Carrier-grade NAT: your ISP puts many customers behind one shared public IPv4 address (RFC 6598 reserves 100.64.0.0/10 for it). Outgoing connections work normally; incoming connections, like friends joining your game server, can't reach you.

Can I port forward behind CGNAT?

No. The forward on your router is never reached, because the incoming traffic stops at your ISP. Use a tunnel, a VPN overlay, a game relay, a public IP from your ISP, or a hosted server.

Does Starlink use CGNAT?

Starlink commonly uses CGNAT for IPv4, as do many 5G home internet plans. Check your router's WAN IP to be sure.

Is double NAT the same as CGNAT?

No. Double NAT means two routers at your home (for example an ISP modem in router mode plus your own router). You can fix it by forwarding on both or using bridge mode. CGNAT happens at the ISP, where you can't change it.

Will a normal VPN app fix CGNAT?

A regular privacy VPN doesn't let friends reach you. A VPN overlay that every player joins (Tailscale, ZeroTier, Radmin VPN, Hamachi) or a tunnel such as playit.gg does.

Behind CGNAT? Host a game server without port forwarding

Quick answer

CGNAT (carrier-grade NAT) means your internet provider shares one public IPv4 address between many customers. Incoming connections stop at the provider and never reach your router, so port forwarding cannot work, no matter how you set it up. To check: compare your router's WAN/Internet IP with the IP a "what is my IP" site shows. If they differ, or the router's WAN IP is between 100.64.0.0 and 100.127.255.255, you're behind CGNAT. The fixes are to ask your ISP for a public IP, use a tunnel such as playit.gg, use a VPN overlay every player joins, use the game's own relay (Valheim crossplay, Hytale friend worlds), or rent a server.

How to fix it, step by step

Find your router's WAN IP. Log in to your router (often 192.168.0.1 or 192.168.1.1) and open its status page. Note the WAN or Internet IPv4 address.
Find your public IP. On the same network, open a "what is my IP" site, or run curl -4 ifconfig.me.
Compare the two. Same address: you're not behind CGNAT, and port forwarding can work. WAN IP from 100.64.x.x to 100.127.x.x: CGNAT. WAN IP that's private (10.x.x.x, 172.16-31.x.x, 192.168.x.x): another router is in front of yours (double NAT), or CGNAT.
Fix double NAT if that's what you have. Forward the port on both routers, or put the ISP's modem/router into bridge mode so only your router does NAT.
Pick a workaround for CGNAT. Ask your ISP for a public or static IPv4 address first; it removes the problem. Otherwise use a tunnel, a VPN overlay, the game's relay, or a hosted server (details below).

Workarounds that work behind CGNAT

Ask your ISP for a public IPv4 address. Sometimes free, sometimes a monthly fee or a business plan. Always worth asking.
Tunnel (playit.gg). Your server connects out to the tunnel and friends join its address. playit.gg lists Minecraft Java, Minecraft Bedrock, Palworld, Valheim, Terraria and Hytale on its free tier; Premium is $3/month.
VPN overlay (Tailscale, ZeroTier, Radmin VPN, Hamachi). Every player installs it and joins your network. Good for a small group of PC players; consoles can't join this way.
The game's own relay. Valheim's -crossplay mode relays traffic, so no port forwarding is needed. Hytale friend worlds fall back to a Hytale relay.
IPv6. Can work when you and every player have IPv6, but you still need a firewall rule, and many players won't have it.
Rent a server. A game host or VPS has its own public IP, so nothing at home needs to be reachable.

Who is usually behind CGNAT?

Starlink, many 5G and fixed-wireless home internet plans, and mobile connections commonly use CGNAT. Some cable and fiber providers do too. Your router's WAN IP is the only reliable test.

Check it automatically

On the web check, open "Add details" and enter your router's WAN IP and your public IP. Server Doctor flags CGNAT (WAN IP in 100.64.0.0/10, or a WAN IP different from your public IP) and double NAT, then shows the fixes for your game.

Test it from the outside

Your own Wi-Fi can't tell you whether friends can reach the server. The free Server Doctor check contacts your server once from the internet, the way the game does, and tells you the most likely cause. The same check runs in Discord with /fix.

No PC to host 24/7?

If you're behind CGNAT and don't want every friend installing a VPN, a hosted server is the simplest fix: it has its own public address, stays online when your PC is off, and needs no router changes.

Behind CGNAT? Host a game server without port forwarding.