How to tell if you're behind CGNAT
You've forwarded the port, the firewall's open and players outside your house still can't reach your server. Often it's CGNAT, your provider sharing one public address between many customers. Nothing on your own router can fix that. It takes two minutes to check.
What carrier grade NAT is
Port forwarding works when your router is the thing on the internet, so a player's connection to your public address reaches it and it passes them on to your PC. With carrier grade NAT, your provider puts its own router in front of yours and shares its address between many homes. A player's connection stops at the provider's router, which has no idea which home it's for. You can't forward a port on it.
It's normal on mobile broadband, 4G and 5G home internet and satellite. Some fibre providers do it too. Double NAT looks the same from outside: two routers in a row in your own house, often the provider's box with your own router plugged into it.
Checking
Open your router's admin page, often 192.168.1.1 or 192.168.0.1 (the address and password are usually on a sticker on the router). Find its status page and the WAN IP, Internet IP or public IP it shows.
Find the address the internet sees you as, by searching "what is my IP".
Compare the two.
| The router's WAN address | What it means |
|---|---|
| The same as your public IP | No CGNAT. Port forwarding can work, check the port and the PC's firewall again |
| 100.64.0.0 to 100.127.255.255 | CGNAT. That range is set aside for providers sharing addresses |
| 192.168.x.x, 10.x.x.x or 172.16.x.x to 172.31.x.x | Double NAT, another router sits in front of this one, usually in your house |
| Any other address that isn't your public IP | CGNAT, the provider translates between the two |
What works on CGNAT
- Ask your provider for a public IPv4 address. Some move you off CGNAT when asked, sometimes for a monthly fee. Mobile and satellite connections usually can't.
- Fix double NAT yourself. Put the provider's box in bridge or modem mode, or forward the port on both routers, the outer one to the inner one first.
- Use a relay. The NatchPlay agent on your PC makes an outgoing connection to a relay and players join the relay's address, so nothing has to come in through your router and CGNAT doesn't matter. Setting one up takes a few minutes. One relay is free for Minecraft Java or Rust.
Hosting on a phone's hotspot or a 4G or 5G router is CGNAT nearly every time. Players can still join through a relay, but every player's game traffic goes up your connection, so keep an eye on a capped data plan.
When it isn't CGNAT
If the WAN address matches your public IP, the port's forwarded, the PC's firewall lets the server through and players still time out, some providers block incoming connections anyway, often on student, shared housing and business lines. A relay gets round that too, since the connection starts from your PC.