CGNAT and the Challenge of Shared IP Addresses
How Carrier-Grade NAT lets many users share one public IP, and why that complicates identification and blocking.
Core Concept
Carrier-Grade NAT (CGNAT) lets an ISP share a single public IP address across hundreds or thousands of subscribers, conserving increasingly scarce IPv4 space.
This means the IP address visible to a destination server often represents an entire neighborhood or region, not a single household or device.
Why ISPs Rely on CGNAT
CGNAT became widespread as IPv4 exhaustion made individually assigned public addresses increasingly costly.
- Mobile carriers with millions of subscribers
- Fixed-line ISPs delaying IPv6 rollout
- Cost savings versus purchasing additional IPv4 space
A Stopgap, Not a Fix
CGNAT is widely viewed as a transitional measure — IPv6 adoption is the actual long-term solution to address exhaustion.
Problems CGNAT Creates
Shared addressing complicates several common security and networking practices.
- IP-based blocking punishes many innocent users for one abuser
- Rate limiting by IP becomes unreliable at CGNAT scale
- Geolocation accuracy drops since the IP represents a broad region
Identifying CGNAT Traffic
Certain signals help distinguish CGNAT traffic from a dedicated address.
Reserved address ranges, known mobile carrier ASNs, and unusually high request diversity from one IP are all useful indicators.
Shared Address Space
The 100.64.0.0/10 range is specifically reserved for CGNAT use, making it a useful signal when visible in internal logs.
Adapting Security Practices
Effective systems adjust their approach when CGNAT is detected.
- Favor account or session-based rate limiting over pure IP limiting
- Weight CGNAT-originating risk scores more cautiously
- Combine IP data with device fingerprinting for better accuracy
Real-World Implementation
CGNAT-aware design has become standard practice across fraud and abuse systems.
- Fraud engines weighting CGNAT ASNs differently than dedicated IPs
- CDNs avoiding aggressive per-IP rate limits on known mobile carriers
- Security teams documenting CGNAT ranges for internal tooling
As mobile traffic continues to grow, treating IP address as a weak, shared signal rather than a unique identifier is increasingly necessary.
Common Mistakes to Avoid
Systems that don't account for CGNAT often make these mistakes.
- Blocking an entire CGNAT IP after detecting abuse from a single user behind it.
- Applying strict per-IP rate limits that penalize thousands of legitimate CGNAT users at once.
- Assuming geolocation accuracy for CGNAT IPs matches that of dedicated addresses.
- Failing to recognize known CGNAT address ranges like 100.64.0.0/10 in internal tooling.
- Treating CGNAT traffic identically to dedicated residential or business IP traffic.
- Assuming all mobile carriers implement CGNAT identically.
- Overlooking that some fixed-line ISPs also use CGNAT, not just mobile carriers.
- Failing to document known CGNAT ranges specific to major regional carriers.
- Overlooking that some enterprise networks also use NAT pooling similar to CGNAT.
- Assuming CGNAT pool sizes are consistent across all deployments of the same carrier.
- Failing to distinguish CGNAT from standard home router NAT in traffic analysis.
- Overlooking that CGNAT pool boundaries can shift as carriers reallocate address space.
Best Practices Checklist
These adjustments help systems handle CGNAT traffic more fairly and effectively.
- Favor account or session-based controls over strict per-IP limits where CGNAT is common.
- Recognize known CGNAT and mobile carrier ASNs and adjust risk scoring accordingly.
- Avoid permanent IP-based blocks on ranges known to be heavily shared.
- Combine IP data with device fingerprinting for more reliable identification under CGNAT.
- Document which traffic sources are known to use CGNAT to inform future policy decisions.
- Document known CGNAT ranges for major carriers relevant to your user base.
- Recognize that fixed-line ISPs increasingly use CGNAT alongside mobile carriers.
- Review carrier-specific CGNAT implementation details rather than assuming uniform behavior.
- Recognize enterprise NAT pooling as a related pattern deserving similar handling to CGNAT.
- Account for variable CGNAT pool sizes even within a single carrier's deployment.
- Distinguish CGNAT-level sharing from standard single-household router NAT in analysis.
- Treat documented CGNAT ranges as needing periodic reverification rather than permanently fixed.
Frequently Asked Questions
Frequently asked questions about CGNAT and its effect on IP-based systems.
Why would blocking an IP affect thousands of unrelated users?
Under CGNAT, a single public IP can be shared by thousands of subscribers simultaneously, so blocking it affects everyone behind that shared address.
Is CGNAT the same as a VPN?
No — CGNAT is an ISP-level address-sharing technique for conserving IPv4 addresses, unrelated to the voluntary use of a VPN service.
How can I tell if traffic is coming from a CGNAT connection?
Known reserved CGNAT ranges, mobile carrier ASN ownership, and unusually high request diversity from one IP are all useful indicators.
Does IPv6 solve the CGNAT problem?
Largely yes — IPv6's vastly larger address space removes the need for widespread address sharing, though CGNAT remains common on IPv4 connections.
Should rate limiting be disabled entirely for CGNAT ranges?
Not entirely — shifting to account or session-based limiting rather than strict per-IP limiting is generally a better approach than disabling limits altogether.
Do all mobile carriers implement CGNAT the same way?
No — pool sizes, address ranges, and reassignment frequency vary meaningfully between carriers, affecting how traffic patterns actually look.
Is CGNAT limited to mobile networks?
No — a growing number of fixed-line ISPs also use CGNAT, particularly as IPv4 exhaustion continues to pressure address availability.
Where can I find documented CGNAT ranges for specific carriers?
Some carriers publish this information, while others require inference from traffic analysis or industry-shared threat intelligence resources.
Do enterprise networks use address sharing similar to CGNAT?
Some do, particularly large organizations with limited public IP allocations, producing similar shared-address challenges as consumer CGNAT.
Is CGNAT pool size consistent within a single carrier?
Not necessarily — pool sizes can vary by region or network segment even within the same carrier's overall deployment.
Do CGNAT address ranges stay fixed indefinitely?
Not necessarily — carriers can reallocate pools over time, so documented ranges benefit from periodic reverification.
Investigate a Shared IP
Run an IP intelligence lookup to check ASN and hosting context for any address.
Launch Tool →