# CGNAT, in plain language
> How to tell if your IPv4 address is shared, and what IPv6, Tailscale, and a tunnel change.
Carrier-grade NAT means the ISP runs one layer of address translation for many customers. Your router already does NAT for your laptop. CGNAT does it again, for the whole neighbourhood, because the ISP has fewer public IPv4 addresses than customers. Outbound browsing works. Inbound connections to you usually do not, and a website sees an address you share with strangers.

## How to tell

- The public IPv4 on [the CGNAT check](https://ipinfo.fyi/tools/cgnat) is not the WAN address in your router.

- The router WAN address is in 100.64.0.0/10, or is a private 10.x or 192.168.x address on the ISP side.

- The ASN is a mobile network. That is a hint, not a measurement.

## What it breaks

Hosting a game, a camera, or a remote desktop on IPv4 fails unless the ISP forwards a port, which CGNAT cannot do for everyone. Some login and trading systems treat the shared address as “many people are using this IP”. A VPN does not make it your own address. It replaces a shared ISP address with a shared datacenter address.

The practical options are on the [CGNAT page](https://ipinfo.fyi/tools/cgnat) and in the [India ISP guide](https://ipinfo.fyi/guides/static-ip-india): a public IPv4 from the ISP, IPv6, Tailscale, or a Cloudflare Tunnel.

Canonical: https://ipinfo.fyi/guides/cgnat