# CGNAT and static IP https://www.datasim.com/technical/cgnat-static-ip/ Quick answer. Carrier-grade NAT (CGNAT) lets many devices share one public IPv4 address, and most mobile networks put devices behind it on a private address. Devices can open connections out, but nothing can connect in unsolicited and the public address can change. A static private IP on a private APN or VPN lets your own systems reach devices. A static public IP makes them reachable from the internet and needs firewalling. ## Simple Every device on a mobile data connection gets an IP address. What kind of address it is decides whether anything on the internet can reach the device, or only the other way round. ### Private addresses and CGNAT There are not enough IPv4 addresses for every device to have its own public one. So most mobile networks give devices a private address and share a small number of public addresses between many devices. The equipment that does this is called carrier-grade NAT, or CGNAT. When a device sends data out, CGNAT swaps its private address for a shared public one and remembers the pair. Replies come back through the same mapping. This works well for devices that start every conversation themselves. ### Why can’t I reach my device remotely? - **Nobody can connect in.** A server cannot open a connection to a device behind CGNAT, because there is no mapping until the device creates one. - **The address can change.** The public address your server sees may change between sessions, so it cannot be used to identify a device. - **Idle connections close.** CGNAT forgets a mapping after a period with no traffic. Devices that keep a connection open, for example to an MQTT broker, need to send small keep-alive messages. ### Static IP addresses A **static private IP** is a fixed address inside a private network. It is used with a [private APN or VPN](/technical/private-apn-vpn/), so your own systems can always reach the device, while the internet cannot. Other SIMs on the same private APN may still reach it, unless the provider keeps them apart. A **static public IP** is a fixed address that anyone on the internet can reach. That makes inbound access simple, but it also exposes the device to scans and attacks, so it needs a firewall. ### How to choose - If your devices only send data out and fetch updates, CGNAT is usually fine. - If you need to reach devices yourself, for example to log in for support, a private network with static private addresses is the usual answer. - Use a static public IP only when the device has to accept connections from the internet, and protect it. IPv6 has enough addresses for every device, so in the long term it removes the need for NAT. Support depends on the network and on the device. ## Advanced ### Address ranges RFC 1918 reserves three IPv4 blocks for private networks. They are not routed on the public internet. | Block | Range | Source | |---|---|---| | 10.0.0.0/8 | 10.0.0.0 to 10.255.255.255 | RFC 1918 | | 172.16.0.0/12 | 172.16.0.0 to 172.31.255.255 | RFC 1918 | | 192.168.0.0/16 | 192.168.0.0 to 192.168.255.255 | RFC 1918 | | 100.64.0.0/10 | 100.64.0.0 to 100.127.255.255 | RFC 6598, Shared Address Space | RFC 6598 (BCP 153, April 2012) set aside 100.64.0.0/10 as Shared Address Space for service providers that run carrier-grade NAT. It exists because a provider cannot safely use RFC 1918 space when its customers may use the same ranges behind their own routers. RFC 6598 states that Shared Address Space is distinct from RFC 1918 private space. A cellular device may be given an address from either kind, depending on how the operator numbers its gateway pools. ### How CGNAT works The PDN gateway (or UPF in 5G) gives the device a private or shared address. Traffic to the internet passes a NAT that maps each internal address and port to an external address and port, and keeps that mapping while it is in use. Many devices share each external address, each with its own ports. RFC 6888 (BCP 127, April 2013) sets the common requirements for carrier-grade NATs. Among them: - a CGN must meet the NAT behaviour requirements for each protocol it forwards, RFC 4787 for UDP and RFC 5382 for TCP, both updated by RFC 7857 (REQ-1); - a subscriber's mappings must use the same external address ("paired" pooling, REQ-2); - a CGN must support limiting the number of external ports per subscriber (REQ-4); - endpoint-independent filtering is recommended (REQ-7); - a CGN must implement a protocol that gives subscribers explicit control over mappings, which should be the Port Control Protocol (REQ-9). ### Why inbound connections fail A mapping exists only after the device sends a packet out. A server that tries to open a connection to the device has no external address and port to send to, so the packet is dropped. Even endpoint-independent filtering only admits packets to a mapping the device has already opened. The external address is also not tied to the device. A new PDN connection, a gateway change or the expiry of a mapping can give it a different external address and port. Identify devices by credentials or a client certificate, never by the source address your server sees. ### Timeouts and keep-alives A NAT removes a mapping after a period with no traffic. RFC 4787 REQ-5 says a UDP mapping must not expire in less than two minutes, with five minutes or more recommended. RFC 5382 says an established TCP connection must not be timed out in less than 2 hours 4 minutes. Actual values vary between networks and can be shorter, so measure them or ask the provider. When a mapping expires, the device's TCP connection is broken without either end being told. The device finds out only when it next sends, and the server may keep a dead session open. For long-lived connections: - set the application keep-alive below the NAT idle timeout. In MQTT this is the keep-alive interval, after which the client sends PINGREQ; - for UDP protocols such as CoAP and LwM2M, expect to re-register or re-establish DTLS after a quiet period; - weigh keep-alives against power. A device in PSM or with long eDRX cycles cannot hold a NAT mapping while asleep, so design it to reconnect on wake. See [PSM and eDRX](/technical/psm-edrx/). ### Static private and static public IP | | Behind CGNAT | Static private IP | Static public IP | |---|---|---|---| | Address | Private or shared, changes | Fixed, private | Fixed, public | | Device reachable from | Nobody unsolicited | Your private network | The whole internet | | Typical delivery | Default public APN | Private APN or VPN | Specific APN or service | | Main risk | Lost connections on timeout | Planning the address space | Scans and attacks | A **static private IP** is assigned against the SIM, usually by the gateway or a RADIUS server on a [private APN](/technical/private-apn-vpn/). Traffic reaches your network over an IPsec tunnel or another VPN. Your servers can open connections to the device, and nothing outside can. A **static public IP** is routable from the internet. It makes inbound access simple and also exposes every open port to scanning. Firewall at the gateway where the provider offers it, allow only known source addresses, close unused services on the device and keep its software patched. ### IPv6 IPv6 gives each PDN connection its own /64 prefix (see [APN](/technical/apn/)), so devices have globally unique addresses and no NAT is needed. Whether inbound traffic is allowed is then a firewall policy at the operator and in the device. Support for IPv6 varies by network, roaming partner and module, and some servers and cloud services are still IPv4 only. Dual stack (`IPV4V6`) lets a device use IPv6 where it works and fall back where it does not. ### Choosing - **Outbound only.** Devices that report data, poll for commands and fetch updates over a connection they open work well behind CGNAT. Use keep-alives or reconnect on demand. - **Occasional inbound.** Have the device keep a connection to a broker or device-management server. An [SMS](/technical/sms/) can also tell a sleeping device to connect. - **Regular inbound access.** Use a private APN or VPN with static private addresses. - **Internet-facing services.** Use a static public IP only when outside parties must connect directly, and firewall it. ## Myths - **Myth.** Private address space includes 100.64.0.0/10. **Fact.** The private ranges in RFC 1918 are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. 100.64.0.0/10 is Shared Address Space, reserved by RFC 6598 for service providers running carrier-grade NAT. RFC 6598 states it is distinct from RFC 1918 space. - **Myth.** A static IP makes a device safe. **Fact.** A static public IP makes a device easier to find, because anyone on the internet can reach the same address every time. It needs a firewall, closed unused services and patched software. A static private IP is shielded by the private network around it. - **Myth.** You need a public IP to manage devices remotely. **Fact.** A device behind CGNAT can keep a connection open to a broker or management server and take commands over it. An SMS can ask a sleeping device to connect. For direct access, a private APN or VPN with static private addresses reaches devices without exposing them to the internet. ## Sources 1. [Address Allocation for Private Internets](https://www.rfc-editor.org/rfc/rfc1918), IETF, RFC 1918 (BCP 5) 2. [IANA-Reserved IPv4 Prefix for Shared Address Space](https://www.rfc-editor.org/rfc/rfc6598), IETF, RFC 6598 (BCP 153) 3. [Common Requirements for Carrier-Grade NATs (CGNs)](https://www.rfc-editor.org/rfc/rfc6888), IETF, RFC 6888 (BCP 127) 4. [NAT Behavioral Requirements for Unicast UDP](https://www.rfc-editor.org/rfc/rfc4787), IETF, RFC 4787 (BCP 127) 5. [NAT Behavioral Requirements for TCP](https://www.rfc-editor.org/rfc/rfc5382), IETF, RFC 5382 (BCP 142) Checked 30 October 2026.