Every ISP that adds subscribers faster than it can obtain IPv4 addresses ends up asking the same question: how do we keep connecting people when the public address space has run out? For most networks the answer, at least for the IPv4 part of the traffic, is carrier-grade NAT. This note explains what CGNAT is, what NAT444 means, what it changes for subscribers, and what an operator has to get right to run it.
What CGNAT is
CGNAT (carrier-grade NAT), also written CGN or CG-NAT, is network address translation run by the ISP rather than by the subscriber's own router. Instead of giving every line its own public IPv4 address, the operator addresses subscribers from private space and translates their traffic onto a much smaller pool of public addresses at a NAT inside the network. "CGN" and "CGNAT" mean the same thing; "large-scale NAT" (LSN) is another name you will see in vendor documentation.
The translation itself is the familiar NAT44 your home router does: an inside IPv4 address and port are rewritten to an outside IPv4 address and port, and the replies are rewritten back. What makes it "carrier-grade" is the scale and the obligations that come with it. One public address is shared by many unrelated households, so the NAT has to be fair between them, behave predictably for applications, and keep records that let the operator say later who was using a given address and port. RFC 6888 (BCP 127) sets out the common requirements for a CGN: it carries over RFC 4787's NAT behaviour requirements, such as endpoint-independent mapping and hairpinning, and adds carrier concerns such as limiting the ports any one subscriber can hold.
NAT444: three address realms, two translations
With CGNAT in the path, a subscriber's packet is usually translated twice:
- The home router (CPE) translates the devices on the home LAN, typically RFC 1918 space such as
192.168.1.0/24, onto its WAN address. - That WAN address is not public. It comes from the ISP's inside space, and the CGN translates it again onto a public IPv4 address.
That arrangement is called NAT444: three IPv4 address realms (home, ISP inside, public internet) joined by two IPv4-to-IPv4 translations.
| Realm | Typical addresses | Who translates it |
|---|---|---|
| Home LAN | RFC 1918, e.g. 192.168.1.0/24 |
The subscriber's CPE |
| ISP inside (subscriber WAN) | 100.64.0.0/10 or RFC 1918 |
The carrier's CGN |
| Public internet | The operator's public IPv4 pool | Not translated |
The middle realm is why 100.64.0.0/10 exists. RFC 6598 reserved it as shared address space for exactly this purpose. If an ISP numbered subscriber WANs from 192.168.0.0/16 or 10.0.0.0/8, it would sooner or later collide with the range a customer uses on their own LAN, and the CPE would have the same prefix on both sides. Shared address space is never used on home LANs, so it avoids that collision. Netavo BNG accepts either: a VRF's inside pool can be 100.64.0.0/10 space or RFC 1918, and once the VRF is bound to a CGN IP group that pool is private and never announced.
How one public address is shared
A public IPv4 address has 65,536 TCP ports and as many UDP ports. A CGN shares the address by sharing its ports: each subscriber is given a slice of the port space, and their outbound flows are translated onto that slice.
Netavo's CGN allocates that slice as a port block, a contiguous range of ports, from the ports 1024 to 65535 on each public address. A subscriber starts with one block and can be given further blocks as they open more simultaneous flows, up to a configured per-subscriber cap. The block size you choose sets how many subscribers fit on each public address, and how much headroom a busy household has before it runs out of ports. The arithmetic is worked through in the note on how many subscribers can share one public IPv4.
On Netavo, the public space and the block policy live in an IP group, and a VRF is bound to it:
set cgn enabled true
set cgn ip-group residential public-subnets 45.84.203.224/28
set cgn ip-group residential chunk-size 512
set cgn ip-group residential port-cap 2048
set routing vrf internet cgn-ip-group residential
chunk-size is the block size and port-cap the most ports one subscriber can hold across all their blocks.
What CGNAT changes for subscribers
For browsing, streaming and most apps, a well-run CGN is invisible. The differences show up at the edges, and every operator who deploys it meets the same handful:
- Unsolicited inbound connections. A subscriber on a shared address cannot run a server that the internet connects to, because the CGN has no way of knowing which subscriber an unsolicited packet is for. The options are covered in inbound services behind CGNAT.
- Gaming and peer-to-peer. Consoles report a NAT type, and what they report depends on how the CGN maps and filters, and on the home router. Netavo's CGN implements endpoint-independent mapping and filtering with hairpinning; see CGNAT and gaming.
- Shared reputation and location. When many households share an address, one of them can earn it a CAPTCHA or a blocklist entry, and geolocation can be wrong. The runbook is in CGNAT CAPTCHAs, blocklists and wrong location.
- Port exhaustion. A household that opens more simultaneous flows than its port allowance sees new connections fail, which looks like a broken internet connection rather than a NAT limit.
What it changes for the operator
The obligation that catches operators out is attribution. An abuse report or a lawful request arrives naming a public address, a port and a time. With a shared address, the address alone identifies many subscribers; you need the port and the time, and a record of which subscriber held that port at that moment.
Logging every flow answers the question, at the cost of an enormous event volume. Block allocation reduces it: when a subscriber is given a block, one record ties that public address and port range to them for as long as they hold it. RFC 7422 describes a fully algorithmic version of the same idea, where the mapping is calculated rather than logged. Netavo records an allocation event for each block it grants and releases, with sequence numbers so a gap in the record is detectable. How to design and query that history is covered in CGNAT logging with deterministic port blocks.
The other operator decisions are where the CGN runs and how it is sized. Netavo's CGN runs integrated on the BNG that terminates the subscribers, so there is no separate box to route through, or as a standalone appliance behind another vendor's BNG. That standalone role is currently offered through a design-partner programme. Either way, the binding and flow tables are sized in configuration, and there is no per-flow licence.
CGNAT conserves IPv4; it does not replace IPv6. Every flow that can go over IPv6 bypasses the CGN entirely, which reduces port pressure, logging volume and the support load. Deploy both, and see IPv6 vs CGNAT economics for how to put numbers on it.
When CGNAT is the right answer
CGNAT is the right default for residential IPv4 when public addresses are scarce or expensive: it serves the many subscribers who only ever make outbound connections, at a sharing ratio you choose. It is the wrong answer for the few who need to be reached from the internet, such as businesses hosting services or customers with remote-access cameras. Give those subscribers a dedicated public IPv4 or rely on IPv6. A good deployment offers both.
See it on your own pool
The free evaluation build is the full production build with CGN enabled, licensed for up to 50 concurrent subscribers. Bind a test VRF to a small public block, bring subscribers up, and watch their port blocks in show cgn bindings. Before go-live, work through how to test a CGNAT deployment. Start at netavobng.com/evaluation; the CGN configuration reference is in the manual. If you would rather have CGNAT run for you, Netavo also offers CGNAT as a service for ISPs.
FAQ
What is CGNAT?
CGNAT (carrier-grade NAT) is network address translation run by the ISP rather than the subscriber's router. Subscribers are addressed from private or shared address space, and the carrier's NAT translates their traffic onto a small pool of public IPv4 addresses, sharing each public address between many subscribers by giving each a slice of its ports.
What is CGN, and is it different from CGNAT?
CGN is the same thing: carrier-grade NAT. CGN, CGNAT and CG-NAT are interchangeable names, and "large-scale NAT" (LSN) is another term some vendors use.
What is NAT444?
NAT444 is the common CGNAT arrangement in which a subscriber's traffic crosses three IPv4 address realms and is translated twice: once by the home router, from the home LAN to the subscriber's WAN address, and again by the carrier's CGN, from that inside address to a public IPv4 address.
Why do CGNAT subscribers get a 100.64.x.x address?
RFC 6598 reserved 100.64.0.0/10 as shared address space for the ISP side of a CGNAT deployment. It is never used on home LANs, so unlike 192.168.0.0/16 or 10.0.0.0/8 it cannot collide with the addresses a customer's own router uses inside the home.
Does CGNAT replace IPv6?
No. CGNAT conserves IPv4 and buys time, but every flow that can use IPv6 bypasses the CGN entirely. Run both, and give subscribers who need inbound reachability IPv6 or a dedicated public IPv4.
What does CGNAT mean?
CGNAT means carrier-grade NAT (sometimes written in full as carrier-grade network address translation, or shortened to CGN or CG-NAT). It is network address translation run by the ISP rather than by the subscriber's own router: subscribers are addressed from private or shared space, and the carrier's NAT translates their traffic onto a small pool of public IPv4 addresses, sharing each public address across many subscribers.
What is the difference between CGNAT and NAT?
The translation is the same NAT44 operation; what differs is who runs it and at what scale. Ordinary NAT is what your home router does — hiding one household's devices behind a single public address you control. CGNAT is that same translation run by the ISP inside the network, sharing one public address across many unrelated households, which adds carrier obligations a home NAT never has: fairness between subscribers, a per-subscriber port cap, and records that can say which subscriber held a given public address and port at a given time.