My new ISP threw me behind CGNAT

Moving to a new house is great! It’s a fresh start: new neighbours, a chance to declutter, and (best of all) a new ISP!

After careful consideration and recommendations from friends/colleagues, I decided to switch to Superloop. At first, Superloop seemed like the clear winner, they had so much going for them:

• Much cheaper options than Optus
• Bring my own router (to be fair, Optus also allowed this.. but I was stuck paying off their router)
• Better customer support
• No lock-in

I thought it was a clean sweep until I started plugging my homelab back in. Only half my services came back online. The rest were supposedly up, however unreachable.

The clue hit me when I figured out all the services I have tunnelled via Tailscale or Cloudflare Tunnels was functional, but anything done via hard and dirty reverse-proxy port-forwarding was unreachable.

My first sanity check was to compare my public IP with my router WAN IP. I grabbed my public IP from a desktop on the network with:

However, when I checked the IP the router was getting (sanity check) it showed 100.x.x.x, very strange…
This is how I learned about Carrier Grade Network Address Translation (CGNAT).

Along with the usual private address spaces preserved for internal routing:

• 192.168.0.0/16 – The one you’ve most likely seen everywhere, for home/small offices
• 172.16.0.0/12 – Medium sized, for branch offices/segmentation
• 10.0.0.0/8 – The largest one, used in huge networks, enterprise and the like

Turns out there’s another far less notable special address space, allocated entirely for CGNAT:

• 100.64.0.0/10 – Sits between medium and large – shouldn’t be used privately as you may collide with someone!

CGNAT works almost the same as your usual NAT on a home router, however it’s run by the ISP instead. Rather than your router owning a public IPv4 address, it’s assigned an address within the 100.64.0.0/10 space and the IPS performs another layer of NAT before any traffic actually hits the wider web.

So if your WAN IP sits anywhere within 100.64.0.1 -> 100.127.255.254 (which mine was) then you’re stuck inside their CGNAT.
This is why all of my requests on my “public IP” were returning nothing, they were never reaching my home router.

So I went online to see if I could just disable it from my Superloop online dashboard. Couldn’t find anything. I then went online searching for if anyone had found a way when I came across this thread. Turns out they’ve disabled Dynamic IPs?? Absolutely unbelievable I didn’t check for this before switching to them. I went immediately into their chatroom to ask if I could opt-out of their CGNAT but I was hit with:

As company policy we do not offer Dynamic IPs anymore. If you would like a Static IP we can provide one for $5 a month.

Paying for a static IP is NOT what I need and I’d already found a way around it with a Dynamic DNS (DDNS) service. My colleagues who were with Superloop told me they were able to opt-out totally fine. It wasn’t until I mentioned I was likely to switch providers that I got this:

After that the internet went out for around 1 minute then came back up. My router now showed it connected to 202.x.x.x (genuine public IP) and my DDNS service picked up the change.

Everything working as intended! Website is back up and the world is at peace again.