Find the missing door before opening a port
Your storage box works from the sofa, but its remote connection times out. Repeating a port-forwarding rule may achieve nothing: the internet-facing address might belong to your provider’s shared gateway rather than your router.
Carrier-grade network address translation, or CGNAT, lets an ISP put multiple subscribers behind a shared public IPv4 address. Your router translates household traffic; the provider translates it again upstream. Outbound browsing normally works because those translations track connections you started. An unsolicited incoming connection needs a route back through both boundaries.
This guide uses the ASUSWRT router web interface to gather evidence before choosing remote access. You need local access and the router administrator credentials. It does not walk through publishing a server or configuring every router brand. Begin with a note of the service you want to reach, such as your own storage application, and whether access is only for you or for public visitors.
Collect two addresses from the same connection
- Connect a personal computer to your home router over Wi-Fi or Ethernet. Keep that connection throughout the comparison. A VPN, proxy or privacy relay can make a website report a different exit address. Pause only an optional service you control, record that change, and restore it afterward; use another personal device if protection is mandatory.
- Open your router’s known local management address in a browser and sign in. ASUS documents entering the router’s LAN address or its local router hostname. Use an address already established for your installation. If credentials are unavailable, stop and ask the administrator; a factory reset is unnecessary for this investigation.
- Open Network Map and read Internet status. Record the WAN IP, connection state and time privately. ASUS’s Internet status guide shows where the WAN address appears. Record the router model and firmware too; layouts vary. For dual-WAN equipment, identify which connection carries this comparison.
- In another tab, use a public address-checking service that explicitly reports IPv4. Record that address immediately. A colon-separated IPv6 address is not comparable with the router’s dotted IPv4 address. If the service shows only IPv6, find its IPv4 result before drawing a conclusion.
You now have two observations: the address assigned to your router’s upstream interface and the IPv4 address seen by an internet service. Neither is the computer’s ordinary household address. If the router is disconnected or has no usable WAN address, fix ordinary connectivity first; that is not evidence of CGNAT.
Read the pair without overdiagnosing it
| Observation | Interpretation and next action |
|---|---|
| 100.64.0.0 through 100.127.255.255 | Shared address space associated with provider NAT. Ask the ISP to confirm your service’s inbound-access options. |
| 10.x.x.x, 172.16.x.x through 172.31.x.x, or 192.168.x.x | Private address space. Inspect the upstream equipment before deciding who controls the extra translation. |
| An otherwise public IPv4 matching the website | No upstream address translation is indicated by this comparison. Inbound service and firewall checks are still needed. |
| A different otherwise public IPv4 | Recheck the exit path, timing and active WAN. Ask the ISP about translation if the discrepancy persists. |
RFC 6598 reserves 100.64.0.0/10 for shared address space. The range ends at 100.127.255.255; not every address beginning with 100 belongs to it. Likewise, only 172.16 through 172.31 belongs to the private 172 range. Read the router’s WAN field: an overlay VPN can assign similar-looking addresses to a virtual interface without saying anything about your ISP.
Hypothetical example: the router shows 100.72.14.8, while the website reports a different public IPv4. Forwarding an application’s TCP port 8443 to 192.168.50.20 only tells your router what to do with traffic that reaches it. It creates no corresponding rule at the provider’s gateway. Changing 8443 to another port cannot remove that upstream boundary.
If WAN instead reads 192.168.1.2, trace its upstream cable without unplugging it. Does it lead to an ISP gateway operating as another router? With permission, inspect that gateway’s WAN address too. A public address there suggests household double NAT; a shared address there suggests another provider boundary. Both can coexist. Do not switch to bridge mode during diagnosis: it can affect phone service, television and other household connections.
Choose the route that fits the audience
For a directly reachable IPv4 endpoint, ask the provider
Ask: “Is my connection behind CGNAT? Can you supply a public IPv4 that accepts unsolicited inbound connections? Is it dynamic or static, what does it cost, and are inbound ports restricted?” A public dynamic address can support incoming connections; static means it stays fixed. Do not purchase a static-address option without confirming public reachability.
Dynamic DNS keeps a hostname pointed at a changing address. It does not create an inbound mapping through CGNAT. Your own port-forwarding settings also cannot administer the provider’s gateway. ASUS’s port-forwarding documentation identifies private WAN and multiple NAT layers as obstacles.
For your own devices, consider an overlay connection
A private overlay such as Tailscale can connect enrolled devices through NAT traversal, with relaying when a direct path is unavailable. This changes the access design: your remote device joins an authenticated network instead of approaching an ordinary public port. Check that the home endpoint supports the client, and plan account recovery and access permissions before depending on it.
Tailscale’s connectivity reference distinguishes direct, peer-relay and DERP-relay connections. CGNAT does not automatically mean every connection must be relayed. Conversely, successful access does not prove a direct path; on an already configured client, tailscale status reports connection type. Test your real workload before relying on its performance.
Treat IPv6 as a separate route
IPv4 CGNAT does not establish whether IPv6 is available. A native IPv6 path requires suitable connectivity at both ends, a reachable service and deliberate firewall permission. ASUS’s IPv4 port-forwarding page is not an IPv6 setup procedure. Obtain model-specific instructions rather than turning off the firewall or assuming an IPv6 address alone completes remote access.
Verify from outside, then close the trial
After implementing your chosen supported method, first confirm the intended service works locally. Then test from an independent connection, such as your personal phone’s cellular data with Wi-Fi off. A successful attempt from home Wi-Fi may use an internal route and cannot establish outside reachability. For an overlay, keep its client connected on the remote device.
Use the intended application, protocol and address. A login page establishes reachability, not successful authorization. A timeout alone cannot distinguish CGNAT from a sleeping endpoint, a stopped service, a wrong destination or a firewall rule. Recheck the local baseline and current addresses before changing more settings.
Remove temporary forwarding rules and withdraw trial remote-access permissions when finished. If you changed existing settings, restore the recorded configuration deliberately and confirm household browsing still works. Restore any optional privacy service paused for the address comparison. Leave router administration local; exposing it or enabling DMZ is not a CGNAT remedy. Keep the address comparison and the provider’s answer privately: together they explain which boundary your eventual setup must cross.
Sources, versions & scope
The steps describe the documented controls and expected checks; they are not a claim that every device or software release has been physically tested. Platform and version differences are stated with the procedure.
