# What is CGNAT, and why are mobile IPs hard to block?

> CGNAT (carrier-grade NAT) is the technique carriers use to put many subscribers behind one public IPv4 address: each device gets a private address, often from the 100.64.0.0/10 block reserved by RFC 6598, and the carrier's NAT translates it. Blocking one mobile IP therefore blocks many real users. Jade Proxies 4G/5G ports exit through such carrier addresses.

Source: https://jadeproxies.com/what-is-cgnat/ · Jade Proxies · Updated 29 October 2026

**Key figure: 4,194,304** — According to Jade Proxies arithmetic, the 100.64.0.0/10 shared address space that RFC 6598 reserves for carrier-grade NAT holds 4,194,304 addresses: 2^(32 − 10) = 2^22, exactly 1/1,024 of the whole IPv4 space. (RFC 6598 (IETF, April 2012), arithmetic by the Jade Proxies Research Desk, 29 October 2026)


## How does CGNAT work?

CGNAT works by adding a layer of address translation inside the carrier's network: the carrier gives each subscriber a private address and rewrites it to a shared public IPv4 address and port when traffic leaves for the internet. Replies come back to that public address and port, and the NAT forwards them to the right subscriber.

| Stage | Address in use | Example |
|---|---|---|
| Phone or modem on the carrier network | Private address from the shared space | 100.72.15.9 |
| Carrier-grade NAT | Private address and port mapped to public address and port | 100.72.15.9:51022 → 203.0.113.40:20511 |
| Website | Public address only | 203.0.113.40 |

One public IPv4 address offers 65,536 port numbers (2^16), and the NAT divides them among the subscribers who share that address at a given moment. How many subscribers share one address is a setting each carrier chooses and does not publish.

## What is the 100.64.0.0/10 shared address space?

100.64.0.0/10 is the block of IPv4 addresses that RFC 6598, published by the IETF in April 2012, reserves for the link between a carrier's NAT and its subscribers. It runs from 100.64.0.0 to 100.127.255.255, is never routed on the public internet, and sits apart from the home and office private ranges, so a subscriber's own router never collides with the carrier's addressing.

According to Jade Proxies arithmetic on RFC 6598, the block holds 4,194,304 addresses. A /10 fixes the first 10 of the 32 bits of an IPv4 address and leaves 22 free: 2^(32 − 10) = 2^22 = 4,194,304. That is exactly 1/1,024 of the full IPv4 space of 4,294,967,296 (2^32) addresses.

| Range | Defined in | Addresses | Typical use |
|---|---|---|---|
| 10.0.0.0/8 | RFC 1918 | 16,777,216 | Company networks; some carriers also use it behind their NAT |
| 172.16.0.0/12 | RFC 1918 | 1,048,576 | Company and cloud networks |
| 192.168.0.0/16 | RFC 1918 | 65,536 | Home routers |
| 100.64.0.0/10 | RFC 6598 | 4,194,304 | Carrier-grade NAT (shared address space) |

## Why did carriers adopt CGNAT?

Carriers adopted CGNAT because IPv4 ran out: the protocol has only 4,294,967,296 addresses in total, part of them reserved, while mobile subscriptions number in the billions. Ericsson's Mobility Report of June 2026 counts about 3.3 billion 5G subscriptions alone.

The shortage hit Asia first. IANA handed its last free IPv4 blocks to the regional registries in February 2011, and APNIC, the registry for Asia and the Pacific, reached its final block in April 2011, ahead of every other region. From then on, a carrier adding subscribers in Asia had to share the addresses it already held through NAT, or buy blocks on the transfer market.

## Why are mobile IPs hard to block?

Mobile IPs are hard to block because one public address behind CGNAT represents many real subscribers at the same moment, so a ban on that address also locks out customers who did nothing wrong. A marketplace or social network that bans a Telkomsel or Jio address cuts off part of its own audience on that carrier.

Platforms therefore use finer tools than an IP ban:

- **Rate limits** per address, so one heavy user slows down while the others continue.
- **Challenges** such as CAPTCHAs or login confirmations, which a real phone user passes.
- **Account and device signals**, such as cookies, login history and app fingerprints, which follow the user rather than the address.

| IP type | Who is behind one public address | Cost of blocking it |
|---|---|---|
| Datacenter | One server or one customer | Low: few real visitors browse from hosting ranges |
| Residential | One household, unless the ISP also uses CGNAT | Moderate: one household is locked out |
| Mobile (CGNAT) | Many subscribers at the same time | High: real customers of that carrier are locked out |

## How does IPv6 change the picture?

IPv6 removes the need to share addresses: with 2^128 possible addresses, a mobile network gives each data connection its own /64 prefix, so a phone's IPv6 traffic is not pooled with other subscribers the way IPv4 traffic is behind CGNAT. Services that rate-limit IPv6 act on the whole /64 prefix rather than on one address, because a single subscriber controls all of it.

Many carriers run IPv6 and IPv4 side by side, and a phone uses IPv6 for sites that support it and CGNAT for the rest. The shared-address effect described on this page applies to IPv4 exits.

## What does CGNAT mean for proxy users?

For proxy users, CGNAT means a mobile exit IP is both shared and changeable: rotating a port asks the carrier for a new public address, and between rotations that address can carry ordinary subscribers' traffic too. Three practical consequences follow.

1. **Rotation changes the public IP.** After a rotation, the carrier maps the port's new connection to a new public address from its pool; each rotation reconnects the port to the carrier and usually takes 5–15 seconds. With Jade Proxies you get a new IP on demand by rotation link or API call, at most once every 30 seconds, or on an automatic timer from every 2 minutes to every 24 hours.
2. **The IP is sticky between rotations.** RFC 6888 asks carrier NATs to keep every connection of one subscriber on the same public address ("paired" pooling), so a session that keeps traffic flowing stays on one IP. After a long idle gap, the next connection can leave from a different address. The [rotating vs sticky guide](https://jadeproxies.com/rotating-vs-sticky-proxies/) covers how to plan session length.
3. **Reputation is shared.** A dedicated port means a dedicated modem, not an exclusive public IP. If another subscriber on the same address triggers CAPTCHAs, you see them too; a rotation moves you to a fresh address.

The [mobile proxy guide](https://jadeproxies.com/what-is-a-mobile-proxy/) explains how a port works end to end, and the [Asian mobile proxies](https://jadeproxies.com/asian-mobile-proxies/) page lists carriers and port prices from $3/day. For residential IPs, which sit behind home lines instead, see the [residential vs mobile comparison](https://jadeproxies.com/residential-vs-mobile-proxies-for-asia/).

## How can I tell if I am behind CGNAT?

You are behind CGNAT when the address your phone or router reports differs from the public address websites see, and the reported address falls in 100.64.0.0/10 or another private range. Four checks confirm it:

1. **Read the local address.** On a router, open the status page and note the WAN or internet IP. On an Android phone using mobile data, read the IP address under About phone → Status (the path varies by brand).
2. **Read the public address.** Open any "what is my IP" page from the same connection.
3. **Compare the two.** If they differ and the local one starts with 100.64 to 100.127, or with 10., the carrier is translating your traffic.
4. **Run a traceroute.** `tracert 1.1.1.1` on Windows or `traceroute 1.1.1.1` on macOS and Linux: hops in 100.64.0.0/10 near the start show the carrier's NAT layer.

## Frequently asked questions

### Is 100.64.0.0/10 a private IP range?

Not in the RFC 1918 sense. RFC 6598 calls it shared address space: it must not appear on the public internet, and it is meant for the link between carrier NATs and subscribers, not for home or office networks.

### Does every mobile carrier use CGNAT?

No public dataset gives the exact share of carriers using CGNAT. Any carrier with more active IPv4 subscribers than public IPv4 addresses has to share addresses, which makes NAT standard practice on mobile data networks.

### Can a website see my 100.64.x.x address?

No. The carrier's NAT replaces the private address before the packet leaves the carrier's network, so the website sees only the shared public address and a port number.

### Why can't I host a server behind CGNAT?

Inbound connections arrive at the shared public address, and the NAT has no mapping that sends them to your device. Hosting a game server or a camera feed behind CGNAT needs a public IP from the carrier or an outbound tunnel.

### Does a mobile proxy rotation give me a new CGNAT address?

Yes. A rotation reconnects the modem, and the carrier maps the new connection to a public address from its pool, usually a different one. At Jade Proxies, each rotation reconnects the port to the carrier and usually takes 5–15 seconds.