The problem
If you have tried to open a port on your router and it doesn’t work, there is one reason that probably has nothing to do with you: you are behind CGNAT. It means your router has no public address of its own, but shares one with other users. Your ISP assigns you an internal address, and there is no way for traffic from the Internet to reach your router unless the ISP forwards it.
That is why online gaming, video calls and remote access to your home fail even when your configuration is perfect.
What CGNAT actually is
Your connection has two parts:
- Private network (LAN): the one your router creates, with addresses like 192.168.1.50. It is private because it is not routed on the Internet.
- Public network (WAN): the address the Internet sees. With CGNAT, that address is not yours: it is a public address shared by hundreds of customers.
If your WAN address falls in the 100.64.0.0/10 range, you almost certainly have CGNAT: that block was reserved by the CGNAT protocol and does not appear on the Internet. You can see it on your router’s status page, in the WAN IP or public IP field.
That shared range is defined in RFC 6598, and the private addresses of your home network in RFC 1918: if what your router shows as public IP is inside 100.64.0.0/10, you have no public address even if the equipment says otherwise.
How to know whether you are behind CGNAT
| Check | Result | Interpretation |
|---|---|---|
| Router WAN IP starts with 100.64-100.127 | You have CGNAT | Confirmed |
| The IP you see online differs from the WAN IP | You have CGNAT | Confirmed |
| WAN IP matches your public IP and is a private 192.168 or 10.x | No CGNAT, but the router is double NAT | Misconfigured |
| WAN IP matches your public IP and it is a real IP | No CGNAT | All good |
The easiest method is comparing the address your router shows with the one an IP lookup page reports. If they don’t match, you have CGNAT.
On the plans offered by the main Spanish ISPs, CGNAT applies to:
- Movistar and O2: common on their fibre plans. It can be avoided with the public IP option, which in some cases has an extra monthly cost.
- Orange: common on their fibre. The public IP option is paid.
- Digi: extended CGNAT by default on its broadband connections.
- Vodafone: on its fibre plans, a public IP is offered as an option.
- Adamo and Masmovil/Yoigo: it depends on the area and the product.
Conditions change often, so confirm with your ISP before you pay. You can look into your own case in replacing the ISP router and see the internet access settings in setting up the fibre router with PPPoE and VLAN.
Why it is a problem
With CGNAT, your router sits on a private network and does not accept direct incoming connections. You can open ports on your router, but the ISP never forwards them because you have no public address to send the traffic to.
This affects:
| Service | Symptom with CGNAT |
|---|---|
| Online gaming | Strict NAT, high latency |
| Incoming video calls | Sometimes nobody can call you |
| Remote access to your home | Impossible without a middleman |
| Server at home | Not reachable from the Internet |
| Torrent | Zero incoming connections |
Most services work fine outbound. The problem is always inbound.
What solutions exist
1. Ask your ISP for a public IP
It is the cleanest solution. Your ISP gives you a real public address and ports open normally.
Pros: simple, no maintenance. Cons: it has a monthly cost and not every combination of plan and technology offers it.
2. Relay servers (rVPN)
It is what any VPN with a public exit does: the underlying problem is explained in the CGNAT reference on Wikipedia, and the use of it by Spanish ISPs is covered in RedesZone.
If you cannot pay for a public IP, there are relays that give you a public server to connect to. The traffic between your home and that server travels encrypted, and from the outside the address seen is the server’s.
That is how internet exit VPNs work, but there are also services built specifically for a home network that behave like a tunnel in the opposite direction.
3. IPv6, if your ISP offers it
Many ISPs that apply CGNAT on IPv4 still provide native IPv6, which does not have the CGNAT problem. If your connection has a public IPv6 address, you can open ports and be reachable without paying anything.
How to check: look at your router’s status page and see whether you have a global IPv6 address, which starts with 2xxx or 3xxx. An address starting with fe80 or with fd/fc is link-local and is of no use.
4. Tailscale or WireGuard with a public node
If you can run a small server (a VPS or a Raspberry Pi reachable from outside) and set up WireGuard, you can reach your home through that server. It is the most flexible solution, and the one used by people who take their smart home seriously.
Why it is not a security issue
Two things are worth keeping apart:
- CGNAT is not a security measure. It is a network architecture decision made to save public IPv4 addresses. It protects you from nothing: if someone gets into your local network, CGNAT does not stop them.
- Opening ports does not mean opening your front door. A port opened on your router only accepts connections you have forwarded to a specific device. All the other ports stay closed.
So opening ports for your smart home is perfectly reasonable as long as the device is up to date. The risk lies in exposing services without a password or without updates, not in the port itself.
Configuring the router under CGNAT
Even if you cannot open incoming ports, you can still improve the internal network:
- Assign static IPs to your important devices, so they don’t change and you can write firewall rules per IP.
- Enable the router firewall and block access from the WAN to your LAN.
- Disable remote administration of the router from the Internet.
- Separate the guest network from the smart home device network.
- Update the firmware, which under CGNAT matters as much as on any other network.
For the network separation, see a separate VLAN for your smart home. For TV or phone ports, read ONT, HGU or neutral router.
Quick checklist
- Check whether your WAN IP starts with 100.64-100.127.
- Compare your WAN IP with your public IP.
- Ask your ISP about the public IP option and its price.
- Check whether native IPv6 is available.
- If you cannot, consider a relay or a VPS with WireGuard.
- Protect the local network: static IPs, firewall, no remote admin.
Sources and next step
To find out what kind of connection you have and how to configure it, see setting up the fibre router with PPPoE and VLAN. If what you want is to expose your smart home to the Internet in a controlled way, the next step is a separate VLAN for your smart home. And for the basics of the network, see WiFi password, WPA3 and WPS.
External sources
- RFC 6598: Shared Address Space for Carrier-Grade NAT — the 100.64.0.0/10 range discussed in the article.
- RFC 1918: private addresses
- CG-NAT: general reference — what it is and why it prevents port forwarding.
- Which Spanish ISPs use CG-NAT — market context and the PCP protocol (reviewed 2026-09-30).