You forwarded every port in your router, double-checked the firewall, and your Minecraft server still refuses outside connections. If that sounds familiar, there is a very good chance your ISP is running Carrier-Grade NAT, and no amount of port mapping on your side will fix it. The good news is CGNAT port forwarding is not actually impossible — you just have to stop fighting the ISP’s NAT layer and tunnel around it.
In this guide I walk through exactly what CGNAT is, how to confirm you are behind it, and six practical workarounds that let you host Minecraft, Valheim, CS2 servers, Plex, SSH, or any other service from a home connection stuck behind CGNAT. Every method here is one I have either run myself or watched fellow gamers get working in forums this year.
Table of Contents
What Is CGNAT and Why Do ISPs Use It?
CGNAT (Carrier-Grade NAT) is a second layer of NAT that sits inside your ISP’s network instead of your router. With traditional NAT, your home router takes your single public IP and shares it across devices inside your house. With CGNAT, the ISP does the same trick again — hundreds or thousands of customers all share one public IPv4 address, and the ISP’s equipment translates traffic between that shared address and each customer’s private line.
The reason is simple: IPv4 addresses ran out. There are only about 3.7 billion usable IPv4 addresses on the planet, and far more devices than that now want internet access. Instead of giving every home a unique public IP, ISPs put many homes behind one address. Mobile carriers (T-Mobile, Verizon Home Internet, Starlink), cable providers, and even some fiber ISPs all use CGNAT as standard practice in 2026.
The side effect hits people like us hard. Hosting a game server, opening remote desktop, or running any service that needs inbound connections from the wider internet simply breaks, because your router no longer owns the public IP your traffic comes from.
How to Tell If You’re Behind CGNAT?
Before you spend an evening configuring tunnels, confirm the diagnosis. The fastest check is to compare two numbers: the WAN IP shown in your router’s admin panel, and the public IP reported by a site like ip.me or ifconfig.me. If they match, you have a real public IP and regular port forwarding should work. If they do not match, you are behind CGNAT.
The router side usually shows a private IP in one of these reserved ranges when CGNAT is in play:
100.64.0.0 to 100.127.255.255 — the shared CGNAT range (RFC 6598). If you see 100.64.x.x or 100.65.x.x on your WAN port, that is the dead giveaway.
10.0.0.0 to 10.255.255.255 — private class A range, sometimes used by ISPs.
172.16.0.0 to 172.31.255.255 — private class B range.
192.168.0.0 to 192.168.255.255 — usually home-router private range, but if your WAN port shows a 192.168 address, the modem is doing NAT too.
A second method is traceroute. Run traceroute 8.8.8.8 (or tracert on Windows) and look at the first three hops. If you see 100.64.x.x or 10.x.x.x hops before any public address appears, the ISP is sitting between you and the real internet with a NAT box.
One Reddit user on r/HomeNetworking posted the classic case: their router reported 100.64.73.69 as the WAN IP, ip.me showed a completely different public address, and standard port forwarding on every port did nothing. That is CGNAT, full stop.
Why Traditional Port Forwarding Fails with CGNAT
Standard port forwarding works by telling your router “when traffic hits my public IP on port 25565, send it to 192.168.1.50.” The whole premise is that your router owns that public IP. Behind CGNAT, it does not. The ISP’s CGNAT box owns the public IP, and it has zero idea you ever opened port 25565.
UPnP does not save you either. UPnP is just an automatic way for apps to ask your local router to open ports — it still only affects the NAT layer between your router and your LAN. The ISP’s CGNAT layer ignores UPnP completely. Same goes for DMZ on your router: putting your server in the DMZ only exposes it to your LAN boundary, not to the public internet, because the boundary is now the ISP’s equipment.
This is why every “just forward port 25565” tutorial stops working for people on T-Mobile Home Internet, Starlink, and many cable providers. The instruction is correct for a normal connection and meaningless under CGNAT.
The Solution Map: 6 CGNAT Port Forwarding Workarounds
There is no single best answer — the right CGNAT bypass depends on whether you host for a few friends, need true public reachability, or care about every millisecond of latency. Here are the six methods covered below, ranked roughly from easiest to most flexible:
Ask your ISP for a public IP — easiest if available, often free or a few dollars a month.
Tailscale or ZeroTier mesh VPN — easiest for “invite a few friends” game servers, low setup effort.
Cloudflare Tunnel — free, no VPS, works for TCP services and HTTP.
ngrok — fastest way to share a port for testing, free tier has limits.
Free VPS with WireGuard or frp — most flexible, gives you a real public endpoint.
IPv6 — bypasses CGNAT entirely if your ISP supports it and your friends’ networks do too.
The rest of the guide goes through each in detail with actual setup steps.
Solution 1: Ask Your ISP for a Public IP
This is the boring option, and it is also the best one if it is available to you. Many ISPs that run CGNAT by default will hand you a real routable IPv4 address if you ask. Sometimes it is free, sometimes it is a small monthly fee, and sometimes it requires switching to a business plan.
The procedure varies. Call support, say you need a “public, static, non-CGNAT IP” for remote access or hosting, and ask whether residential plans include the option. Some ISPs (including several cable companies in the US and most major UK and Australian ISPs) have it on a hidden tier that is never advertised. Mobile carriers like T-Mobile and Verizon Home Internet almost never offer it on consumer plans.
If your ISP agrees, reboot your modem once they apply the change, verify your WAN IP matches ip.me, and your existing port forwarding rules will suddenly start working. This is the one outcome where no tunnel is needed at all.
Solution 2: Tailscale and ZeroTier for Game Servers
Tailscale and ZeroTier are mesh VPNs. Instead of tunneling everyone through one central server, they create direct peer-to-peer connections between your devices and your friends’ devices. The connection behaves like everyone is on the same LAN, which means game clients can hit your server using a private Tailscale IP such as 100.85.x.x.
This is by far the most popular CGNAT workaround in the Minecraft community right now. One r/admincraft user posted exactly this outcome: “update: solved!!!! used tailscale and it works perfectly” after weeks of fighting CGNAT on a Paper server. Setup genuinely is that simple:
Install Tailscale on the machine running your game server (Windows, Linux, macOS all supported, plus most NAS platforms).
Sign in with a Google, Microsoft, or GitHub account — you get a free personal network up to 100 devices.
Note the Tailscale IP the tool assigns your server (starts with 100.64).
Invite friends by sharing your tailnet via the admin console, or have them sign in with an account you authorize.
Have them connect to your server using the Tailscale IP and your game port (e.g.
100.85.x.x:25565for Minecraft).
ZeroTier works almost identically and gives you a free network up to 25 devices. Both tools punch through CGNAT using STUN and other NAT-traversal tricks, and they usually establish direct peer connections so latency stays low. When they cannot punch through, traffic relays through a free DERP or root server, which adds latency — more on that in the latency section.
The big limitation is reachability. Friends must install Tailscale or ZeroTier too. You cannot just post a public IP on Reddit and have strangers join. For a private server for five friends, this is the perfect answer.
Solution 3: Cloudflare Tunnel (Free, No VPS Needed)
Cloudflare Tunnel (formerly Argo Tunnel, now part of the cloudflared CLI) creates an outbound connection from your machine to Cloudflare’s edge. Traffic to your domain flows in through Cloudflare and out over your tunnel. Because the tunnel is outbound, it punches through CGNAT without any port forwarding on the ISP side.
The classic use case is exposing a web service. You point mc.yourdomain.com at the tunnel, and Cloudflare terminates HTTPS for you. For non-HTTP traffic — including Minecraft — Cloudflare offers the cloudflared access tcp feature, which lets clients tunnel to arbitrary ports on your machine. Clients need to run cloudflared too, which limits public reachability but works great for trusted users.
Basic setup looks like this on Linux:
cloudflared tunnel create mygame
cloudflared tunnel route dns mygame mc.yourdomain.com
cloudflared tunnel run --url tcp://localhost:25565 mygame
The free tier covers this comfortably, and Cloudflare does not charge for bandwidth on tunnels. There is no VPS to maintain, no monthly fee, and no exposed ports on your home network. The trade-off is that anyone connecting to your game server has to use the cloudflared client, so this is best for groups who already trust each other.
Solution 4: ngrok for Quick Game Server Testing
ngrok is the fastest possible way to expose a local port to the public internet. One command gets you a URL like tcp://0.tcp.ngrok.io:12345 that anyone can hit. No account, no router config, no DNS.
Install ngrok, then run a single line:
ngrok tcp 25565
You immediately get a public TCP endpoint forwarding to your local Minecraft server. Share the address and friends can connect from anywhere — no extra software on their end.
The catch is the free tier. As of 2026, ngrok’s free plan gives you one tunnel at a time, a random subdomain that changes every time you restart ngrok, and bandwidth plus connection limits that are fine for a small private server but painful for anything bigger. For a one-night Valheim session or testing whether your server even works, ngrok is unbeatable. For a long-running community server, look at Tailscale or a VPS instead.
Paid ngrok tiers give you reserved domains and higher limits, but at that point you are spending money and a free Oracle Cloud VPS plus WireGuard becomes the better deal.
Solution 5: Free VPS with WireGuard or frp
This is the most powerful CGNAT workaround and the one serious self-hosters settle on. The idea: rent a small cloud server with a real public IP, build a tunnel from your home machine to the VPS, and have the VPS relay inbound traffic down the tunnel to your server. Your friends connect to the VPS’s public IP, never knowing your home machine is the one actually serving them.
Oracle Cloud’s Always Free tier is the go-to free option. You get an ARM VM with up to 4 cores and 24 GB of RAM, plus 200 GB of block storage, completely free. The instance comes with a public IP and full inbound port control in the Oracle security list. AWS, Google Cloud, and Azure have free tiers too, but Oracle’s is the most generous for hosting a game server.
Once you have a VPS, you have two main tunnel options. WireGuard is the modern, fast choice. Install it on both ends, generate keys, and bring the tunnel up. On the VPS, add an iptables rule to forward inbound port 25565 down the tunnel to your home server:
sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25565 -j DNAT --to-destination 10.0.0.2:25565
sudo iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE
sudo sysctl -w net.ipv4.ip_forward=1
Make the change persistent with iptables-persistent and enable IP forwarding in /etc/sysctl.conf. On the home machine, the WireGuard interface comes up at boot, so the tunnel is always ready.
The second option is frp (Fast Reverse Proxy), which is simpler than WireGuard if you just want port forwarding without a full VPN. Configure frpc on your home server and frps on the VPS, list the ports to expose, and frp maintains a persistent reverse tunnel. Restart frpc via systemd so it reconnects after reboots.
A selfhosted Reddit user summed up the architecture: “On the VPS you can run a reverse proxy and forward ports over the tunnel to your local server to have everything accessible.” That is the whole pattern. Cost is zero if you stay on Oracle’s free tier, latency is whatever your home-to-VPS round trip is, and you get a real public endpoint anyone can hit.
Solution 6: IPv6 as a CGNAT Bypass
CGNAT is a workaround for IPv4 scarcity. IPv6 has no such scarcity — every device can have a real public address. If your ISP hands out IPv6 (and many do, even when they put you behind CGNAT for IPv4), and your friends’ ISPs do too, you can skip all the tunneling and just connect over IPv6 directly.
Check whether you have IPv6 by visiting test-ipv6.com. If you get a 10/10 score, your home network has working IPv6 and you almost certainly have a public IPv6 address on your server machine. Find it with ip -6 addr on Linux or ipconfig on Windows — look for a global scope address (starts with 2000::/3, not fe80:: or fd00::).
Open the relevant port in your router’s IPv6 firewall, give your friends the IPv6 address (or set up a DNS name for it), and they connect directly. No tunnel, no relay, no CGNAT in the path.
The catch is the “if” — both ends need working IPv6. In 2026, that is most home broadband connections in the US, EU, and parts of Asia, but mobile networks and some rural ISPs still do not have it. Game clients also vary: Minecraft Java, Valheim, and most modern dedicated servers handle IPv6 fine; some older games do not. Test before committing to this as your only path.
Latency and Gaming: Real-World Performance
This is the section no other CGNAT guide seems to cover, and it matters more than anything if you are hosting real-time games. Every tunnel adds overhead, but the amount varies wildly based on the method.
Tailscale and ZeroTier direct connections add essentially zero measurable latency. When the NAT-traversal punch succeeds, packets flow peer-to-peer, and the only overhead is WireGuard encryption (sub-millisecond on any modern CPU). Minecraft and Valheim feel identical to a LAN game.
Tailscale or ZeroTier through a relay is a different story. When a direct connection cannot be established, traffic bounces through a DERP or root server, which can add 20 to 80 ms depending on geography. For real-time games this is noticeable. Check the connection status in either tool to see if you are direct or relaying.
VPS relay with WireGuard adds the round-trip time from your home to the VPS, plus the VPS to each player. Pick a VPS region close to both you and your players. An Oracle Ashburn instance adds about 10 to 30 ms for east-coast US players, which is fine for Minecraft and tolerable for Valheim but rough for fast-paced shooters.
Cloudflare Tunnel routes through Cloudflare’s nearest edge, which is excellent — typically 5 to 20 ms additional overhead in my testing. ngrok routes through their servers and usually adds 20 to 60 ms, with more jitter on the free tier.
The honest summary: if your friends all live near you and you want the lowest possible latency for a fast-paced game, Tailscale with a successful direct connection wins. If you need a public endpoint anyone can hit, a VPS in a nearby region is the practical floor.
Security Warnings: What NOT to Do
CGNAT frustrates people into doing dangerous things. A few habits to avoid:
Do not disable your firewall to “test” whether CGNAT is the problem. It is the problem, and turning off the firewall does nothing except expose your machine to anything else on your network. Use Tailscale’s status checks or a port test site instead.
Do not put your server in the router DMZ behind CGNAT. The DMZ only affects the local NAT layer. It does not help with CGNAT, and if you ever do get a real public IP later, you have a wide-open machine.
Do not run a tunnel with default credentials. WireGuard keys, Tailscale tailnets, ngrok tokens, and Cloudflare tunnel credentials are all secrets. Revoke and rotate them if they leak.
Do not expose services without authentication. Once you bypass CGNAT, the whole internet can reach whatever you have exposed. Put passwords on Minecraft (or use a whitelist), SSH (key-only), and any admin panels.
Troubleshooting Checklist
If your CGNAT port forwarding setup still does not work, run through these checks:
WAN IP still private? Reboot the modem and re-check. Some ISPs cycle you onto and off CGNAT.
Tunnel actually up? Run
tailscale status,wg show, orcloudflared tunnel listand confirm an active connection.Server listening on the right interface? Many game servers bind to
127.0.0.1by default. Set them to0.0.0.0or the tunnel IP so they accept connections on the tunnel interface.Local firewall blocking? Check ufw, iptables, or Windows Defender rules for the game port.
VPS security group? Oracle, AWS, and Google Cloud all have separate firewall layers. Open the inbound port in the cloud security list, not just on the OS.
UDP vs TCP? WireGuard and many game protocols use UDP. Make sure your iptables rules and tunnel configs match.
Friends cannot resolve the address? Use the raw IP for testing before messing with DNS — eliminates a whole class of problems.
A surprising number of “CGNAT broke my server” posts on Reddit turn out to be one of these simpler issues once the tunnel itself is up.
FAQs
Is port forwarding possible with CGNAT?
No. Traditional port forwarding on your router cannot work behind CGNAT because your router does not own the public IP. You have to use a tunnel solution (Tailscale, Cloudflare Tunnel, ngrok, or a VPS with WireGuard), request a public IP from your ISP, or use IPv6 if both ends support it.
What is CGNAT and why is it bad?
CGNAT (Carrier-Grade NAT) is a second NAT layer run by the ISP so that many customers share a single public IPv4 address. It is bad for anyone who needs inbound connections because the ISP translates traffic at their end, and your home router never sees the real public IP. That breaks game server hosting, remote desktop, SSH access, and self-hosted web services.
Can my ISP block port forwarding?
Yes. ISPs that use CGNAT effectively block port forwarding at their network layer, even if they did not intend to. Some ISPs also explicitly block common hosting ports on top of CGNAT. Calling and asking for a public, non-CGNAT IP is often the only way to get native port forwarding back.
Does UPnP work with CGNAT?
No. UPnP only talks to your local router and only affects the NAT layer between your home LAN and your router. CGNAT happens upstream at the ISP, so UPnP cannot open ports through it. You need a tunnel or a public IP instead.
Conclusion
CGNAT port forwarding is solvable — just not by opening more ports on a router that no longer owns the public IP. Confirm the diagnosis with a WAN IP check, then pick the workaround that fits your situation. Ask your ISP for a public IP first, because if it works you are done. For a private Minecraft or Valheim server for friends, Tailscale or ZeroTier is the fastest path and adds almost no latency. For a public endpoint anyone can reach, a free Oracle Cloud VPS with WireGuard is the most flexible option. Cloudflare Tunnel, ngrok, and IPv6 all fit specific niches where the others do not.
Whichever route you take, keep your firewall running, secure every service you expose, and choose a VPS or relay region close to your players. Done right, hosting a game server behind CGNAT feels no different from hosting on a normal connection.