Updated October 18, 2026: Added a WAN-versus-public-IP checklist and corrected the idea that every private WAN address proves ISP CGNAT.
To check for CGNAT, compare the internet/WAN IPv4 address shown by your router with the public IPv4 address visible to an internet service. A mismatch suggests another translation layer, but you must rule out your own upstream router, VPN or proxy before concluding that the ISP uses CGNAT.
Read the WAN address, not your computer’s LAN address
- Open your router’s official app or administration page using the method in its manual.
- Find the internet or WAN status page and record its IPv4 address privately.
- From a device on the same home connection, check the externally visible IPv4 address with a reputable IP-checking service.
- Compare them while a VPN or proxy is not changing the path, if it is appropriate for your connection to disable it temporarily.
An address such as 192.168.1.20 on your laptop only identifies it on the local network. It does not tell you whether the router has a public internet address.
Interpret the result
| Router WAN IPv4 | What to investigate |
|---|---|
| 100.64.0.0–100.127.255.255 | This is shared-address space reserved for uses including carrier-grade NAT. Confirm the ISP’s arrangement. |
| 10.x.x.x, 172.16.x.x–172.31.x.x, or 192.168.x.x | The WAN is private. An upstream home modem/router can cause this, as can an ISP network. |
| A globally routable address matching the external check | You appear to have direct public IPv4 at that router. A firewall or ISP policy may still restrict incoming traffic. |
| A different address without a clear explanation | Check VPNs, multi-WAN, upstream equipment and the ISP before changing port-forwarding rules. |
CGNAT and double NAT need different fixes
If your own modem/router sits in front of another router, the extra layer may be within your home. Supported bridge mode or an appropriate access-point arrangement can address that topology. It does not remove an ISP’s carrier-grade NAT. Features on a router such as the TUF-AX5400 cannot, by themselves, reconfigure the ISP’s upstream network.
Under CGNAT, forwarding a port on your own router generally cannot configure the ISP’s upstream translation. Ask the ISP whether a public IPv4 option is available and whether it is dynamic or static. A static address and a public address are different properties.
Check IPv6 separately
A connection can use CGNAT for IPv4 while providing IPv6. IPv6 reachability depends on the ISP, devices, application and firewall rules; it is not a reason to disable the firewall. Describe which protocol your remote-access application actually needs.
If your goal is a camera, NAS or game server, test from outside the home network. If you need it while away, also check which devices require the router to remain on. Share diagnostic screenshots only after removing addresses, account details and credentials that are not needed.
Images from the original article
These original illustrations are retained for reference. Product examples and software screens may show older versions; use the model-specific instructions above.
