Minecraft Server Behind CGNAT: What to Do
Learn what to do when a Minecraft server is behind CGNAT, why port forwarding fails, and options such as public IPv4, IPv6, tunnels, VPS, or hosting.
CGNAT is one of the most common reasons Minecraft port forwarding looks correct but still fails. The router rule can be perfect and still never receive public traffic.
How to Detect CGNAT
Compare:
- The WAN/Internet IP shown in your router.
- The public IP shown by an external IP lookup.
If they are different, or if the router WAN IP is private/shared, CGNAT may be present.
Private or shared ranges often include:
| Range | Meaning |
| --- | --- |
| 10.x.x.x | Private |
| 172.16.x.x to 172.31.x.x | Private |
| 192.168.x.x | Private |
| 100.64.x.x to 100.127.x.x | Shared carrier-grade NAT range |
Why Port Forwarding Fails
With normal home hosting, players connect to your public IP and your router forwards traffic to the server. With CGNAT, your router is behind another NAT layer controlled by the ISP. You cannot create the needed inbound rule on that ISP layer.
If CGNAT is the blocker, adding more router forwards will not fix it. Solve the public reachability problem first.
Options
| Option | Pros | Tradeoff | | --- | --- | --- | | Ask ISP for public IPv4 | Cleanest home-hosting path | May cost extra or be unavailable | | Use IPv6 | No IPv4 port forwarding needed | Players and DNS must support it | | Use a tunnel | Can work behind CGNAT | Adds dependency and latency | | Use a VPS relay/proxy | More control | Requires Linux/network admin | | Buy Minecraft hosting | Simplest operations | Monthly cost, less control |
If you are choosing between VPS and shared hosting, read VPS vs shared Minecraft hosting.
Domain Notes
A domain cannot bypass CGNAT by itself. DNS points players somewhere; it does not create a reachable inbound path. Fix reachability first, then add DNS.
FAQ
What is CGNAT?
Carrier-grade NAT means your ISP shares one public IPv4 address across multiple customers, so inbound port forwarding to your router may not work.
Can port forwarding work behind CGNAT?
Usually no. Your router is not directly reachable from the public internet, so the forward never receives the traffic.
What is the best fix for CGNAT?
A real public IPv4 address is the cleanest home-hosting fix. Otherwise use hosting, a VPS, a tunnel, or an IPv6 solution that your players can reach.
Related Tools
server.properties Generator
Generate a clean Minecraft server.properties baseline for online mode, max players, difficulty, view distance, simulation distance, and command blocks.
Backup Schedule Generator
Generate a Minecraft server backup schedule with interval, retention, storage estimate, off-node backup reminder, and cron-style examples.
Minecraft Port Checker / Troubleshooting Wizard
Build a Minecraft port troubleshooting plan for port 25565, home hosting, VPS firewalls, panel allocations, proxy networks, DNS, and CGNAT.
Related Articles
Public IP vs Local IP for Minecraft Servers
Understand public IP vs local IP for Minecraft servers, what address players should use, how port forwarding works, and why 192.168 addresses fail externally.
Port Forwarding Not Working for Minecraft Server
Fix Minecraft port forwarding not working by checking server-port, local IP, router NAT, Windows Firewall, UFW, provider firewalls, and CGNAT.
VPS vs Shared Minecraft Hosting
Compare VPS and shared Minecraft hosting for performance, control, support, backups, security, cost, panels, migrations, and admin workload.