CGNAT Explained: Is Your Fibre Line Behind One?

CGNAT is a public IPv4 address your provider shares between several subscribers: you browse without trouble, but nobody can reach you from outside. To find out whether your fibre line depends on it, compare the address your router shows with the one the internet sees. They differ? You are almost certainly behind a CGNAT.

What is CGNAT, exactly?

CGNAT stands for Carrier-Grade NAT, a provider-level NAT. Your router already performs NAT: it tucks all your devices behind a single address. With CGNAT, the provider adds a second layer upstream and tucks several households behind one public address. For that link, the IETF reserved a special block, 100.64.0.0/10, described in RFC 6598 in April 2012: it numbers the link between the provider's equipment and your box.

Connections that start from your home go through. Those arriving uninvited stop at the provider's level, which does not know which subscriber to hand them to.

Why do providers share their IPv4 addresses?

The stock is empty. In its October 2023 IPv6 status update, Proximus says its last IPv4 block from RIPE (the European address registry) dates from 2012, and that it has applied CGN on its mobile internet for years, up to 16 subscribers per address. For residential fixed lines, the document says nothing.

Sharing costs ports. One IPv4 address offers 64,512 usable ports (1,024 to 65,535); the more subscribers share it, the fewer each keeps for simultaneous connections.

Author's calculation over 64,512 ports, as of 12 October 2026; the actual split is up to each provider. A 2016 exchange on the RIPE mailing list mentions a Belgian agreement that would cap sharing at 16 subscribers per address. I could not find the text, so I treat it as a rumour.

How do you know whether your fibre line is behind a CGNAT?

The check takes five minutes and needs no tools.

1. Open your router's interface and note the IPv4 "WAN" or "Internet" address.
2. On any device on the network, search "what is my IP address": the site shows the public address seen from outside.
3. Compare the two addresses using the table below.
4. If a personal router sits behind the box, repeat the check on the box itself, or put it in bridge mode before concluding.

A failed port forward proves nothing on its own: a firewall or the wrong target device gives the same symptom.

Which uses does CGNAT break?

Browsing, streaming and video calls notice nothing, because the connection starts from your home. The problem appears as soon as something must be able to reach you from outside, or when the address you borrow has a bad reputation.

• Remote access to a NAS, a camera or an alarm, without going through the manufacturer's cloud.
• Home hosting: a game server, a website, exposed home automation.
• Inbound VPN to your home network.
• The console NAT type, stuck on strict: see our article on strict, moderate and open NAT.
• The address's reputation, which another subscriber can damage: repeated captchas, even a refusal from a site.

Who uses CGNAT in Belgium?

No official Belgian provider page consulted on 12 October 2026 describes its policy for residential fixed lines. The public traces fit in a few lines.

Our article on console NAT judged CGNAT rare on Belgian fixed lines. These testimonies show it exists at least at Orange Belgium and is sometimes fixed with a simple call. They are isolated cases, not a statistic.

The region does not decide, the provider does. In Flanders you mostly choose between Proximus (partner builder Fiberklaar) and Telenet (Wyre fibre network); in Wallonia, between Proximus (Unifiber) and the VOO or Orange cable; in Brussels, among all four. With fibre available at about 78% in Brussels, 71% in Flanders and 44% in Wallonia in mid-2026 (figures keep moving), the address you are given depends first on which provider your street lets you sign up with.

How do you get out of CGNAT?

Here are the options, from the simplest to the most technical.

1. Ask support for a dedicated IPv4 address. This is the route in both testimonies found. Ask the price and the condition before saying yes.
2. Use IPv6. Every device gets a public address. Check that your router hands out IPv6, then add a rule allowing inbound traffic to the target device: the firewall forbids it by default.
3. Work around it with an outbound tunnel. A service such as Tailscale or Cloudflare Tunnel opens the connection from your home outward, so CGNAT does not stop it.
4. Change plan. If remote access is essential, compare the providers at your address with our ranking of the best fibre internet plans.

The double NAT trap

A false CGNAT costs an hour of support for nothing. Before calling, unplug the personal router, connect a computer straight to the box and read the box's WAN address again. If it is public, the problem is at home. Proximus also documents port forwarding on its b-box and Internet Box, proof that the feature is meant for subscribers.

To understand where the fibre stops at your home, read FTTH, FTTB and FTTC; for the wall socket's role, the ONT box.