Double NAT vs. CGNAT: How to Fix Strict NAT and Port Forwarding on 5G Home Internet, Starlink, and Cable

Last updated: August 2026

Double NAT and CGNAT produce the same symptoms — strict NAT type, port forwards that silently fail, party chat that keeps dropping — but only one of them is yours to fix. Double NAT means two routers are stacked inside your home. CGNAT means your internet provider is sharing one public address across many customers, and no setting on your equipment changes that.

This guide gives you the two-minute check that tells them apart, the fixes for the problem you control, and the workarounds that actually function for the one you do not — on 5G home internet, Starlink, and cable alike.

Double NAT or CGNAT? The Two-Minute Check

Log into your router and find its WAN or Internet address — the address your ISP handed it, not the 192.168.x.x addresses it hands your devices. That one field settles the question.

• An address between 100.64.0.0 and 100.127.255.255 means CGNAT. That range is shared address space reserved by RFC 6598 specifically for carrier-grade NAT, and its presence on your WAN side is definitive.
• An address like 192.168.x.x or 10.x.x.x, with your own router plugged into an ISP gateway, means Double NAT — the gateway is translating once and your router is translating again.
• A public address means neither. Your problem is local configuration, and our port forwarding guide by router brand is the right document.

One quirk worth knowing: overlay tools like Tailscale assign 100.x addresses to their own virtual adapters. The CGNAT check applies to your router's WAN interface, not to a VPN adapter on your computer.

Either condition shows up the same way in daily use: NAT Type 3 or Strict on consoles, forwards that test closed no matter how carefully you configure them, and multiplayer party chat that connects and then drops.

How to Fix Double NAT

Double NAT ends when only one device performs translation, and there are three clean ways to get there.

Bridge mode is the standard fix: it turns the ISP gateway into a plain modem and lets your own router handle everything. The steps differ by provider, so use our step-by-step bridge mode guide for every major ISP rather than hunting through menus. If you run mesh, the equivalent move is switching the mesh system to access point mode so it stops translating a second time.

The cleaner fix on cable is ownership: replace the rented combo gateway with your own modem and router, which removes the second NAT and the monthly rental fee in one move. Our guide to owning your modem instead of renting covers compatibility and activation.

A gateway's DMZ option can also stop the double translation, but it exposes the entire device you place in it. Treat DMZ as a last resort, and never point it at a computer that stores anything you care about.

Why Port Forwarding Cannot Work Under CGNAT

A port forward is an instruction to your router: when a request arrives at our public address on this port, send it to this device. Under CGNAT, there is no "your public address." Your router's WAN side holds a shared-space address the internet cannot route to, and the public address you appear from belongs to a carrier device serving hundreds of other customers. The knock on the door stops at a front desk that has no record of you.

That is why the forward tests closed no matter what you do, and why UPnP cannot help either — both operate on your equipment, and the blockage sits upstream of it. The fix is not a better router setting. It is one of the four workarounds below.

CGNAT Workarounds That Actually Work

Start With IPv6

IPv6 removes the problem instead of working around it: every device gets a globally unique address, so there is nothing to translate. It costs nothing — enable it on your gateway, router, and console if it is not already on. Xbox benefits most, since Xbox network services are IPv6-native and will quietly prefer it.

The honest caveat is that IPv6 helps game connectivity more reliably than self-hosting. Some carriers, T-Mobile among them, filter inbound IPv6 connections, so your NAT type improves but a server behind that connection still is not reachable from outside.

Tailscale and WireGuard Tunnels

For remote access and self-hosting, an overlay network is the local-first answer. Tailscale puts your devices on a private encrypted mesh that traverses NAT on its own — direct WireGuard connections where possible, encrypted relays where a network is too strict — which means it works from behind CGNAT with zero ports opened and no router changes. The base tier is free, and if full sovereignty matters to you, the open-source Headscale project lets you run the coordination server yourself.

This covers the classic CGNAT casualties: reaching a home camera or NAS from anywhere, remote desktop, and private game servers shared with people you invite onto the mesh.

A VPN With Port Forwarding

A VPN with port forwarding gives you a reachable port on the VPN server's public address, bypassing your ISP's NAT entirely. Most large VPNs do not offer the feature at all, so "get a VPN" alone fixes nothing — the feature is the fix.

Proton VPN supports port forwarding on its paid plans: connect to a P2P server, enable the toggle, and the app assigns a port. Know the mechanics before relying on it — the port number is random and usually changes when you reconnect, which suits torrent clients and hosting sessions better than a permanent server. And our usual privacy co-recommendation does not fit this job: Mullvad deliberately removed port forwarding in 2023 after abuse of the feature got its addresses blacklisted — a principled call that happens to take it off this particular table.

Check Out Proton VPN

ISP Public-IP Options

Some providers will simply sell you the missing ingredient. Starlink documents this directly: standard service is CGNAT with all inbound ports blocked, while Priority, Mobile Priority, and Maritime plans can enable an optional public IP from the account dashboard — public, though dynamic, since it is assigned by DHCP. Other ISPs offer static-IP add-ons, usually framed as business features; the phrase to use with support is "public routable IPv4 address."

If none of the four options fit and you are weighing a provider switch, do the infrastructure homework first — our guide to finding the cell towers near you shows how to check what the next carrier actually has serving your address.

What Each Service Actually Gives You

Verizon is the mixed case worth spelling out: its own support site documents a port forwarding setting on the 5G Home router, yet many lines sit behind CGNAT in practice — the toggle exists, but the two-minute check tells you whether it can matter on your line.

Carrier network policies change without notice. Treat this table as a starting point and confirm against your provider's current documentation — and your own WAN address — before buying equipment or changing plans.

Console Quick Checks (PS5, Xbox, PC)

On PS5, run Settings, then Network, then Connection Status, then Test Internet Connection, and read the NAT Type: Type 1 is a direct modem connection, Type 2 is normal behind one router, and Type 3 means something upstream is blocking inbound traffic. On Xbox, Settings, then General, then Network Settings reports Open, Moderate, or Strict — the same ladder with different names. On PC, the tell is usually an application reporting a closed port or a relayed connection.

Make sure UPnP is enabled on the one router you control, since consoles use it to open what they need automatically. You will notice this guide skips the lists of specific port numbers that float around forums — consoles handle their own ports through UPnP, the numbers vary by game, and manual entry is covered properly in the port forwarding guide linked above.

Frequently Asked Questions

Can you port forward on T-Mobile Home Internet?

No. T-Mobile Home Internet places IPv4 traffic behind carrier-grade NAT, so there is no public address for a forwarded port to reach, and the gateway offers no setting that changes this. The service is IPv6-native, which improves console NAT behavior, but inbound connections are filtered. For remote access or hosting, use a tunnel such as Tailscale or a VPN that supports port forwarding.

What does a 100.64.x.x address mean?

An address between 100.64.0.0 and 100.127.255.255 is shared address space reserved by RFC 6598 specifically for carrier-grade NAT. If your router's WAN side shows one, your ISP is translating your traffic upstream and the internet cannot reach you directly. It is the single most reliable CGNAT tell — just make sure you are reading the router's WAN field, not a VPN adapter.

Does a VPN fix strict NAT?

Only if the VPN supports port forwarding, which most large providers do not. With the feature, you receive a reachable port on the VPN server's public address, bypassing your ISP's NAT entirely. Proton VPN offers it on paid plans; Mullvad removed the feature in 2023, so our usual privacy co-pick does not fit this particular job.

Does IPv6 fix my NAT type?

Often it helps, especially on Xbox, which uses IPv6 natively when available. IPv6 gives every device a globally unique address, so there is no NAT to traverse. The catch is that some carriers filter inbound IPv6 connections, so it improves game connectivity more reliably than it enables self-hosting a server.

Is CGNAT bad?

For browsing, streaming, and video calls, CGNAT is invisible and most people never notice it. It only matters when something outside needs to reach in: hosting a game server, remote camera access, self-hosted services, or peer-to-peer connections. It is less a defect than a loss of control — your ISP holds the address, not you.

What is the difference between Double NAT and CGNAT?

Double NAT happens inside your home: two routers each performing translation, usually a rented gateway with your own router behind it. You can fix it yourself with bridge mode or by replacing the combo unit. CGNAT happens inside your ISP's network, where many customers share one public address, and no home equipment change can undo it.