.64.0.0/10

A router WAN address from 100.64.0.0 through 100.127.255.255 is strong evidence that the ISP is using CGNAT.

Rule out Double NAT

A private WAN address or two different addresses can also mean another router is upstream. Check that layer before choosing a bypass.

Open the full CGNAT check Rule out Double NAT

Choose a Method Based on What Must Connect

Match the method to who needs access, which protocol the service uses, how many ports it needs, whether the entry must stay fixed, and how much setup you want to manage.

Method	Who can connect	HTTP / TCP / UDP	Port count	Fixed entry	Management
ISP public IPv4	Any client allowed by your router and service	HTTP, TCP and UDP	As many as the router and service need	Dynamic or static	Easy
Reachable IPv6	IPv6-capable clients allowed by the firewall	HTTP, TCP and UDP	As many as the firewall and service need	Usually stable enough for direct access	Easy to moderate
NordVPN Meshnet	Only approved devices	Private device-to-device access	No public port required	No public entry required	Easy—install the app
Proton VPN	Anyone using the VPN address and assigned port	TCP and UDP on the assigned port	1	Port may change after reconnecting	Easy—install the app
PureVPN	Anyone using the VPN address and selected ports	TCP and UDP on selected ports	2–15	VPN-provided entry	Easy—app plus add-on
Vultr or DMIT VPS	Any client allowed by your firewall	HTTP, TCP and UDP	More ports or custom rules	Yes	Advanced—server administration

Try the ISP route first

Ask for public IPv4 or reachable IPv6 before buying another service. If either is available, it gives your router the shortest path and keeps normal port forwarding under your control.

The Easiest Option for Private Remote Access

If you only need your own devices or invited people to reach a home PC or NAS, a public port adds work you do not need. NordVPN Meshnet creates a private route between approved devices, so you install the app, sign in, and connect without managing a server.

Best for private access

NordVPN Meshnet

Meshnet connects approved PCs, phones, and home devices behind CGNAT
Simple apps provide private remote access without a public router port
Protects millions of users worldwide
30-day refund window for eligible purchases

Try NordVPN Meshnet

Choose NordVPN when access should stay private

Need to reach your own PC, NAS, or an invite-only group? Meshnet solves that private-access problem by joining approved devices through the app, giving you a direct private route without a public router port.

Bypass CGNAT With VPN Port Forwarding

If players, peers, or customers need a public port but the ISP blocks the route, a port-forwarding VPN moves that entry to its own server. Proton VPN gives you the simple one-port option; PureVPN gives you room for 2–15 selected ports without maintaining a VPS.

Choose a VPN That Supports Your NAT Setup

Not every VPN supports port forwarding or offers features that can improve NAT connectivity. The VPNs recommended here are options we found through research that clearly document either port-forwarding support or features intended to improve NAT connectivity, and they offer flexible refund policies so you can test them with less risk. Buying a VPN that cannot forward ports or improve NAT connectivity—and will not refund you either—is a frustrating outcome to avoid.

Best for exactly 1 port

Proton VPN

One assigned public incoming port on supported paid apps and P2P servers
A strong fit for one P2P listener, compatible game, or configurable service
100M+ accounts across the Proton privacy ecosystem
30-day refund window for eligible paid-plan purchases

Get Proton VPN for one port

Need one public listener without running a server? Proton supplies the VPN endpoint and assigned port, so one compatible app or service can receive incoming connections through the VPN.

Best for 2–15 ports

PureVPN

Port Forwarding add-on can open up to 15 selected incoming ports
Useful for several self-hosted services, game ports, or remote-access tools
3M+ users and 17 years in cybersecurity
31-day refund window for eligible initial purchases

Get PureVPN for multiple ports

Need several known ports but not a server control panel? PureVPN’s add-on puts 2–15 selected ports behind one app-based setup, giving multiple services a reachable VPN entry.

Keep the service running while you test the port. Proton’s assigned port can change after a reconnect, and PureVPN’s Port Forwarding add-on must be used in a supported location—once connected, match the active VPN port to the app’s listening port.

Some links on this page are affiliate links, meaning we may earn a commission at no extra cost to you. This helps keep NAT Checker free, but it doesn't affect what we recommend.

Use a VPS for a Fixed Public Entry

When you need a stable public address, UDP, more ports, or custom rules, a VPS becomes your public gateway. Your home service opens the tunnel outward, while remote users connect to the VPS—giving you the fixed entry and control that CGNAT took away.

Remote user or player

VPS public address and ports

Outbound WireGuard or FRP tunnel

Home service

First server choice

New users get $300

Vultr

A fixed public entry for WireGuard, FRP, and reverse-proxy connections
Full control over TCP, UDP, firewall rules, and additional service ports
80M+ cloud servers launched across 32+ data-center locations

Build the public entry on Vultr

Need a flexible fixed gateway for several TCP or UDP services? Vultr gives you the public server, firewall and routing control, so one outbound tunnel can make your home services reachable on the ports you choose.

APAC route choice

DMIT

Public IPv4 and IPv6 options for a stable reverse-tunnel endpoint
Premium routes across Hong Kong, Tokyo, Los Angeles, and wider APAC
Eligible new VM orders have a documented three-day refund window under the usage limit

Build the public entry on DMIT

Need the same fixed gateway with an APAC-focused route choice? DMIT gives your tunnel a public endpoint in locations such as Hong Kong, Tokyo or Los Angeles, helping you place the entry closer to the path you care about.

Some links on this page are affiliate links, meaning we may earn a commission at no extra cost to you. This helps keep NAT Checker free, but it doesn't affect what we recommend.

A server gives you more control

You choose the public ports, protocols, firewall, and tunnel. Plan on handling Linux, SSH keys, security updates, service restarts, and basic monitoring—or ask someone comfortable with server administration to help with the first setup.

Verify the Entire Connection Path

A port test is meaningful only when the service is running. Check the path from left to right and you will usually find the broken link in a few minutes.

Local service is listening

Host firewall allows it

VPN or tunnel is connected

Public address and port are correct

Outside client can connect

Fix a port that still looks closed

Troubleshooting

What you see	Check first	Best next move
The service fails even on the home network	Listening address, local port, app status, and host firewall	Make the local connection work before testing the VPN or server endpoint.
Local access works, but the public port looks closed	Active VPN port, VPS mapping, service listener, and public destination	Start the listener, confirm the exact public port, then test again from another network.
TCP works, but UDP does not	Protocol selection on the service, VPN/VPS rule, and firewall	Create a separate UDP path; a TCP rule does not carry UDP traffic.
It stops working after the VPN reconnects	Whether the assigned port changed or the tunnel failed to restart	Update the app’s listening port or add tunnel auto-start and keepalive.
The connection works, but latency is high	VPN/server region and the route between the endpoint and users	Choose a region closer to the people connecting and retest the route.
Everything suddenly stops working	Public IP changes, tunnel keepalive, and whether the service starts after a reboot	Reconnect the tunnel, update the endpoint if needed, and enable automatic startup for the tunnel and service.

Security Checklist

Expose only the exact service ports you need; do not use a blanket DMZ rule.
Use strong authentication, TLS where available, and SSH keys on public servers.
Keep the service, operating system, VPN app, and tunnel software updated.
Apply the same least-access rule to IPv6; a public IPv6 address still needs a firewall.

Frequently Asked Questions

Authoritative Sources

These IETF standards define CGNAT shared address space, carrier NAT behavior, and common NAT-traversal concepts. Provider feature links are kept inside the matching recommendation section instead of this reference list.

Run the NAT Checker

Share this article