As IPv4 addresses became increasingly scarce, ISPs needed a way to serve more customers than they had addresses for. Carrier-grade NAT, sometimes called CGN or CGNAT, is how many of them solved that problem.

To understand carrier-grade NAT, you first have to understand standard NAT, which stands for Network Address Translation. This technique allows a router to map multiple local IP addresses to a single public IP.  With standard NAT, your home router assigns private IP addresses to the devices on your network while sharing a single public IP with the outside world. 

Carrier-grade NAT adds a second layer of NAT on top of that first one. Your ISP assigns the same public IP address to multiple customers simultaneously, translating traffic behind the scenes to keep everyone’s connections separate.

For everyday internet browsers, there really isn’t any need to notice carrier-grade versus standard NAT. Pages load, videos play, and nothing seems different. However, noticeable complications tend to surface in specific situations: hosting a server, using certain gaming features, setting up remote access, or running applications that require a direct connection can all run into problems when carrier-grade NAT is in the picture.

NAT status also has implications for accountability. Because many users share a single IP, that address alone can’t identify a specific person or household. This is useful context when considering how IP-based location and IP reputation work in practice, since an IP flagged for suspicious activity might affect other customers sharing the same address.