Am I behind CGNAT?

A 2-minute check. You need your router's admin page.

Find your router's WAN (internet) IPv4 address. Log into your router (often 192.168.0.1, 192.168.1.1 or 10.0.0.1, or the ISP's app) and look for the WAN, Internet or Public IP status.
Find the address the internet sees. Your public IP as seen by this site: checking… (if this shows an IPv6 address, look up your IPv4 with a site like ifconfig.me using its IPv4 option.)
Compare.
- If the WAN address starts with 100.64. to 100.127., you are behind CGNAT.
- If the WAN address is private (10.x, 172.16–31.x, 192.168.x), your ISP's modem is probably routing in front of your router (double NAT). Try bridge or passthrough mode, then check again.
- If the WAN address matches the address the internet sees, you have a public IPv4 and port forwarding can work, unless the ISP blocks that port.
- If they differ and the WAN address is public, you may still be behind a carrier NAT; ask your ISP.
Test a port. Forward a port to a running service, then test it from outside your network (for example from your phone on mobile data, not on your Wi-Fi).

If you are behind CGNAT

Ask your ISP whether it offers a public IPv4 or CGNAT opt-out, and what it costs.
Use IPv6 if your ISP provides it and the people connecting to you have it too.
Use an outbound tunnel (for example Cloudflare Tunnel or Tailscale) or a small VPS as a relay.

Found something? Share your reading. It helps other people on your ISP.