You forwarded the port. The rule is right, the service is listening, the firewall is open — and nothing outside can reach it. The usual reason is that the public address you think is yours belongs to your ISP, shared with hundreds of other customers, and no port on it was ever yours to forward. That is carrier-grade NAT. Below: how to prove it in about a minute, why the proof needs one number off your router, and what actually works once you know.
What carrier-grade NAT is
The world ran out of IPv4 addresses. Rather than buy more, most mobile networks and many fixed-line ISPs now put a second layer of NAT in their own core: your router gets an address from a reserved range, 100.64.0.0/10, and hundreds of customers share one real public address behind the carrier's equipment. Outgoing connections work perfectly — which is why most people never notice. Incoming connections have nowhere to land, because the public address is not yours and the carrier has no rule sending your ports to your router.
Why this test asks for a number instead of just telling you
The address that proves carrier NAT — the 100.64.x.xone — sits between your router and your ISP. Our server sees only the carrier's outside address, which looks like any other public IP. Your browser cannot see it either. So no website can detect this reliably on its own, whatever it claims: everything observable from outside is circumstantial.
One comparison settles it. Open your router's status page and read its WAN or Internet address. If that address matches the one this page shows, you hold a real public address and forwarding works. If it differs — especially if it starts with 100.64 through 100.127 — something else holds your public address, and your own router cannot forward a port it does not own.
Reading the result
A WAN address in 100.64.0.0/10 is carrier NAT, plainly. A private address there (10.x, 192.168.x, 172.16–31.x) means a second router or a modem still in router mode sits in front of yours — worth checking before you blame the ISP, because that one you can fix. A public address that differs from ours means something public is in front: a carrier NAT with a public pool, a VPN, or another router. Without the WAN address, this page can only report hints and says so.
What actually works once you know
Ask for a public IP. Many ISPs will move you off carrier NAT on request, sometimes free, often as a small monthly add-on. This is the cleanest fix and the one people skip.
Use IPv6. IPv6 addresses are plentiful enough that carriers rarely NAT them. If your ISP offers IPv6 and whatever you are connecting from supports it, the problem disappears — this page tells you which protocol your connection is using.
Tunnel out. A small server you control, or a service like a reverse tunnel, gives you a public endpoint that forwards back down a connection your router opened outward. Outward connections always work under carrier NAT, which is exactly why this approach does.
Once you are off carrier NAT, the open port checker will confirm a forwarded port is really reachable, and What Is My IP shows the address the internet sees for you.
Common questions
How do I know if I am behind CGNAT?
Open your router's status page and read its WAN or Internet address, then compare it with the public address this page shows. If they match, you hold a real public address and port forwarding works. If the router's address starts with 100.64 through 100.127, that is the range reserved for carrier NAT and you are behind it. No website can detect this on its own, because that address sits between your router and your ISP where nothing outside can see it.
Why can't I port forward even though the rule is correct?
Under carrier-grade NAT the public address is your ISP's, shared with many customers, and no port on it belongs to you. Forwarding a port on your own router is still correct and still useless, because traffic from the internet never reaches your router in the first place. Outgoing connections keep working normally, which is why the problem usually only shows up when you try to host something.
How do I get out of CGNAT?
Ask your ISP for a public or static IP — many will move you off carrier NAT, sometimes free and often as a small monthly add-on. Failing that, IPv6 is rarely carrier-NATed, so a service reachable over IPv6 sidesteps the problem entirely. The third option is a tunnel through a small server you control, which works because the connection is opened outward from your side.
Is CGNAT the same as double NAT?
They look identical from inside and the effect on port forwarding is the same, but the cause differs. Double NAT usually means your own modem is still in router mode in front of your router — that one you can fix yourself by switching it to bridge mode. Carrier NAT is your ISP's equipment and no setting on your own hardware changes it. If this test shows a private address like 192.168.x.x on your router's WAN side, check the modem first.
Does a VPN fix CGNAT?
Not by itself. A normal VPN gives you an address at the provider's end, and incoming ports there are not yours either. What does work is a VPN or tunnel service that explicitly offers port forwarding or a dedicated IP, because then a public endpoint forwards traffic back down the connection your router opened outward.
Also Check These Tools
🌐What Is My IPInstantly see your public IPv4 and/or IPv6 address with ISP, city, and country details.→📡What Is My ISPSee which Internet Service Provider (ISP) or organization is associated with your public IP and connection.→🔷What Is My DNSLook up public DNS A and AAAA records using Cloudflare DNS over HTTPS, with honest labeling about resolvers.→📶Ping & Latency TestMeasure HTTPS round-trip time from your browser to this site—a practical “ping” when ICMP is not available in the web sandbox.→🛜What Is My Network TypeDetect whether you are on Wi-Fi, cellular, or ethernet, with effective speed class and estimated bandwidth from the Network Information API.→🔐What Is My VPN / Am I Leaking?Compare your HTTP-visible public IP with WebRTC ICE reflexive addresses to spot possible IP leaks, plus plain-language DNS leak context.→⚡Internet Speed TestTest your download and upload speeds with a fast, accurate in-browser speed test.→🖥️What Is My BrowserDetect your browser name, version, engine, and operating system in one click.→🔍What Is My User AgentSee the full user agent string your browser sends to websites and servers.→🍪What Is My Cookie / Tracking StatusSee whether first-party cookies and web storage work, what DNT/GPC report, and visible cookie surface—plus honest limits for HttpOnly and cross-site tracking.→📐What Is My Screen ResolutionCheck your screen resolution, color depth, pixel ratio, and viewport size.→🎮What Is My WebGL / GPUDetect your GPU renderer, vendor, WebGL version, and key graphics capabilities directly from your browser — no plugins required.→📍What Is My LocationDiscover your approximate location based on your IP address including city and country.→🕐What Is My TimezoneFind your current timezone, UTC offset, and local time with DST status.→🎞️What Is My Refresh RateMeasure your monitor’s real refresh rate (Hz) live in the browser — see whether 60, 120, 144 or 240 Hz is actually active, with frame-time stability.→🔌Open Port CheckerCheck which TCP ports are open, closed, or filtered on your public IP address — no software needed.→🚦ISP Throttling TestCheck whether your ISP is slowing video: compares download speed to Netflix’s servers against generic servers and says whether it looks like shaping or congestion.→