CgNAT

❗Article Status Notice: This Article is a stub

---

This article is underdeveloped, and needs additional work to meet the wiki's Content Guidelines and be in line with our Mission Statement for comprehensive coverage of consumer protection issues. Learn more ▼

Issues may include:

• This article needs to be expanded to provide meaningful information
• This article requires additional verifiable evidence to demonstrate systemic impact
• More documentation is needed to establish how this reflects broader consumer protection concerns
• The connection between individual incidents and company-wide practices needs to be better established
• The article is simply too short, and lacks sufficient content

How you can help:

• Add documented examples with verifiable sources
• Provide evidence of similar incidents affecting other consumers
• Include relevant company policies or communications that demonstrate systemic practices
• Link to credible reporting that covers these issues
• Flesh out the article with relevant information

This notice will be removed once the article is sufficiently developed. Once you believe the article is ready to have its notice removed, please visit the Moderator's noticeboard, or the Discord (join here) and post to the #appeals channel, or mention its status on the article's talk page.

Carrier-Grade Network Address Translation (cgNAT, also known as LSN and NAT444) is used by Internet Service Providers (ISPs) to mitigate IPv4 address exhaustion by making thousands of customers share a single public IPv4 address.

Complaints from law enforcement agencies

Law enforcement agencies find it harder to identify criminals behind an IPv4 address used by thousands of people. As a result the agency may have to tap connections of all users sharing that address to identify the criminal.

A 2016 survey conducted by the European Cybercrime Centre revealed that 90% of EU Member State cyber divisions regularly encountered errors related to CGNAT technologies during investigations, sometimes forcing them to discontinue cases or employ more resource-intensive approaches.

The process of reverse-tracking from cgNAT logs is fundamentally flawed. In criminal cases where cgNAT logs are used as primary evidence, there exists significant potential for misidentification, as the same public IP address and port combination might be reassigned to different users within a very short time.

Security concerns

If a malicious actor using a cgNAT IP address gets blacklisted by a server/website then all users sharing the same cgNAT IP will also get blacklisted.

A DDoS attack targeted at one user behind a cgNAT IP address affects all users behind that address, which can disrupt service for entire neighborhoods.

Service limitations

Because multiple people share the same public IP address, they are unreachable from the internet. This prevents them from hosting personal websites or having remote access to home security cameras or personal computers. cgNAT basically breaks all protocols that require direct connection to work.

To circumvent these limitations, ISPs typically offer subscriptions for dedicated IPv4 addresses or IPv6 tunnels.