Why you can't port forward on full fibre: CGNAT explained (and how to fix it)

You set up port forwarding exactly as you always have. The router accepts the rule, everything looks right, and yet nothing from outside your home can reach your server, your game host or your security camera. The fault is not your configuration. On most new full fibre connections, the way your internet provider hands out addresses has changed, and that change quietly disables inbound connections like the ones port forwarding relies on.

The culprit is CGNAT, and once you know it is there, the fix is usually simple: get a public IP address from your provider, or route around the problem with a tunnel.

What's actually happening when port forwarding fails

Port forwarding tells your router: when a connection arrives from the internet on a particular port, send it to a specific device on my home network. It only works if the wider internet can actually reach your router in the first place. That requires your router to have a public IP address, one that is unique and reachable from outside.

On a CGNAT connection, your router does not have its own public address. It shares one with a crowd of other customers. So when an outside connection tries to reach you, there is no clear path back to your particular router, and the connection never arrives. Your port forwarding rule is correct, but it is guarding a door that the outside world cannot find.

What CGNAT is (and how it differs from standard NAT)

Almost every home network already uses NAT, network address translation. Your router has one public IP, and all the devices behind it (phones, laptops, consoles) share that single address using private addresses like 192.168.x.x. The router keeps track of which device asked for what, and sends replies back to the right place. That is ordinary NAT, and it does not stop port forwarding, because you still own and control that one public address.

CGNAT, carrier-grade NAT, adds a second layer of translation higher up, inside your provider's network. Instead of giving each household a public IP, the provider pools many households behind a shared one. Your router gets an address from a private range, your provider's equipment translates it again, and only then does traffic reach the public internet.

So there are now two layers of translation between your device and the world. You control the first, in your own router. You do not control the second, and that is the one that matters for inbound connections.

Providers moved to CGNAT because the older IPv4 address system is running out. There are only about four billion IPv4 addresses, far fewer than the number of connected devices worldwide, and the free pool has long since dried up. Rather than buy scarce addresses for every customer, providers share them. That is the trade-off behind CGNAT: it stretches a limited supply of addresses, at the cost of easy inbound access.

Why CGNAT breaks port forwarding

Outbound connections still work fine. When you load a website or stream a film, your device starts the conversation, and the provider's equipment remembers to send the replies back to you. Everyday browsing, streaming and gaming as a client all keep working.

Inbound connections are the problem. When something outside tries to start a conversation with you (someone connecting to your game server, your remote desktop, your camera), the provider's shared equipment has no standing rule that says this traffic belongs to your router. With many homes behind one address, it cannot know which of you the connection is meant for. So it drops it. Port forwarding configures your own router perfectly, but the block sits one layer above, where you have no control.

How to check if you're behind CGNAT

There is a quick self-check that takes a minute and needs nothing special.

1. Log into your router's admin page and find its WAN IP address, sometimes labelled internet IP or external IP.
2. On a device connected to the same network, visit a site that shows your public address, such as whatismyip.com, and note the IP it reports.
3. Compare the two.

If the two addresses match, you have a normal public IP and port forwarding should work. If they are different, your traffic is being translated somewhere beyond your router, which points to CGNAT.

There is a stronger clue. CGNAT connections usually hand your router an address from a reserved shared range, 100.64.0.0/10. In plain terms, if your router's WAN IP starts with 100.64 through to 100.127, that address block is set aside specifically for carrier-grade NAT. Seeing an address in that range is close to a confirmation that you are behind CGNAT.

Which UK full fibre providers use CGNAT

CGNAT is now common on newer full fibre services, especially the altnets that built their networks recently and never had a large block of IPv4 addresses to hand out. Community Fibre is one clear example. Its current approach ties your type of address to your package: port forwarding works on certain higher-tier Premium packages where you are allocated a public IP, while customers who sign up or renew more recently are placed on CGNAT by default.

The pattern repeats across the market, so do not assume your provider is unusual. If you have a recently installed full fibre line and port forwarding has stopped working, run the self-check above rather than guessing.

Option 1: Ask your ISP for a public or static IP

The cleanest fix is to stop sharing an address. Ask your provider to move you off CGNAT and onto a public IP. Once you have your own public address, port forwarding behaves exactly as it did before.

How easy this is depends on the provider. Community Fibre, for instance, lets customers who are on CGNAT add a public IP for £4 per month by contacting its team. Others may bundle a public IP only with higher-speed or business tariffs. It is worth being clear and persistent when you ask, since front-line support does not always volunteer the option.

When you ask, be precise about what you want:

• A public IP gets you off CGNAT so inbound connections reach you. That alone is usually enough for port forwarding.
• A static IP also stays the same over time, which matters if you want to point a domain name at your home or avoid updating settings whenever the address changes.

If your use case is a home server or anything you reach by name from outside, a static public IP is the tidiest answer.

Option 2: Use a tunnel or relay with a static IP

If your provider will not budge, or you would rather not pay them, you can route around CGNAT entirely. The idea is to rent a small server elsewhere that does have a public IP, and have your home connection reach out to it. Because your home starts that connection outbound, CGNAT allows it. The rented server then acts as the public front door, forwarding incoming traffic down the tunnel to your home.

In practice this means a cheap virtual private server (a VPS) with a public, static IP, and a tunnel such as an SSH reverse tunnel or a mesh VPN running between the VPS and your home device. Outsiders connect to the VPS, and the VPS relays them to you. This works even on the strictest CGNAT, because nothing ever has to connect inbound to your router.

The trade-offs are cost and complexity. You pay a monthly VPS fee, you have another box to maintain, and all your traffic passes through it, so a cheap server with limited capacity can become a bottleneck for high-bandwidth uses. For a game server or a self-hosted site, it is a solid route. For bulk video from several cameras at once, watch the throughput.

Option 3: IPv6, VPNs and other workarounds

IPv6 is the long-term answer the older internet was always heading towards. There are so many IPv6 addresses that there is no need to share them, so providers that offer IPv6 can give every device its own reachable address with no CGNAT in the way. If your provider supports IPv6, you may be able to reach your home service over IPv6 directly, sidestepping the IPv4 shortage entirely. The catch is that both ends need working IPv6: the device you connect from has to support it too, which is not guaranteed on every network you might use.

A plain VPN can also help, but only the right kind. A commercial privacy VPN generally will not let you accept inbound connections, and some have dropped port forwarding features that once allowed it. What you want instead is a self-hosted or mesh VPN that links your remote device straight to your home network, so you reach your devices as if you were on the same LAN. That covers remote desktop and private access to home services neatly, though it does not expose a service to the general public.

Which option is right for your use case

• Gaming (hosting a server or peer-to-peer): a public IP from your provider is simplest. If that is not available, a VPS relay works. CGNAT can also cause strict NAT symptoms in some games, which a public IP resolves.
• Self-hosting a website or service for the public: you need something publicly reachable, so a static public IP or a VPS tunnel with a static IP. IPv6 helps if your visitors have it.
• CCTV and cameras: a public IP or a tunnel both work. Mind the bandwidth through a cheap VPS if you have several streams, and a mesh VPN is a safer, more private way to view footage yourself.
• Remote desktop and personal access: a mesh VPN is often the easiest and most secure option, and avoids exposing anything to the open internet at all.

FAQ

Why can't I port forward on my full fibre connection? Because you are almost certainly behind CGNAT. Your router shares a public IP with other customers, so inbound connections from the internet cannot find their way to your specific router, no matter how your forwarding rules are set.

What is CGNAT and why does my ISP use it? Carrier-grade NAT adds a layer of address translation inside the provider's network so many households can share one public IPv4 address. Providers use it because IPv4 addresses have run out and sharing them stretches a limited supply.

How do I know if I'm behind CGNAT? Compare your router's WAN IP with the public IP a site like whatismyip.com reports. If they differ, you are being translated beyond your router. An address starting 100.64 to 100.127 (the 100.64.0.0/10 range) all but confirms CGNAT.

Can I get a public IP from my ISP? Often yes, sometimes for a fee. Community Fibre, for example, adds a public IP for £4 per month on request. Other providers may include one only on higher-tier or business packages. Ask specifically for a public, and ideally static, IP.

Does CGNAT affect gaming and home servers? Yes. Playing online as a client still works, but hosting a server, running peer-to-peer features or accepting any inbound connection is blocked until you get a public IP or use a relay or tunnel.