CGNAT

For the technical specification, see RFC 6598.

Carrier-grade NAT (CGNAT or CGN) is a large-scale NAT technique used by ISPs to let many subscribers share the same pool of public IPv4 addresses. It emerged as a response to IPv4 address exhaustion and is closely linked to the allocation of the "100.64.0.0/10" shared address space for use inside provider networks. The usage of this technique carries several implications for Internet governance and regulation that might go unnoticed without knowledge of its workings.

Deployment

In a CGNAT model, subscribers use private addressing in their home or enterprise networks, which is translated again inside the carrier network before reaching the public Internet. Mobile operators and broadband providers deploy CGNAT to keep offering IPv4 connectivity when they no longer have enough public addresses to assign one per customer. Measurement studies show widespread CGNAT use, especially in mobile networks, and highlight its impact on performance and traceability across the public Internet.

Governance and Accountability Issues

Because multiple subscribers share the same public IPv4 address, CGNAT weakens the traditional assumption that an IP address can be used to link online activity to a single access line or account. Law enforcement agencies and regulators have repeatedly flagged CGNAT as a major obstacle for IP-based attribution, especially when providers do not maintain detailed logs of address and port mappings over time.

From an Internet governance perspective, CGNAT shifts part of the accountability model from addressing to logging and data retention. Operators must decide how much connection metadata to retain (such as internal address, external address, ports, and timestamps) in order to respond to lawful requests, while data protection frameworks constrain how long this information may be stored. Industry guidance and regulatory discussions increasingly focus on “traceability by design” in CGN deployments, including deterministic NAT schemes and high-volume log management solutions.

Impact on Users and Platforms

CGNAT has side effects that influence user experience and platform governance choices:

• Application breakage and reduced reachability: Some services that expect inbound connections (for example, certain gaming platforms, peer-to-peer applications, or self-hosted services) become harder or impossible to use behind CGNAT, because subscribers cannot obtain a unique, publicly routable IPv4 address or stable port mappings.
• Shared reputation and collateral damage: Many unrelated users share the same public IP, so IP-based rate limiting, blocking, or reputation systems can affect large groups at once. Security and content platforms report cases where sanctions or abuse controls aimed at a few users degrade service for entire CGNAT subscriber clusters.
• Geolocation and policy enforcement: IP-based geolocation and some fraud detection systems operate at the level of public addresses. Under CGNAT, they tend to reflect the location of the carrier’s gateway rather than individual subscribers, which can complicate regional content policies, licensing restrictions, and jurisdictional assessments.

These effects feed back into governance debates about the reliability of IP addresses as identifiers and about the proportionality of IP-based blocking or enforcement measures in a CGN environment.

Relationship to IPv6 and Numbering Policy

CGNAT is widely described as a transitional response to IPv4 scarcity rather than a long-term architectural goal. IETF documents on shared addressing underline that techniques like CGNAT introduce complexity, new security considerations, and additional monitoring requirements, and they explicitly position IPv6 deployment as the sustainable way to restore end-to-end addressing and reduce dependence on stateful middleboxes.

RIR communities and technical bodies often treat CGNAT as a pragmatic tool that can delay, but not avoid, the need for IPv6. Policy and governance discussions therefore tend to frame CGNAT alongside IPv6 incentives, address allocation policies, and regulatory expectations around traceability, rather than as a complete solution to IPv4 exhaustion.

Network Address Translation. Maps an IP address space into another by modifying network address information in the IP header of packets while they are in transit across a traffic routing device (RFC 2663).

Internet Service Provider

Internet Engineering Task Force

Regional Internet Registry