Why 5G Home Internet Has No Static IP: CGNAT Explained

calendar Aug 15, 2026 / · 9 min read · cgnat static ip vpn remote access 5g home internet fixed wireless port forwarding self-hosting boulder  ·
Share on: linkedin copy

A remote worker who wires up a home security camera, assigns it a fixed local address, forwards port 8080 on the router, and then can't reach the camera from outside the house has just run into carrier-grade NAT — not a router misconfiguration. It's an easy thing to chase for an evening before realizing the router did everything right and the problem sits one layer further out, on the carrier's network. This explainer covers what carrier-grade NAT (CGNAT) actually is, why 5G home internet and satellite providers default to it, what it does and doesn't break for VPNs and remote access, and the workarounds people actually use to get around it.

What CGNAT Actually Is

Every home network already runs Network Address Translation. A router takes the private addresses your laptop, phone, and smart TV use internally — the familiar 192.168.x.x range — and translates all of that traffic to a single public IP address before it leaves the house. That public address is how the rest of the internet finds your household and sends replies back.

Carrier-grade NAT adds a second layer of the same trick, run by the internet provider instead of the home router. Instead of giving each subscriber a dedicated public IPv4 address, the carrier assigns the gateway an address from a shared, carrier-internal range — commonly drawn from the block set aside specifically for this purpose, 100.64.0.0/10, defined in RFC 6598 as shared address space for exactly this use — and then translates traffic from potentially thousands of subscribers onto a much smaller pool of real public IP addresses at the network edge. Your device does its own NAT to the gateway's shared address, and the carrier does another NAT from that shared address out to the real internet. Two translation layers stacked on top of each other, with the subscriber controlling only the first one.

Why 5G Home Internet and Satellite Plans Default to CGNAT

Fixed-wireless and satellite home internet grew fast on a finite resource: there are only so many public IPv4 addresses to go around, and handing every residential subscriber a dedicated one doesn't scale the way it did when broadband providers had smaller subscriber counts and more address space per customer to work with. CGNAT lets a carrier serve a large number of fixed-wireless households out of a comparatively small pool of public addresses, which is part of why it shows up by default across the category rather than as one provider's unusual choice.

That's the practical backdrop for services like T-Mobile Home Internet, Verizon 5G Home, AT&T Internet Air, and satellite services like Starlink — all of them are built to serve households at scale over shared network infrastructure, and CGNAT (or an equivalent shared-address setup on the satellite side) is the structural way that scaling happens. It isn't a defect in any one plan; it's a property of how the category is built.

T-Mobile Home Internet

5G home internet over T-Mobile's wireless network.

Visit T-Mobile Home Internet →

Both plans sell to Boulder addresses over the same kind of shared infrastructure, and neither hands a residential subscriber a public IPv4 address by default — so the choice between them turns on coverage and price at your specific address, not on whether CGNAT applies.

Verizon

5G and LTE home internet over Verizon's wireless network.

Visit Verizon →

The VPN Myth: Most Remote-Work VPN Connections Aren't Affected

This is the point that trips up the most people searching for what CGNAT breaks, and it's worth stating plainly before the list of things that actually do break: if your job requires connecting to a company VPN concentrator to reach internal systems, CGNAT almost certainly does not affect you.

The reason comes down to which direction the connection is initiated. When a laptop connects to an employer's VPN, the laptop is the one reaching out — it's an outbound connection, no different in principle from loading a web page or streaming a video. CGNAT only interferes with inbound connections, ones where something outside your home network needs to reach a specific device or port inside it without you initiating the contact first. A remote worker dialing into an office VPN, a commercial VPN app connecting to a provider's server, a cloud backup service, a video call — all outbound, all unaffected. The confusion happens because "VPN" covers both directions of the same technology, and only one of those directions runs into trouble on a CGNAT connection.

What Actually Breaks: Port Forwarding, Self-Hosting and Inbound Access

The things that do break all share the same shape: something outside the house needs to reach a specific device inside it, unprompted.

  • Port forwarding. Forwarding a port on the home router only controls the first NAT layer. The carrier's shared address is still standing between that forwarded port and the open internet, and there's no router setting that reaches past it.
  • Self-hosting a server. Running a personal website, a game server for friends, or a file server meant to be reached from outside the house requires exactly the inbound path CGNAT removes.
  • Home security camera and NVR systems that expect a direct connection. A camera system built to be reached by dialing straight into the home network — rather than by checking in with the manufacturer's own cloud service — runs into the same wall as any other self-hosted service.
  • Running your own VPN server at home. This is the flip side of the VPN myth above: if you set up a personal VPN server on your own router or a home device so you can dial into your house from a coffee shop, that server needs an inbound connection to reach it — and that's the direction CGNAT blocks.
  • Remote desktop into a home PC without a third-party relay in between, for the same reason.
  • Some multiplayer gaming and voice chat. Certain games and console platforms rely on a direct peer-to-peer connection between players rather than routing everything through a game server. CGNAT can push a connection into a stricter NAT classification, which shows up as matchmaking trouble, voice chat that won't connect peer-to-peer, or being placed in a more limited class of multiplayer session — even though ordinary streaming and browsing on the same connection look completely normal.

Workarounds: Mesh VPNs, Tunnels, and IPv6

None of the above is permanent or unfixable — it just requires flipping the direction of the connection instead of fighting the carrier's NAT layer directly.

Mesh/overlay VPN services like Tailscale and ZeroTier build a private network between your own devices, using NAT traversal techniques to punch through both NAT layers where possible, and falling back to a relay server when a direct path can't be established. From your side, this looks like installing an app on your home server and your laptop; the service handles finding a path between the two without requiring you to forward a port on either end.

Reverse-tunnel services like Cloudflare Tunnel and ngrok solve the problem by inverting it. Instead of waiting for an inbound connection to reach your home server, your server makes an outbound connection to the tunnel service, which then exposes it publicly on the tunnel provider's own address. Since the connection from your home network is outbound the whole time, CGNAT never gets a vote.

A rented cloud server (VPS) as a relay is the DIY version of the same idea: a small cloud server with a real public IP sits in between, and your home device connects out to it — via a reverse SSH tunnel or a WireGuard hub-and-spoke setup — so anything trying to reach your home service goes through the VPS's public address instead of trying to reach your CGNAT'd gateway directly.

IPv6 is worth checking before assuming none of this applies. Some fixed-wireless connections pair a CGNAT'd IPv4 address with a real, globally routable IPv6 address. Where that's the case, a device or service that supports IPv6 can sometimes be reached directly, sidestepping the whole CGNAT problem for that specific use case. It's worth checking the gateway's status page for a public IPv6 address before concluding that direct remote access is entirely out of reach.

When to Just Choose a Wired Connection Instead

For most households, none of this matters day to day — streaming, browsing, video calls, and cloud backups are all outbound-initiated and run identically whether the connection sits behind CGNAT or not. It matters specifically for people who want to self-host something, run a home security system that expects direct access, or operate a personal VPN server rather than just using one. If that describes your household and the workarounds above feel like more setup than you want to take on, it's worth checking whether a wired option is available at your address instead — cable and fiber providers have historically had more IPv4 address space per subscriber to work with and are more often willing to sell a static or public IP as an add-on than a fixed-wireless carrier is. Boulder and Boulder County addresses vary block by block on what's actually available, and the FCC's National Broadband Map is a reasonable place to check what wired technologies are reported at a specific address before assuming fixed wireless is the only option.

Bottom Line

CGNAT isn't a bug in any single 5G home internet plan — it's a structural consequence of serving large numbers of wireless subscribers out of a limited pool of public IPv4 addresses, and it shows up across the fixed-wireless and satellite category as a result. It has no effect on the things most households actually do online, and — despite the name overlap — it has no effect on the ordinary case of dialing into a work VPN, since that's an outbound connection. Where it does bite is the inbound case: port forwarding, self-hosted services, home security systems built to be reached directly, and running your own VPN server rather than just using one. For most of those situations, a mesh VPN, a reverse tunnel, or a small relay server closes the gap without requiring a different internet plan at all.

References

Posts in this series