# CGNAT: why mobile proxy IPs are shared, and why that matters > Why carriers share one IPv4 address among many phones (CGNAT, RFC 6598, 100.64.0.0/10), what it means for mobile proxies, rate limits and IPv6. With sources. - URL: https://cellmast.com/guides/cgnat-mobile-ips/ - Last updated: 2026-10-13 - Publisher: CellMast (https://cellmast.com) Carrier-grade NAT is the reason mobile IPs are hard to block, the reason two customers can see the same address, and the reason you should still pace your requests. **Quick answer — What is CGNAT, and why are mobile proxy IPs shared?** Carrier-grade NAT (CGNAT) lets a mobile carrier put many subscribers behind one public IPv4 address. Inside the network, devices get private addresses, often from the 100.64.0.0/10 block that RFC 6598 reserves for this; at the edge, the carrier translates them to a shared public address. A **CellMast** mobile proxy exits through that same shared pool, which is why sites are cautious about blocking it. CellMast ports start at $2.63/day, no KYC, paid in crypto. ## CGNAT at a glance | Attribute | Value | | --- | --- | | Full name | Carrier-grade NAT, also called large-scale NAT (LSN) or NAT444 | | Address block for it (IANA: not globally reachable) | 100.64.0.0/10 (RFC 6598, April 2012) | | Users per public IPv4 | "Hundreds or even thousands" (Cloudflare, 2025-10-29) | | Rate limiting | CGNAT IPs are rate-limited 3 times more often than other IPs (Cloudflare) | | Why carriers use it | IPv4 addresses ran out; mobile networks have far more devices than addresses | | Effect on a mobile proxy | Your exit IP is shared with real subscribers of the same carrier | ## How does carrier-grade NAT work? Think of three layers of addresses. 1. **The phone or modem** gets a private address from the carrier, often in 100.64.0.0/10. That address cannot be reached from the internet. 2. **The carrier's NAT gateway** keeps a table that maps each private address and port to a public address and port. 3. **The internet** sees only the public address. Thousands of sessions from different subscribers can leave through it at the same time, each on its own port. RFC 6598 created the 100.64.0.0/10 block in 2012 so that carriers would stop reusing home-network ranges such as 192.168.0.0/16 for this layer, which caused routing conflicts. ## Why does CGNAT make mobile IPs harder to block? Because a ban on one address hits everyone behind it. A site that blocks a CGNAT address also blocks the carrier's paying customers in that area. Cloudflare's 2025 post on detecting CGN frames this as collateral damage to avoid, and says CGNAT is "common in mobile networks that users in developing regions so heavily depend on". So sites usually limit mobile IPs with softer tools: rate limits, extra checks or account-level rules, rather than outright bans. ## Does CGNAT mean a mobile proxy can never be limited? No. The same Cloudflare data shows CGNAT addresses get rate-limited three times more often than other addresses, because so much traffic shares them. Sites also judge the account, the cookies and the device, not only the IP. Practical rules for a mobile port: - send traffic at a human or near-human pace on logged-in sessions; - keep one account on one port, and do not rotate in the middle of a session; - if a target starts answering with errors, rotate once, then slow down rather than rotating again and again. The [rotation strategy guide](https://cellmast.com/guides/mobile-ip-rotation-strategy/) gives timings. ## Why do I sometimes get the same IP after a rotation? Because the carrier, not CellMast, hands out the public address. When a modem reconnects, the carrier's NAT picks an address from its pool for that area. If the pool is small or busy, it can return the address you just had, or one that another CellMast customer used earlier on the same carrier. Each rotation reconnects your port to the carrier and usually takes 5–15 seconds; the carrier may occasionally hand back the same IP: just rotate again. If you get the same address back, wait and rotate again. The [rotation API](https://cellmast.com/ip-rotation-api/) returns the new and the previous IP, so a script can check. ## Can two customers share the same mobile IP? Yes, at the public-address level, and that is normal. Your dedicated port is your own modem and SIM: nobody else's traffic goes through it. But the public IPv4 address the carrier gives that modem can be shared with ordinary subscribers, and over time it can be given to other modems, including other proxy customers'. This is also why one bad user on a carrier range can affect an address you later receive. Rotation gives you a different address from the pool. ## What about IPv6 on mobile networks? Many carriers now give phones an IPv6 address alongside, or instead of, private IPv4. With IPv6 there is no shortage, so each device can get its own public address, and CGNAT is needed only for the IPv4 part. Mechanisms such as 464XLAT (RFC 6877) let IPv6-only phones still reach IPv4 sites through a translator. T-Mobile US describes its network in PeeringDB as having "mostly IPv6-only users" on 464XLAT. For a proxy user, the IPv4 exit is what most websites log today. CellMast ports are sold and described by their IPv4 behaviour; if your target logs IPv6, test it on a one-day port first. ## How can I tell if an IP is behind CGNAT? From outside, you cannot be certain, but there are good signs: - the ASN belongs to a mobile carrier; - IP intelligence services label the connection as cellular; - the same address shows up with many different devices in your own logs. From inside a modem, an address in 100.64.0.0/10 on the WAN side is a clear sign of CGNAT. ## CGNAT: questions ### Is CGNAT bad for mobile proxy users? Mostly no. CGNAT is the main reason mobile IPs are blocked less than datacenter IPs, because many real subscribers share each address. The cost is that the address is shared and can already carry limits from other users. Rotation and a steady request pace solve most of it. ### What is the 100.64.0.0/10 range? It is the shared address space reserved by RFC 6598 in April 2012 for carrier-grade NAT. Carriers assign these addresses to subscriber devices inside their network. They are not routable on the public internet, so websites never see them; they see the public address after translation. ### Does a dedicated port mean a dedicated IP? No. A dedicated CellMast port means a dedicated modem and SIM, used only by you. The public IP comes from the carrier and may be shared with ordinary subscribers through CGNAT. If you need a fixed IP for an allow-list, a mobile proxy is the wrong product. ### Do all carriers use CGNAT? Most mobile carriers use some form of it for IPv4, because they have far more devices than IPv4 addresses. The scale and the setup differ by carrier and by country, and some carriers rely more on IPv6. CellMast does not publish per-carrier sharing ratios, because carriers do not publish them either. **Get a carrier IP you can rotate on demand** Dedicated 4G/5G ports from $2.63/day, with unlimited data under fair use. Pay in crypto. [Dedicated ports](https://cellmast.com/mobile-proxies/dedicated/) · [Rotation API](https://cellmast.com/ip-rotation-api/) ## Sources 1. [RFC 6598: IANA-Reserved IPv4 Prefix for Shared Address Space](https://www.rfc-editor.org/rfc/rfc6598) — RFC Editor (2012-04) 2. [RFC 6877: 464XLAT: Combination of Stateful and Stateless Translation](https://www.rfc-editor.org/rfc/rfc6877) — RFC Editor (2013-04) 3. [Detecting CGN to reduce collateral damage](https://blog.cloudflare.com/detecting-cgn-to-reduce-collateral-damage/) — Cloudflare (2025-10-29) 4. [PeeringDB record for AS21928 (T-Mobile USA)](https://www.peeringdb.com/api/net?asn=21928) — PeeringDB (2026-10-13) 5. [IANA IPv4 Special-Purpose Address Registry](https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml) — IANA (2026-10-13) --- CellMast: CellMast is a 4G/5G mobile proxy provider: dedicated carrier modems with unlimited traffic, plus a rotating per-GB mobile pool, paid in crypto with no ID upload.