CGNAT
AdvancedCarrier-Grade NAT — the ISP technique that puts thousands of customers behind one shared public IP, and the reason mobile proxy IPs are so trusted.
In depth
CGNAT (Carrier-Grade Network Address Translation) is how ISPs — especially mobile carriers — stretch scarce IPv4 addresses: instead of giving each customer a public IP, they place thousands of customers behind a single shared one, translating between private and public addresses at carrier scale.
Why it exists
IPv4 ran out of addresses long before the internet stopped growing. Mobile networks, with billions of devices, adopted CGNAT almost universally: your phone gets a private IP, and its traffic exits to the internet through a carrier gateway whose public IP is shared with a whole crowd of subscribers at once.
The accidental gift to proxy users
- Blocking is collateral-heavy: ban one mobile CGNAT IP and you ban every subscriber behind it — potentially thousands of real customers. Most platforms simply can't afford that, so mobile IPs enjoy exceptional tolerance.
- Bad behavior gets diluted: abuse from one device blends into the legitimate traffic of the crowd sharing the address, making per-IP reputation scoring nearly useless.
- This is the mechanism behind mobile proxy pricing: mobile proxies cost more than residential precisely because CGNAT makes their IPs the hardest class to block.
The flip side
CGNAT also frustrates ordinary users: hosting servers, port forwarding, and some peer-to-peer applications break behind it, and you may be rate-limited for a stranger's abuse of your shared IP.
Examples
- A mobile carrier routes 5,000 subscribers through one public IPv4 address via CGNAT.
- A platform declines to ban a spam-flagged mobile IP because thousands of legitimate users share it.
- A home ISP customer can't port-forward a game server because their 'public' IP is actually a shared CGNAT address.
Common use cases
FAQs
Because banning a CGNAT IP means banning every subscriber behind it at once — often thousands of real people. Platforms tolerate suspicious traffic from mobile ranges rather than accept that collateral damage, which mobile proxy providers monetize.
Compare the WAN IP your router reports with the public IP a website sees. If they differ — commonly the router shows an address in 100.64.0.0/10 — your ISP is translating you through CGNAT.
Mostly invisible for browsing, but it breaks inbound connections: self-hosted servers, port forwarding, and some gaming or P2P setups. Some ISPs sell a dedicated public IP as an upgrade for users who need one.