Am I behind CGNAT or Large-Scale NAT?

Find the problem

This arrangement travels under four names, and they all mean the same thing: CGNAT (Carrier-Grade NAT - the common name), Large-Scale NAT (LSN - the name engineering standards use), Service Provider NAT (SP NAT - the name providers and vendors use), and NAT444 (the technical name for the architecture: your traffic crosses two layers of address sharing, your own router's and the provider's, so three IPv4 realms in total). Whatever your provider calls it, the mechanism is one: many customers parked behind one shared public address, with a reserved middle range (100.64.0.0/10, so-called shared address space) glueing the layers together. Everything outward works normally; nothing inward can reach you directly - which is why port forwarding "doesn't work" and self-hosting fails. Two addresses compared honestly settle whether you are behind it.

1. Note your public address

Open Radien's status card, then Network Details: the Public IP row is how the internet sees you right now.

2. Find your router's own internet address

Open the router's settings page (see Can't open your router's settings page) and find the WAN or Internet address it reports.

The two addresses match: no provider NAT. Your router holds the real public address, and inbound things are between you and your router's settings.
They differ: your router sits behind another layer of the provider's network - CGNAT by whatever name your provider gives it.

3. Name the range

Paste the router's WAN address into Radien's IP Converter or Subnet Calculator. If it classifies as shared address space (100.64.0.0/10) the verdict is definite - that range exists only for the provider's middle layer. A private-range WAN address (10.x, 172.16-31.x, 192.168.x) tells the same story in older clothes.

4. Optional proof by symptom

If you have set up port forwarding and want to see the truth from outside: switch the phone to cellular data (off your own Wi-Fi), and run Port Scanner against the public IP you noted in step 1. Filtered or closed on the forwarded port, from outside, with the forward configured - that is provider NAT behaving exactly as designed.

What you now know

Whether a real public address is yours or shared - and the name for what you found, in all four dialects. If it is shared, nothing on your side is misconfigured: the provider's design does not allow inbound connections, and the conversation with them starts from facts: "my router's WAN address is in 100.64.0.0/10, so I am behind your CGNAT; I would like a public IP." Some providers sell exactly that.

Every check on this page runs free in Radien, entirely on your iPhone.