What Is Carrier-Grade NAT and How Does It Affect Internet Use?

Carrier-grade NAT (CGNAT) is a method internet providers use to share a single public IPv4 address across many customers at once, which means your connection never gets a unique public address of its own. In New Zealand it is especially common on 4G and 5G wireless broadband and satellite services. Most people never notice it — right up until a security camera, VPN server or remote access setup refuses to work.

Why New Zealand providers use CGNAT

The internet was built on IPv4, which allows roughly 4.3 billion unique addresses — nowhere near enough for every phone, router, camera and sensor now online. Public IPv4 addresses ran out years ago, and buying more is expensive. CGNAT lets a provider stretch its supply: instead of giving each customer their own public address, it places hundreds or thousands of connections behind one shared address and translates the traffic at the network edge.

In New Zealand, CGNAT is most common on fixed wireless broadband delivered over 4G and 5G, and on satellite services, because addressing is handled inside the mobile or satellite network core. Fibre connections more often receive a genuine public address, but that is not guaranteed either — practices vary between providers and plans. Business plans and static IP add-ons are the usual exceptions.

What stops working behind CGNAT

CGNAT breaks inbound connections — anything where a device or person out on the internet needs to reach equipment at your premises. Your router will still show a WAN address and still offer a port forwarding menu, but the address it holds is shared and unreachable from outside, so those forwarding rules achieve nothing.

The typical casualties are remote viewing of CCTV cameras or an NVR configured with port forwarding, hosting your own VPN server so staff can dial into the office network, remote desktop access to a work PC, and any on-site server that outside users need to reach. Online gaming can suffer from a strict NAT type, and some peer-to-peer applications struggle. Dynamic DNS services stop being useful too, because the address they record is shared with a crowd of other customers.

What CGNAT doesn't affect

Everyday outbound use is fine. Web browsing, email, Microsoft 365, Xero, video calls and cloud backup all initiate connections outward, and CGNAT handles that without fuss. Connecting out to a company or commercial VPN service usually works normally as well, although some older IPsec configurations can be temperamental.

The side effects you might notice are reputation-related rather than speed-related. Because you share an address with many strangers, you may see more captcha challenges, occasional rate limits, or a website block triggered by someone else's behaviour on the same address. CGNAT is rarely the reason a connection feels slow — that is almost always a separate issue.

How to check whether you're behind CGNAT

There is a two-minute test. Log into your router and find the WAN or internet address on its status page. Then open a browser and search "what is my IP". If the two addresses are different, your traffic is being translated upstream and you are behind CGNAT.

The router address itself is also a giveaway. If it falls between 100.64.0.0 and 100.127.255.255 — a range reserved specifically for carrier NAT — or in a private range such as 10.x.x.x, your provider is not giving you a public address. If you are still unsure, ask your provider directly whether your plan includes a public IP, and whether it is static or dynamic.

Your options if CGNAT is causing problems

The simplest fix is usually a public or static IP address from your provider. Many NZ providers offer one as an add-on or as part of a business plan, including on wireless broadband — but availability varies, so confirm it before you sign anything, not after the cameras are installed.

The second option is to redesign the setup so nothing needs an inbound connection at all. Cloud-managed cameras push footage out to a secure platform instead of waiting for you to connect in. Modern remote access and mesh VPN tools establish outbound connections from both ends, so they work happily behind CGNAT. Anything serving the public — a website, a booking system — belongs on cloud hosting rather than a server in the back office. This approach often improves your security posture too: open ports on a router are a common attack path, and closing them is basic cyber security hygiene.

The third option is changing plan or provider. If your business genuinely depends on inbound access, make a public IP a requirement when comparing connections rather than an afterthought.

Getting the right connection for your business

CGNAT is worth checking before it bites — ideally when you are choosing a new connection, moving premises, or planning cameras, alarms or phone systems that need remote access. It is far cheaper to specify the right plan up front than to rework equipment later.

We can review your business internet and networking setup, confirm whether you are behind CGNAT, and organise a connection with a static IP where you need one — including on wireless broadband where a fast install or portability matters.