Do port forwarding and remote access ring a bell by chance? Hosting your own website?
Some Starlink customers complain about CGNAT
If you have been using Starlink for a while, you may have noticed something odd when you check your network settings. The IP address your router receives from Starlink does not look like a normal public internet address. It likely starts with 100.64 — a range that means your connection is sitting behind something called CGNAT. This article explains what that is, why Starlink uses it, and what it means for you as a subscriber.
What Is an IP Address?
Before we get to CGNAT specifically, a quick refresher. Every device that connects to the internet needs an IP address — a numerical label that identifies it on the network, similar to a postal address for your home. When you visit a website, your router sends a request to that site using your IP address, and the site sends the data back to the same address.
For most of the internet’s history, ISPs assigned each customer what is called a public IP address — one that is globally unique and reachable from anywhere on the internet. This worked fine for years.
The problem is that public IP addresses are running out
The system most of the internet still relies on is called IPv4. It has a theoretical maximum of just over four billion unique addresses. That sounds like a lot, but with billions of smartphones, computers, smart TVs, and internet-connected devices in use around the world, those addresses are exhausted. Engineers have been managing this scarcity for years using various techniques, and CGNAT is one of the most widely deployed.
What Is CGNAT?
CGNAT stands for Carrier-Grade Network Address Translation. It is a method ISPs use to allow many customers to share a single public IP address simultaneously.
Here is a simple way to think about it. Imagine a large apartment building. The building has one street address, but dozens of families live inside it. When a delivery arrives addressed to that building, the front desk has to figure out which apartment it belongs to — because the outside world only knows the building’s address, not each individual apartment number.
CGNAT works the same way. Starlink’s network acts as that front desk. You and potentially hundreds of other Starlink subscribers share one public IP address. Your router is assigned a private address in the 100.64.x.x range — a block reserved specifically for ISP-level CGNAT — and Starlink’s systems handle translating your traffic to and from the shared public address.
For ordinary browsing, streaming, and downloading, you will never notice this at all. Your requests go out, the responses come back, and everything works as expected. The translation happens invisibly behind the scenes.
Why Does Starlink Use It?
Starlink now serves tens of millions of subscribers worldwide. Assigning each of those customers a unique public IPv4 address would require an enormous pool of addresses that simply does not exist in adequate supply. CGNAT is the practical solution: it lets Starlink scale to a massive subscriber base without exhausting IP address resources.
It is worth noting that Starlink could have chosen to issue each customer a dynamic public IP — one that changes periodically but is still globally routable. Many traditional ISPs do this. Starlink instead opted for CGNAT, which is more efficient at scale but comes with trade-offs.
What Does CGNAT Mean for You in Practice?
For the vast majority of Starlink users — people who browse the web, watch streaming services, video call family, and play online games as a client — CGNAT has no practical impact whatsoever. Your connection works normally.
The limitations show up when you want to do something that requires the internet to reach your home network, rather than the other way around.
The most common situation people run into is port forwarding. With a standard public IP, you can configure your router to forward incoming traffic on a specific port to a device inside your home — for example, to access a home security camera remotely, run a game server for friends to join, self-host a website, or connect to a home NAS from outside. With CGNAT, that is not possible. Because your router does not have a unique public address, there is no way for Starlink’s gateway to know that an incoming connection is intended for you rather than one of the hundreds of other subscribers sharing that same public IP.
Other things CGNAT affects include hosting services on your home network that are accessible from the internet, traditional VPN setups that require inbound connections, and some gaming scenarios where you need to host rather than join.
Does Starlink Offer Any Way Around It?
For residential subscribers on the standard plan, there is no option to get a true public IP. Your connection will be behind CGNAT by default, and that is not something you can change in the Starlink app.
Starlink’s Priority plans — aimed at businesses and power users — do offer a publicly routable IP address as an add-on feature. This is not a static IP in the traditional sense, meaning it can still change, but it does give you a real public address that is not shared with other subscribers and does allow inbound connections. Whether it is worth the significant price difference over the residential plan depends entirely on what you are trying to do.
For residential users who need remote access to their home network, the practical workarounds involve going around CGNAT rather than through it. Services like Tailscale or Cloudflare Tunnel create outbound connections from your home network to a relay server in the cloud, effectively bypassing the CGNAT restriction by always initiating the connection from your end. Dynamic DNS services, on their own, do not solve the CGNAT problem — they can track your IP address, but if that address is behind CGNAT, it is still not directly reachable.
The Bigger Picture
CGNAT is not unique to Starlink. Many mobile carriers and a growing number of ISPs in regions with IPv4 scarcity use it too. It is an industry-wide response to a genuine infrastructure problem.
The long-term solution is IPv6, the successor to IPv4, which has an address space so large that every device on Earth could have its own unique public address many times over. IPv6 adoption has been growing steadily, and Starlink has been rolling out IPv6 support in certain markets. But widespread IPv6 deployment across the entire internet is still a work in progress, and for now, CGNAT remains the practical reality for most Starlink residential subscribers.
The bottom line: if you use Starlink for everyday internet tasks, CGNAT is invisible and irrelevant. If you are planning to run services that need to accept incoming connections from the internet, it is an important limitation to understand before you run into it unexpectedly.
