CGNAT

CGNAT (Carrier-Grade NAT) is how ISPs cope with IPv4 address exhaustion. Instead of a public address, subscribers receive an address from the 100.64.0.0/10 shared address space reserved for this purpose by RFC 6598. Traffic is translated to public IPv4 addresses on the BNG or on a dedicated CGNAT appliance. Because the subscriber's own router also performs NAT, the design is often called NAT444. Core requirements for carrier-grade NAT are set out in RFC 6888.

The roughly 64,000 usable ports of each public address are shared among subscribers. With dynamic allocation every connection is logged individually. Port block allocation (PBA) hands each subscriber a block of, say, 1,024 ports and cuts log volume considerably. Deterministic NAT pre-computes a fixed mapping between an inside address and a public address/port range. When choosing a sharing ratio (for example 1:16 or 1:32), per-subscriber concurrent connection needs and the application mix must be considered.

A subscriber behind CGNAT cannot be reached directly from the internet, so port forwarding, home servers, IP cameras, some games and peer-to-peer applications may break. Operators therefore commonly keep a separate pool for customers who need a static public IP. The long-term answer is IPv6, but during the transition CGNAT is unavoidable for most ISPs.

Legally, the main issue is record-keeping. Hundreds of subscribers can use the same public IP at the same moment. Identifying who generated a given flow requires NAT logs containing public IP, port range, inside IP and time. These logs must be stored with accurate clock synchronisation and protected integrity. They are typically shipped via syslog to a central log management system.