CGNAT proxy infrastructure exists inside an internet where one public IP address no longer necessarily represents one device, one subscriber, or even one household. Network Address Translation (NAT) and Carrier-Grade NAT (CGNAT) have fundamentally changed the relationship between devices and the public IPv4 addresses visible to websites.

This distinction matters when working with residential proxy networks.

It is easy to imagine a residential IP as a simple identity:

One Residential IP
        =
One Household
        =
One User

Modern networks often do not work this way.

A home router can place dozens of devices behind one public address. An ISP using CGNAT can go further by allowing multiple subscribers to share the same public IPv4 address.

The actual structure may look more like this:

Phones / Laptops / TVs
          ↓
       Home NAT
          ↓
    Subscriber Network
          ↓
       ISP CGNAT
          ↓
      Public IPv4
          ↓
       Internet

As a result:

1 Public IP
≠
1 Device
≠
1 User
≠
1 Subscriber
≠
1 Household

Understanding this architecture is essential for interpreting residential IPs correctly.

---

What Is CGNAT and Why Does It Matter for Proxies?

Carrier-Grade NAT, commonly abbreviated as CGNAT, is a large-scale form of Network Address Translation operated by an internet service provider or carrier.

Traditional NAT usually happens inside the customer’s network.

For example:

Laptop     192.168.1.10 ─┐
Phone      192.168.1.11 ─┤
Smart TV   192.168.1.12 ─┤
                          ↓
                      Home Router
                          ↓
                    Public IPv4
                          ↓
                       Internet

The devices use private IPv4 addresses internally, while the router translates their connections onto a public IPv4 address.

CGNAT adds another translation layer.

Household A ─┐
Household B ─┤
Household C ─┤
Household D ─┼→ ISP CGNAT → Public IPv4 → Internet
Household E ─┘

Now several subscribers can potentially share one public IPv4 address.

This architecture is important for residential proxy analysis because the IP observed by a destination represents an internet-facing network endpoint, not necessarily a unique physical user.

---

NAT Was Designed to Separate Internal and Public Addressing

IPv4 provides a limited address space.

Instead of assigning a globally routable IPv4 address to every device in a household, networks commonly use private address ranges internally.

Examples include:

10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

A laptop might therefore have:

192.168.1.25

inside the home network.

That address is not globally routed across the public internet.

When the laptop connects to a website, the router translates the connection.

Conceptually:

192.168.1.25:51001
        ↓
       NAT
        ↓
203.0.113.x:62001
        ↓
     Internet

Another device could simultaneously use:

192.168.1.30:51001
        ↓
       NAT
        ↓
203.0.113.x:62002

Both devices appear to the outside world as the same public IPv4 address.

The port mapping allows the NAT device to keep the connections separate.

This means IP sharing already exists before CGNAT enters the picture.

---

CGNAT Adds Another Layer of Address Sharing

An ISP can extend this principle beyond one household.

Imagine three subscribers.

Subscriber A has an internal address:

100.64.1.10

Subscriber B:

100.64.1.11

Subscriber C:

100.64.1.12

The ISP can translate connections from all three subscribers through the same public address.

For example:

Subscriber A
100.64.1.10:5000
        ↓
203.0.113.x:20001

Subscriber B
100.64.1.11:5000
        ↓
203.0.113.x:30001

Subscriber C
100.64.1.12:5000
        ↓
203.0.113.x:40001

From the perspective of an external website:

Source IP = 203.0.113.x

for all three.

But they are not necessarily the same subscriber.

The transport-layer ports help the carrier maintain separate connection mappings internally.

---

The 100.64.0.0/10 Address Range Is Important for CGNAT

CGNAT networks commonly use the shared address space reserved for service-provider NAT deployments:

100.64.0.0/10

This range is different from ordinary RFC 1918 private space such as:

10.0.0.0/8
192.168.0.0/16

A simplified ISP architecture can therefore look like:

Home Device
    ↓
192.168.x.x
    ↓
Home Router
    ↓
100.64.x.x
    ↓
ISP CGNAT
    ↓
Public IPv4
    ↓
Internet

This creates two layers of translation:

Private Device Address
        ↓
Subscriber-Side NAT
        ↓
Carrier-Side Address
        ↓
CGNAT
        ↓
Public IPv4

This arrangement is sometimes described as NAT444 because IPv4 translation occurs across multiple IPv4 network domains.

---

Why Ports Matter as Much as IP Addresses Under CGNAT

When many subscribers share one public IP, the address alone is insufficient for routing return traffic to the correct connection.

The network also tracks ports.

A TCP connection is commonly identified using information including:

Source IP
Source Port
Destination IP
Destination Port
Protocol

Conceptually:

203.0.113.x:21001 → example.com:443
203.0.113.x:21002 → example.com:443
203.0.113.x:21003 → another-site.com:443

Even though the public source IP is identical, the connection tuples are different.

A CGNAT device maintains state that maps these public connections back to the appropriate internal subscriber connection.

For example:

Public Mapping
203.0.113.x:21001
        ↓
Subscriber A
100.64.1.10:51532

This is why CGNAT is fundamentally not just an IP-address mechanism.

It is a stateful connection translation system.

---

One Residential IP Does Not Necessarily Mean One Household

This is the most important implication for proxy users.

Suppose a website observes:

203.0.113.x

It cannot determine from that address alone whether the traffic came from:

One device
One household
Several devices in one household
One subscriber
Several subscribers behind CGNAT

The public IP identifies the public-facing network address used for the connection.

It does not provide a one-to-one mapping to a person.

Therefore, statements such as:

“This IP represents one user”

should generally be treated with caution.

A more accurate model is:

Public IP
   ↓
Public Network Endpoint
   ↓
Potentially One or More
Internal Connections

The relationship between that endpoint and individual users depends on the underlying ISP architecture.

---

Residential IP, Device Identity, and User Identity Are Different Layers

A useful way to understand the problem is to separate identity into layers.

Device identity

A physical or virtual device:

Laptop
Phone
Tablet
Smart TV

Local network identity

An address inside a private network:

192.168.1.25

Subscriber network identity

The connection assigned to a broadband or mobile subscriber.

Public network identity

The address visible to internet destinations:

203.0.113.x

Application identity

A website may separately recognize:

Account
Cookies
Session tokens
Browser storage
Authentication state

These layers should not be collapsed into one concept.

For example:

Same Public IP
+
Different Cookies
+
Different Accounts

can represent multiple independent application sessions.

Likewise:

Different Public IP
+
Same Account
+
Same Cookies

can still represent continuity at the application layer.

An IP address is therefore only one network signal.

---

Why Mobile Networks Make This Even More Important

CGNAT is especially relevant to mobile networks.

A mobile carrier can operate enormous numbers of connected devices while having a much smaller pool of public IPv4 addresses.

Conceptually:

Phone A ──┐
Phone B ──┤
Phone C ──┤
Phone D ──┼→ Carrier Network
Phone E ──┤        ↓
   ...    │      CGNAT
          │        ↓
          └→ Public IPv4 Pool

A public mobile IP may therefore be shared across many connections.

The mapping can also change over time as devices:

Reconnect
Change radio networks
Move between network areas
Switch between Wi-Fi and mobile
Receive new carrier-side addresses

This is one reason mobile IP behavior can be highly dynamic.

A public IP should not automatically be interpreted as a persistent identifier for a particular mobile device.

---

CGNAT and Dynamic IP Assignment Are Different

These two concepts are often confused.

Dynamic IP assignment means the public address assigned to a subscriber can change over time.

For example:

Monday
Subscriber A → IP 1

Tuesday
Subscriber A → IP 2

CGNAT means multiple subscriber connections can share public address resources.

For example:

Subscriber A ─┐
Subscriber B ─┼→ IP 1
Subscriber C ─┘

A network can use dynamic addressing without CGNAT.

It can also use CGNAT together with dynamic addressing.

Therefore:

Dynamic IP
≠
CGNAT

although both can contribute to changing relationships between subscribers and public IPv4 addresses.

---

CGNAT Does Not Mean Every Residential IP Is Shared

The opposite assumption is also incorrect.

The existence of CGNAT does not mean every residential IPv4 address is simultaneously shared by many subscribers.

ISP architectures differ.

A subscriber might receive:

Dedicated public IPv4

or:

Dynamic public IPv4

or:

CGNAT connectivity

or:

IPv6 + CGNAT IPv4

or another configuration.

Even within one ISP, different access products or regions can use different architectures.

Therefore, the correct conclusion is not:

Every residential IP is shared.

It is:

A public residential IPv4 address cannot automatically be assumed to represent exactly one subscriber.

That distinction is much more accurate.

---

How CGNAT Changes the Meaning of a Residential Proxy Exit

Consider a residential proxy connection:

Application
     ↓
Proxy Gateway
     ↓
Residential Endpoint
     ↓
ISP Network
     ↓
Public IPv4
     ↓
Destination

If the residential endpoint’s ISP uses CGNAT, the IP observed by the destination can be the carrier’s public-facing NAT address rather than an IPv4 address uniquely assigned to that endpoint.

The destination sees:

Public IPv4

but the underlying network may contain:

Residential Endpoint
       ↓
Subscriber Connection
       ↓
Carrier NAT
       ↓
Shared Public IPv4

This means the phrase residential IP describes network origin and connectivity context; it should not automatically be interpreted as proof that one public IP belongs exclusively to one household or device.

---

The Proxy Layer Does Not Remove the ISP Layer

Another important distinction is that residential proxy routing exists on top of the underlying ISP architecture.

A simplified view is:

Client
   ↓
Proxy Provider
   ↓
Residential Endpoint
   ↓
ISP
   ↓
Internet

The proxy provider controls aspects such as:

Gateway routing
Session selection
Endpoint selection
Proxy authentication

But the ISP controls another set of network behaviors:

Address assignment
NAT architecture
CGNAT
IPv4/IPv6 connectivity
Routing
Subscriber connectivity

Therefore, some behavior observed through a residential proxy may originate from the ISP network rather than from the proxy gateway itself.

This separation is important when diagnosing IP changes or connectivity behavior.

---

Why the Same Public IP Can Appear on Multiple Connections

Suppose several independent residential connections eventually reach the internet through the same carrier NAT address.

A destination could observe:

Connection A → 203.0.113.x
Connection B → 203.0.113.x
Connection C → 203.0.113.x

Looking only at the IP might suggest:

A = B = C

But the underlying topology could actually be:

Endpoint A ─┐
Endpoint B ─┼→ CGNAT → 203.0.113.x
Endpoint C ─┘

The connections are independent even though the visible public address is shared.

This is one reason counting unique public IPs does not necessarily count unique physical endpoints.

---

One Proxy Endpoint Can Also Change Public IPs

The inverse is possible.

Consider one residential endpoint:

Residential Endpoint A

At one time:

Endpoint A
    ↓
Public IP 1

Later:

Endpoint A
    ↓
Public IP 2

The endpoint may not have changed.

Only its public network identity changed.

Therefore:

One Endpoint
→ Multiple IPs Over Time

while CGNAT can produce:

Multiple Endpoints
→ One Public IP

Together, these relationships show why:

Endpoint Count
≠
Public IP Count

This is particularly important when measuring dynamic residential networks.

---

Why IP-Based Rate Limits Can Affect Shared Networks

CGNAT also creates consequences outside the proxy industry.

Many internet services apply controls at least partly by source IP.

If multiple independent users share one public IPv4 address, IP-level activity can become aggregated.

Conceptually:

User A requests
      +
User B requests
      +
User C requests
      ↓
Same Public IPv4
      ↓
Destination

From the destination’s network perspective, these connections share the same source address even though they may represent unrelated users.

This is one reason modern internet services generally cannot rely on IP address alone as a perfect representation of a human identity.

Other signals may be used depending on the application.

---

CGNAT Can Complicate Inbound Connectivity

Traditional NAT already makes unsolicited inbound connections more difficult because internal devices are not directly addressed by their private IPv4 addresses from the public internet.

CGNAT adds another translation layer controlled by the ISP.

For a subscriber behind CGNAT:

Internet
   ↓
Public IPv4
   ↓
ISP CGNAT
   ↓
Subscriber
   ↓
Home NAT
   ↓
Device

The subscriber generally does not control the carrier’s NAT mapping in the same way they control their own home router.

This is why CGNAT can affect applications that require direct inbound IPv4 connectivity.

Proxy users primarily concerned with outbound web traffic may not notice this directly, but it is an important characteristic of the underlying residential network.

---

Port Allocation Becomes a Shared Resource

CGNAT conserves IPv4 addresses partly by distinguishing subscribers through transport-layer port mappings.

But TCP and UDP ports are finite.

A public IPv4 address has a limited port-number space per transport protocol.

This means a carrier cannot map an unlimited number of simultaneous connections through one public address without additional architecture.

Conceptually:

Public IPv4
     ↓
Available Port Space
     ↓
Allocated Across Connections

If too many subscribers or connections are concentrated behind one public address, port resources become an engineering consideration.

Carriers can address this using larger public pools, multiple NAT devices, port allocation strategies, load distribution, and other network designs.

This is another reason:

One Public IP

does not represent unlimited network capacity.

---

Port Exhaustion and IP Exhaustion Are Different Problems

It is useful to distinguish two forms of scarcity.

IPv4 address exhaustion

Not enough globally unique IPv4 addresses

NAT port exhaustion

Not enough usable translation mappings
for the required concurrent connections

CGNAT helps mitigate the first problem by sharing public addresses.

But large-scale sharing introduces the second resource-management problem.

This illustrates a recurring networking principle:

Solving scarcity at one layer often moves resource management to another layer.

For proxy infrastructure, this helps explain why raw public IP count is not equivalent to connection capacity.

---

CGNAT Can Affect Connection Persistence

Because CGNAT is stateful, it maintains mappings for active network flows.

A simplified table might look like:

Internal Connection	Public Mapping	Destination
100.64.1.10:50100	203.0.113.x:21001	Server A:443
100.64.1.11:50200	203.0.113.x:21002	Server B:443
100.64.1.12:50300	203.0.113.x:21003	Server C:443

These mappings do not necessarily remain forever.

Idle flows can expire.

Connections can close.

Network state can be recreated.

Therefore, long-lived connections depend not only on the client and destination but also on intermediate stateful network devices.

This becomes relevant for long-running residential connections where several layers of NAT may exist between the application and the public internet.

---

CGNAT and Sticky Proxy Sessions Are Different Layers

A sticky proxy session is usually a proxy-routing concept.

For example:

session-ABC
      ↓
Proxy Routing
      ↓
Residential Endpoint X

CGNAT exists further downstream:

session-ABC
      ↓
Residential Endpoint X
      ↓
ISP CGNAT
      ↓
Public IPv4

These should not be confused.

The proxy system may continue routing traffic to the same residential endpoint while the underlying ISP network changes how that endpoint reaches the public internet.

Therefore:

Same Proxy Session
       ≠
Guaranteed Permanent Public IP

The exact behavior depends on the residential network and proxy architecture.

This is why session identity, endpoint identity, and public IP identity should be monitored separately.

---

How IPv6 Changes the NAT Equation

IPv6 dramatically expands the available address space.

Instead of using 32-bit addresses like IPv4, IPv6 uses 128-bit addresses.

This reduces the need to conserve globally unique addresses using traditional IPv4 NAT techniques.

A simplified IPv6 architecture can look more like:

Device
   ↓
Globally Unique IPv6 Address
   ↓
Router / Firewall
   ↓
ISP
   ↓
Internet

That does not mean IPv6 removes firewalls, privacy mechanisms, address changes, prefix delegation, or all forms of translation.

It means the fundamental pressure that drove widespread IPv4 address sharing is different.

This is one reason many modern ISP networks operate with combinations such as:

IPv6
+
CGNAT IPv4

A subscriber can receive native IPv6 connectivity while IPv4 traffic continues through carrier-grade translation.

---

Dual-Stack Residential Networks Can Have Two Very Different Identities

Consider a dual-stack household.

Its IPv4 path might be:

Device
  ↓
Home NAT
  ↓
CGNAT
  ↓
Shared Public IPv4

while IPv6 might look like:

Device
  ↓
IPv6 Prefix
  ↓
ISP
  ↓
Public IPv6

The same physical device therefore participates in two very different addressing models.

A website reached over IPv4 may see a shared carrier address.

A website reached over IPv6 may see an address belonging to a delegated IPv6 prefix.

This makes the statement:

“What is this user’s IP?”

less straightforward than it appears.

A device can simultaneously have multiple network identities depending on protocol and connection path.

---

NAT Type Can Matter More Than Users Realize

Not every NAT implementation handles mappings identically.

Mapping behavior can depend on factors such as:

Source address
Source port
Destination address
Destination port
Transport protocol
Timeout policy

Different NAT behaviors can affect peer-to-peer connectivity, UDP applications, long-lived flows, and inbound reachability.

For ordinary outbound HTTP and HTTPS proxy traffic, many of these details remain invisible to the application.

But for network engineers, they help explain why two residential networks using NAT can still exhibit different connection behavior.

---

How to Detect Whether a Network May Be Behind CGNAT

From inside a network, one useful clue is comparing the WAN-side IPv4 address assigned to the customer equipment with the public IPv4 address observed by an external service.

For example:

Router WAN IP:
100.72.x.x

External IP:
203.0.113.x

Because 100.64.0.0/10 is shared address space intended for service-provider use, seeing an address from that range on the ISP-facing side can be evidence of carrier-grade translation upstream.

Another possible pattern is:

Router WAN IPv4
        ≠
Observed Public IPv4

However, network architectures vary, and this alone should not be used as a universal classification method without additional context.

The important point for proxy analysis is that the public address seen by a website does not expose the entire path behind it.

---

A Better Data Model for Residential Proxy Observations

Instead of recording only:

{
  "ip": "203.0.113.x"
}

a more useful network observation can include:

{
  "exit_ip": "203.0.113.x",
  "ip_version": 4,
  "asn": "AS64500",
  "network_type": "residential",
  "country": "JP",
  "session_id": "session-abc",
  "first_seen": "2026-09-24T08:00:00Z",
  "last_seen": "2026-09-24T08:18:00Z"
}

If the system controls endpoint-level telemetry, it can separately track an internal endpoint identifier.

Conceptually:

Endpoint ID
     ↓
Session ID
     ↓
Public IP
     ↓
ASN
     ↓
Timestamp

This makes it possible to detect two important relationships:

One Endpoint → Multiple Public IPs

and:

One Public IP → Multiple Endpoints

Those relationships cannot be understood from public IP strings alone.

---

Why This Matters When Measuring Residential Proxy Networks

Suppose a test observes:

100,000 unique public IPs

It would be incorrect to automatically conclude:

100,000 unique devices

or:

100,000 unique households

because NAT, CGNAT, dynamic address assignment, and endpoint churn can break those one-to-one assumptions.

Likewise, observing the same public IP repeatedly does not prove that every connection originated from the same physical endpoint.

Therefore, different measurements should answer different questions:

Unique Public IPs
→ Address diversity

Unique ASNs
→ Network diversity

Unique ISPs
→ Provider diversity

Unique Endpoints
→ Endpoint diversity, if measurable

Session Lifetime
→ Routing persistence

Public IP Lifetime
→ Address persistence

A professional proxy benchmark should avoid using one metric as a substitute for another.

---

Where ColaProxy Fits Into NAT and CGNAT Networks

Residential proxy infrastructure such as ColaProxy operates within the broader architecture of consumer ISP and mobile networks.

A simplified path can be represented as:

Application
     ↓
ColaProxy Gateway
     ↓
Residential Proxy Endpoint
     ↓
Local / ISP Network
     ↓
NAT or CGNAT Where Applicable
     ↓
Public Internet
     ↓
Destination

Different residential endpoints can exist behind different ISP architectures.

One endpoint may have a directly assigned public IPv4 address.

Another may operate behind CGNAT.

Another may use dual-stack IPv4 and IPv6 connectivity.

For permitted web automation and data collection, developers therefore benefit from treating the observed exit IP as one property of the connection rather than assuming it uniquely identifies the underlying device or subscriber.

Proxy routing, residential endpoint selection, ISP addressing, and destination-side application state are separate layers of the complete system.

---

The Better Mental Model: IP Addresses Identify Network Paths, Not People

The simplest way to avoid confusion is to stop treating an IP address as a universal identity.

A public IP tells you something important:

This network connection reached the destination using this public internet address.

But it does not automatically tell you:

Who the person is
How many devices are behind the address
How many subscribers share it
Whether the same subscriber will use it tomorrow
Whether the same endpoint used it yesterday

A better model is:

Person
   ↓
Application
   ↓
Device
   ↓
Local Network
   ↓
Subscriber Connection
   ↓
NAT / CGNAT
   ↓
Public IP
   ↓
Internet Service

Each layer represents a different type of identity.

Collapsing all of them into “the IP” creates incorrect assumptions.

---

Conclusion

CGNAT proxy infrastructure should be understood in the context of the modern residential internet, where public IPv4 addresses are increasingly shared, dynamically assigned, and separated from individual devices by multiple network layers.

Traditional home NAT already allows many devices to share one public address.

CGNAT extends that model by allowing an ISP or carrier to share public IPv4 resources across multiple subscriber connections.

As a result:

One IP
≠
One Device
≠
One User
≠
One Household

The reverse relationship can also occur. One residential endpoint can use different public IP addresses over time because of dynamic addressing or changes in the underlying network.

For proxy infrastructure, this means public IP count, endpoint count, subscriber count, and network diversity should be treated as separate concepts.

IPv4 exhaustion helped make address sharing increasingly important. IPv6 changes the economics of address scarcity, but the modern internet will continue to contain a mixture of IPv4, IPv6, NAT, CGNAT, and dual-stack networks.

The most useful principle is therefore simple:

A residential IP describes a network-facing identity—not a guaranteed one-to-one identity for a person, device, or household.

---

Frequently Asked Questions

What is CGNAT?

Carrier-Grade NAT is a network architecture in which an ISP or carrier translates traffic from multiple subscriber connections through a shared pool of public IPv4 addresses.

Does one residential IP mean one user?

No. A public residential IP can represent multiple devices in one household, and with CGNAT it can potentially be shared by multiple subscriber connections. An IP address should not be treated as a unique user identifier.

Can multiple households share the same public IPv4 address?

Yes. When an ISP uses CGNAT, multiple subscribers can share public IPv4 resources while their connections are distinguished internally through NAT mappings.

What is the difference between NAT and CGNAT?

Traditional NAT commonly operates at the customer’s router and lets multiple local devices share an internet connection. CGNAT operates inside the ISP or carrier network and can allow multiple subscribers to share public IPv4 addresses.

What is the 100.64.0.0/10 network?

100.64.0.0/10 is shared IPv4 address space reserved for service-provider environments such as carrier-grade NAT. It is distinct from ordinary RFC 1918 private ranges such as 192.168.0.0/16.

Does CGNAT change a residential proxy’s public IP?

CGNAT can affect how a residential endpoint reaches the public internet. The public address visible to a destination can be an ISP’s carrier-side NAT address rather than an IPv4 address uniquely assigned to the endpoint.

Is CGNAT the same as a rotating proxy?

No. CGNAT is an ISP networking mechanism for sharing public IPv4 resources. Proxy rotation is a proxy-routing mechanism for selecting or changing exit paths. They operate at different layers.

Does IPv6 eliminate CGNAT?

IPv6 greatly reduces the need to conserve addresses in the same way as IPv4, but real networks can use multiple technologies simultaneously. A subscriber may have native IPv6 while IPv4 traffic still passes through CGNAT.