{"id":1997,"date":"2026-09-24T16:03:44","date_gmt":"2026-09-24T08:03:44","guid":{"rendered":"\/blog\/?p=1997"},"modified":"2026-09-24T16:03:46","modified_gmt":"2026-09-24T08:03:46","slug":"cgnat-proxy","status":"publish","type":"post","link":"\/blog\/cgnat-proxy","title":{"rendered":"Does One Residential IP Mean One User? How NAT and CGNAT Change Proxy Networks"},"content":{"rendered":"\n

CGNAT proxy<\/strong> infrastructure exists inside an internet where one public IP address no longer necessarily represents one device, one subscriber, or even one household. Network Address Translation (NAT) and Carrier-Grade NAT (CGNAT) have fundamentally changed the relationship between devices and the public IPv4 addresses visible to websites.<\/p>\n\n\n\n

This distinction matters when working with residential proxy networks.<\/p>\n\n\n\n

It is easy to imagine a residential IP as a simple identity:<\/p>\n\n\n\n

One Residential IP\n        =\nOne Household\n        =\nOne User<\/code><\/pre>\n\n\n\n
Modern networks often do not work this way.<\/p>\n\n\n\n
A home router can place dozens of devices behind one public address. An ISP using CGNAT can go further by allowing multiple subscribers to share the same public IPv4 address.<\/p>\n\n\n\n
The actual structure may look more like this:<\/p>\n\n\n\n
Phones \/ Laptops \/ TVs\n          \u2193\n       Home NAT\n          \u2193\n    Subscriber Network\n          \u2193\n       ISP CGNAT\n          \u2193\n      Public IPv4\n          \u2193\n       Internet<\/code><\/pre>\n\n\n\n
As a result:<\/p>\n\n\n\n
1 Public IP\n\u2260\n1 Device\n\u2260\n1 User\n\u2260\n1 Subscriber\n\u2260\n1 Household<\/code><\/pre>\n\n\n\n
Understanding this architecture is essential for interpreting residential IPs correctly.<\/p>\n\n\n\n
\n\n\n\n
What Is CGNAT and Why Does It Matter for Proxies?<\/h2>\n\n\n\n
Carrier-Grade NAT, commonly abbreviated as CGNAT<\/strong>, is a large-scale form of Network Address Translation operated by an internet service provider or carrier.<\/p>\n\n\n\n
Traditional NAT usually happens inside the customer’s network.<\/p>\n\n\n\n
For example:<\/p>\n\n\n\n
Laptop     192.168.1.10 \u2500\u2510\nPhone      192.168.1.11 \u2500\u2524\nSmart TV   192.168.1.12 \u2500\u2524\n                          \u2193\n                      Home Router\n                          \u2193\n                    Public IPv4\n                          \u2193\n                       Internet<\/code><\/pre>\n\n\n\n
The devices use private IPv4 addresses internally, while the router translates their connections onto a public IPv4 address.<\/p>\n\n\n\n
CGNAT adds another translation layer.<\/p>\n\n\n\n
Household A \u2500\u2510\nHousehold B \u2500\u2524\nHousehold C \u2500\u2524\nHousehold D \u2500\u253c\u2192 ISP CGNAT \u2192 Public IPv4 \u2192 Internet\nHousehold E \u2500\u2518<\/code><\/pre>\n\n\n\n
Now several subscribers can potentially share one public IPv4 address.<\/p>\n\n\n\n
This architecture is important for residential proxy analysis because the IP observed by a destination represents an internet-facing network endpoint<\/strong>, not necessarily a unique physical user.<\/p>\n\n\n\n
\n\n\n\n
NAT Was Designed to Separate Internal and Public Addressing<\/h2>\n\n\n\n
IPv4 provides a limited address space.<\/p>\n\n\n\n
Instead of assigning a globally routable IPv4 address to every device in a household, networks commonly use private address ranges internally.<\/p>\n\n\n\n
Examples include:<\/p>\n\n\n\n
10.0.0.0\/8\n172.16.0.0\/12\n192.168.0.0\/16<\/code><\/pre>\n\n\n\n
A laptop might therefore have:<\/p>\n\n\n\n
192.168.1.25<\/code><\/pre>\n\n\n\n
inside the home network.<\/p>\n\n\n\n
That address is not globally routed across the public internet.<\/p>\n\n\n\n
When the laptop connects to a website, the router translates the connection.<\/p>\n\n\n\n
Conceptually:<\/p>\n\n\n\n
192.168.1.25:51001\n        \u2193\n       NAT\n        \u2193\n203.0.113.x:62001\n        \u2193\n     Internet<\/code><\/pre>\n\n\n\n
Another device could simultaneously use:<\/p>\n\n\n\n
192.168.1.30:51001\n        \u2193\n       NAT\n        \u2193\n203.0.113.x:62002<\/code><\/pre>\n\n\n\n
Both devices appear to the outside world as the same public IPv4 address.<\/p>\n\n\n\n
The port mapping allows the NAT device to keep the connections separate.<\/p>\n\n\n\n
This means IP sharing already exists before CGNAT enters the picture.<\/p>\n\n\n\n
\n\n\n\n
CGNAT Adds Another Layer of Address Sharing<\/h2>\n\n\n\n
An ISP can extend this principle beyond one household.<\/p>\n\n\n\n
Imagine three subscribers.<\/p>\n\n\n\n
Subscriber A has an internal address:<\/p>\n\n\n\n
100.64.1.10<\/code><\/pre>\n\n\n\n
Subscriber B:<\/p>\n\n\n\n
100.64.1.11<\/code><\/pre>\n\n\n\n
Subscriber C:<\/p>\n\n\n\n
100.64.1.12<\/code><\/pre>\n\n\n\n
The ISP can translate connections from all three subscribers through the same public address.<\/p>\n\n\n\n
For example:<\/p>\n\n\n\n
Subscriber A\n100.64.1.10:5000\n        \u2193\n203.0.113.x:20001\n\nSubscriber B\n100.64.1.11:5000\n        \u2193\n203.0.113.x:30001\n\nSubscriber C\n100.64.1.12:5000\n        \u2193\n203.0.113.x:40001<\/code><\/pre>\n\n\n\n
From the perspective of an external website:<\/p>\n\n\n\n
Source IP = 203.0.113.x<\/code><\/pre>\n\n\n\n
for all three.<\/p>\n\n\n\n
But they are not necessarily the same subscriber.<\/p>\n\n\n\n
The transport-layer ports help the carrier maintain separate connection mappings internally.<\/p>\n\n\n\n
\n\n\n\n
The 100.64.0.0\/10 Address Range Is Important for CGNAT<\/h2>\n\n\n\n
CGNAT networks commonly use the shared address space reserved for service-provider NAT deployments:<\/p>\n\n\n\n
100.64.0.0\/10<\/code><\/pre>\n\n\n\n
This range is different from ordinary RFC 1918 private space such as:<\/p>\n\n\n\n
10.0.0.0\/8\n192.168.0.0\/16<\/code><\/pre>\n\n\n\n
A simplified ISP architecture can therefore look like:<\/p>\n\n\n\n
Home Device\n    \u2193\n192.168.x.x\n    \u2193\nHome Router\n    \u2193\n100.64.x.x\n    \u2193\nISP CGNAT\n    \u2193\nPublic IPv4\n    \u2193\nInternet<\/code><\/pre>\n\n\n\n
This creates two layers of translation:<\/p>\n\n\n\n
Private Device Address\n        \u2193\nSubscriber-Side NAT\n        \u2193\nCarrier-Side Address\n        \u2193\nCGNAT\n        \u2193\nPublic IPv4<\/code><\/pre>\n\n\n\n
This arrangement is sometimes described as NAT444 because IPv4 translation occurs across multiple IPv4 network domains.<\/p>\n\n\n\n
\n\n\n\n
Why Ports Matter as Much as IP Addresses Under CGNAT<\/h2>\n\n\n\n
When many subscribers share one public IP, the address alone is insufficient for routing return traffic to the correct connection.<\/p>\n\n\n\n
The network also tracks ports.<\/p>\n\n\n\n
A TCP connection is commonly identified using information including:<\/p>\n\n\n\n
Source IP\nSource Port\nDestination IP\nDestination Port\nProtocol<\/code><\/pre>\n\n\n\n
Conceptually:<\/p>\n\n\n\n
203.0.113.x:21001 \u2192 example.com:443\n203.0.113.x:21002 \u2192 example.com:443\n203.0.113.x:21003 \u2192 another-site.com:443<\/code><\/pre>\n\n\n\n
Even though the public source IP is identical, the connection tuples are different.<\/p>\n\n\n\n
A CGNAT device maintains state that maps these public connections back to the appropriate internal subscriber connection.<\/p>\n\n\n\n
For example:<\/p>\n\n\n\n
Public Mapping\n203.0.113.x:21001\n        \u2193\nSubscriber A\n100.64.1.10:51532<\/code><\/pre>\n\n\n\n
This is why CGNAT is fundamentally not just an IP-address mechanism.<\/p>\n\n\n\n
It is a stateful connection translation system<\/strong>.<\/p>\n\n\n\n
\n\n\n\n
One Residential IP Does Not Necessarily Mean One Household<\/h2>\n\n\n\n
This is the most important implication for proxy users.<\/p>\n\n\n\n
Suppose a website observes:<\/p>\n\n\n\n
203.0.113.x<\/code><\/pre>\n\n\n\n
It cannot determine from that address alone whether the traffic came from:<\/p>\n\n\n\n
One device\nOne household\nSeveral devices in one household\nOne subscriber\nSeveral subscribers behind CGNAT<\/code><\/pre>\n\n\n\n
The public IP identifies the public-facing network address used for the connection.<\/p>\n\n\n\n
It does not provide a one-to-one mapping to a person.<\/p>\n\n\n\n
Therefore, statements such as:<\/p>\n\n\n\n
\n
“This IP represents one user”<\/p>\n<\/blockquote>\n\n\n\n
should generally be treated with caution.<\/p>\n\n\n\n
A more accurate model is:<\/p>\n\n\n\n
Public IP\n   \u2193\nPublic Network Endpoint\n   \u2193\nPotentially One or More\nInternal Connections<\/code><\/pre>\n\n\n\n
The relationship between that endpoint and individual users depends on the underlying ISP architecture.<\/p>\n\n\n\n
\n\n\n\n
Residential IP, Device Identity, and User Identity Are Different Layers<\/h2>\n\n\n\n
A useful way to understand the problem is to separate identity into layers.<\/p>\n\n\n\n
Device identity<\/h3>\n\n\n\n
A physical or virtual device:<\/p>\n\n\n\n
Laptop\nPhone\nTablet\nSmart TV<\/code><\/pre>\n\n\n\n
Local network identity<\/h3>\n\n\n\n
An address inside a private network:<\/p>\n\n\n\n
192.168.1.25<\/code><\/pre>\n\n\n\n
Subscriber network identity<\/h3>\n\n\n\n
The connection assigned to a broadband or mobile subscriber.<\/p>\n\n\n\n
Public network identity<\/h3>\n\n\n\n
The address visible to internet destinations:<\/p>\n\n\n\n
203.0.113.x<\/code><\/pre>\n\n\n\n
Application identity<\/h3>\n\n\n\n
A website may separately recognize:<\/p>\n\n\n\n
Account\nCookies\nSession tokens\nBrowser storage\nAuthentication state<\/code><\/pre>\n\n\n\n
These layers should not be collapsed into one concept.<\/p>\n\n\n\n
For example:<\/p>\n\n\n\n
Same Public IP\n+\nDifferent Cookies\n+\nDifferent Accounts<\/code><\/pre>\n\n\n\n
can represent multiple independent application sessions.<\/p>\n\n\n\n
Likewise:<\/p>\n\n\n\n
Different Public IP\n+\nSame Account\n+\nSame Cookies<\/code><\/pre>\n\n\n\n
can still represent continuity at the application layer.<\/p>\n\n\n\n
An IP address is therefore only one network signal.<\/p>\n\n\n\n
\n\n\n\n
Why Mobile Networks Make This Even More Important<\/h2>\n\n\n\n
CGNAT is especially relevant to mobile networks.<\/p>\n\n\n\n
A mobile carrier can operate enormous numbers of connected devices while having a much smaller pool of public IPv4 addresses.<\/p>\n\n\n\n
Conceptually:<\/p>\n\n\n\n
Phone A \u2500\u2500\u2510\nPhone B \u2500\u2500\u2524\nPhone C \u2500\u2500\u2524\nPhone D \u2500\u2500\u253c\u2192 Carrier Network\nPhone E \u2500\u2500\u2524        \u2193\n   ...    \u2502      CGNAT\n          \u2502        \u2193\n          \u2514\u2192 Public IPv4 Pool<\/code><\/pre>\n\n\n\n
A public mobile IP may therefore be shared across many connections.<\/p>\n\n\n\n
The mapping can also change over time as devices:<\/p>\n\n\n\n
Reconnect\nChange radio networks\nMove between network areas\nSwitch between Wi-Fi and mobile\nReceive new carrier-side addresses<\/code><\/pre>\n\n\n\n
This is one reason mobile IP behavior can be highly dynamic.<\/p>\n\n\n\n
A public IP should not automatically be interpreted as a persistent identifier for a particular mobile device.<\/p>\n\n\n\n
\n\n\n\n
CGNAT and Dynamic IP Assignment Are Different<\/h2>\n\n\n\n
These two concepts are often confused.<\/p>\n\n\n\n
Dynamic IP assignment<\/strong> means the public address assigned to a subscriber can change over time.<\/p>\n\n\n\n
For example:<\/p>\n\n\n\n
Monday\nSubscriber A \u2192 IP 1\n\nTuesday\nSubscriber A \u2192 IP 2<\/code><\/pre>\n\n\n\n
CGNAT means multiple subscriber connections can share public address resources.<\/p>\n\n\n\n
For example:<\/p>\n\n\n\n
Subscriber A \u2500\u2510\nSubscriber B \u2500\u253c\u2192 IP 1\nSubscriber C \u2500\u2518<\/code><\/pre>\n\n\n\n
A network can use dynamic addressing without CGNAT.<\/p>\n\n\n\n
It can also use CGNAT together with dynamic addressing.<\/p>\n\n\n\n
Therefore:<\/p>\n\n\n\n
Dynamic IP\n\u2260\nCGNAT<\/code><\/pre>\n\n\n\n
although both can contribute to changing relationships between subscribers and public IPv4 addresses.<\/p>\n\n\n\n
\n\n\n\n
CGNAT Does Not Mean Every Residential IP Is Shared<\/h2>\n\n\n\n
The opposite assumption is also incorrect.<\/p>\n\n\n\n
The existence of CGNAT does not mean every residential IPv4 address is simultaneously shared by many subscribers.<\/p>\n\n\n\n
ISP architectures differ.<\/p>\n\n\n\n
A subscriber might receive:<\/p>\n\n\n\n
Dedicated public IPv4<\/code><\/pre>\n\n\n\n
or:<\/p>\n\n\n\n
Dynamic public IPv4<\/code><\/pre>\n\n\n\n
or:<\/p>\n\n\n\n
CGNAT connectivity<\/code><\/pre>\n\n\n\n
or:<\/p>\n\n\n\n
IPv6 + CGNAT IPv4<\/code><\/pre>\n\n\n\n
or another configuration.<\/p>\n\n\n\n
Even within one ISP, different access products or regions can use different architectures.<\/p>\n\n\n\n
Therefore, the correct conclusion is not:<\/p>\n\n\n\n
\n
Every residential IP is shared.<\/p>\n<\/blockquote>\n\n\n\n
It is:<\/p>\n\n\n\n
\n
A public residential IPv4 address cannot automatically be assumed to represent exactly one subscriber.<\/strong><\/p>\n<\/blockquote>\n\n\n\n
That distinction is much more accurate.<\/p>\n\n\n\n
\n\n\n\n
How CGNAT Changes the Meaning of a Residential Proxy Exit<\/h2>\n\n\n\n
Consider a residential proxy connection:<\/p>\n\n\n\n
Application\n     \u2193\nProxy Gateway\n     \u2193\nResidential Endpoint\n     \u2193\nISP Network\n     \u2193\nPublic IPv4\n     \u2193\nDestination<\/code><\/pre>\n\n\n\n
If the residential endpoint’s ISP uses CGNAT, the IP observed by the destination can be the carrier’s public-facing NAT address rather than an IPv4 address uniquely assigned to that endpoint.<\/p>\n\n\n\n
The destination sees:<\/p>\n\n\n\n
Public IPv4<\/code><\/pre>\n\n\n\n
but the underlying network may contain:<\/p>\n\n\n\n
Residential Endpoint\n       \u2193\nSubscriber Connection\n       \u2193\nCarrier NAT\n       \u2193\nShared Public IPv4<\/code><\/pre>\n\n\n\n
This means the phrase residential IP<\/strong> describes network origin and connectivity context; it should not automatically be interpreted as proof that one public IP belongs exclusively to one household or device.<\/p>\n\n\n\n
\n\n\n\n
The Proxy Layer Does Not Remove the ISP Layer<\/h2>\n\n\n\n
Another important distinction is that residential proxy routing exists on top of the underlying ISP architecture.<\/p>\n\n\n\n
A simplified view is:<\/p>\n\n\n\n
Client\n   \u2193\nProxy Provider\n   \u2193\nResidential Endpoint\n   \u2193\nISP\n   \u2193\nInternet<\/code><\/pre>\n\n\n\n
The proxy provider controls aspects such as:<\/p>\n\n\n\n
Gateway routing\nSession selection\nEndpoint selection\nProxy authentication<\/code><\/pre>\n\n\n\n
But the ISP controls another set of network behaviors:<\/p>\n\n\n\n
Address assignment\nNAT architecture\nCGNAT\nIPv4\/IPv6 connectivity\nRouting\nSubscriber connectivity<\/code><\/pre>\n\n\n\n
Therefore, some behavior observed through a residential proxy may originate from the ISP network rather than from the proxy gateway itself.<\/p>\n\n\n\n
This separation is important when diagnosing IP changes or connectivity behavior.<\/p>\n\n\n\n
\n\n\n\n
Why the Same Public IP Can Appear on Multiple Connections<\/h2>\n\n\n\n
Suppose several independent residential connections eventually reach the internet through the same carrier NAT address.<\/p>\n\n\n\n
A destination could observe:<\/p>\n\n\n\n
Connection A \u2192 203.0.113.x\nConnection B \u2192 203.0.113.x\nConnection C \u2192 203.0.113.x<\/code><\/pre>\n\n\n\n
Looking only at the IP might suggest:<\/p>\n\n\n\n
A = B = C<\/code><\/pre>\n\n\n\n
But the underlying topology could actually be:<\/p>\n\n\n\n
Endpoint A \u2500\u2510\nEndpoint B \u2500\u253c\u2192 CGNAT \u2192 203.0.113.x\nEndpoint C \u2500\u2518<\/code><\/pre>\n\n\n\n
The connections are independent even though the visible public address is shared.<\/p>\n\n\n\n
This is one reason counting unique public IPs does not necessarily count unique physical endpoints.<\/p>\n\n\n\n
\n\n\n\n
One Proxy Endpoint Can Also Change Public IPs<\/h2>\n\n\n\n
The inverse is possible.<\/p>\n\n\n\n
Consider one residential endpoint:<\/p>\n\n\n\n
Residential Endpoint A<\/code><\/pre>\n\n\n\n
At one time:<\/p>\n\n\n\n
Endpoint A\n    \u2193\nPublic IP 1<\/code><\/pre>\n\n\n\n
Later:<\/p>\n\n\n\n
Endpoint A\n    \u2193\nPublic IP 2<\/code><\/pre>\n\n\n\n
The endpoint may not have changed.<\/p>\n\n\n\n
Only its public network identity changed.<\/p>\n\n\n\n
Therefore:<\/p>\n\n\n\n
One Endpoint\n\u2192 Multiple IPs Over Time<\/code><\/pre>\n\n\n\n
while CGNAT can produce:<\/p>\n\n\n\n
Multiple Endpoints\n\u2192 One Public IP<\/code><\/pre>\n\n\n\n
Together, these relationships show why:<\/p>\n\n\n\n
Endpoint Count\n\u2260\nPublic IP Count<\/code><\/pre>\n\n\n\n
This is particularly important when measuring dynamic residential networks.<\/p>\n\n\n\n
\n\n\n\n
Why IP-Based Rate Limits Can Affect Shared Networks<\/h2>\n\n\n\n
CGNAT also creates consequences outside the proxy industry.<\/p>\n\n\n\n
Many internet services apply controls at least partly by source IP.<\/p>\n\n\n\n
If multiple independent users share one public IPv4 address, IP-level activity can become aggregated.<\/p>\n\n\n\n
Conceptually:<\/p>\n\n\n\n
User A requests\n      +\nUser B requests\n      +\nUser C requests\n      \u2193\nSame Public IPv4\n      \u2193\nDestination<\/code><\/pre>\n\n\n\n
From the destination’s network perspective, these connections share the same source address even though they may represent unrelated users.<\/p>\n\n\n\n
This is one reason modern internet services generally cannot rely on IP address alone as a perfect representation of a human identity.<\/p>\n\n\n\n
Other signals may be used depending on the application.<\/p>\n\n\n\n
\n\n\n\n
CGNAT Can Complicate Inbound Connectivity<\/h2>\n\n\n\n
Traditional NAT already makes unsolicited inbound connections more difficult because internal devices are not directly addressed by their private IPv4 addresses from the public internet.<\/p>\n\n\n\n
CGNAT adds another translation layer controlled by the ISP.<\/p>\n\n\n\n
For a subscriber behind CGNAT:<\/p>\n\n\n\n
Internet\n   \u2193\nPublic IPv4\n   \u2193\nISP CGNAT\n   \u2193\nSubscriber\n   \u2193\nHome NAT\n   \u2193\nDevice<\/code><\/pre>\n\n\n\n
The subscriber generally does not control the carrier’s NAT mapping in the same way they control their own home router.<\/p>\n\n\n\n
This is why CGNAT can affect applications that require direct inbound IPv4 connectivity.<\/p>\n\n\n\n
Proxy users primarily concerned with outbound web traffic may not notice this directly, but it is an important characteristic of the underlying residential network.<\/p>\n\n\n\n
\n\n\n\n
Port Allocation Becomes a Shared Resource<\/h2>\n\n\n\n
CGNAT conserves IPv4 addresses partly by distinguishing subscribers through transport-layer port mappings.<\/p>\n\n\n\n
But TCP and UDP ports are finite.<\/p>\n\n\n\n
A public IPv4 address has a limited port-number space per transport protocol.<\/p>\n\n\n\n
This means a carrier cannot map an unlimited number of simultaneous connections through one public address without additional architecture.<\/p>\n\n\n\n
Conceptually:<\/p>\n\n\n\n
Public IPv4\n     \u2193\nAvailable Port Space\n     \u2193\nAllocated Across Connections<\/code><\/pre>\n\n\n\n
If too many subscribers or connections are concentrated behind one public address, port resources become an engineering consideration.<\/p>\n\n\n\n
Carriers can address this using larger public pools, multiple NAT devices, port allocation strategies, load distribution, and other network designs.<\/p>\n\n\n\n
This is another reason:<\/p>\n\n\n\n
One Public IP<\/code><\/pre>\n\n\n\n
does not represent unlimited network capacity.<\/p>\n\n\n\n
\n\n\n\n
Port Exhaustion and IP Exhaustion Are Different Problems<\/h2>\n\n\n\n
It is useful to distinguish two forms of scarcity.<\/p>\n\n\n\n
IPv4 address exhaustion<\/h3>\n\n\n\n
Not enough globally unique IPv4 addresses<\/code><\/pre>\n\n\n\n
NAT port exhaustion<\/h3>\n\n\n\n
Not enough usable translation mappings\nfor the required concurrent connections<\/code><\/pre>\n\n\n\n
CGNAT helps mitigate the first problem by sharing public addresses.<\/p>\n\n\n\n
But large-scale sharing introduces the second resource-management problem.<\/p>\n\n\n\n
This illustrates a recurring networking principle:<\/p>\n\n\n\n
\n
Solving scarcity at one layer often moves resource management to another layer.<\/p>\n<\/blockquote>\n\n\n\n
For proxy infrastructure, this helps explain why raw public IP count is not equivalent to connection capacity.<\/p>\n\n\n\n
\n\n\n\n
CGNAT Can Affect Connection Persistence<\/h2>\n\n\n\n
Because CGNAT is stateful, it maintains mappings for active network flows.<\/p>\n\n\n\n
A simplified table might look like:<\/p>\n\n\n\n
Internal Connection<\/th>Public Mapping<\/th>Destination<\/th><\/tr><\/thead>
100.64.1.10:50100<\/td>203.0.113.x:21001<\/td>Server A:443<\/td><\/tr>
100.64.1.11:50200<\/td>203.0.113.x:21002<\/td>Server B:443<\/td><\/tr>
100.64.1.12:50300<\/td>203.0.113.x:21003<\/td>Server C:443<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
These mappings do not necessarily remain forever.<\/p>\n\n\n\n
Idle flows can expire.<\/p>\n\n\n\n
Connections can close.<\/p>\n\n\n\n
Network state can be recreated.<\/p>\n\n\n\n
Therefore, long-lived connections depend not only on the client and destination but also on intermediate stateful network devices.<\/p>\n\n\n\n
This becomes relevant for long-running residential connections where several layers of NAT may exist between the application and the public internet.<\/p>\n\n\n\n
\n\n\n\n
CGNAT and Sticky Proxy Sessions Are Different Layers<\/h2>\n\n\n\n
A sticky proxy session is usually a proxy-routing concept.<\/p>\n\n\n\n
For example:<\/p>\n\n\n\n
session-ABC\n      \u2193\nProxy Routing\n      \u2193\nResidential Endpoint X<\/code><\/pre>\n\n\n\n
CGNAT exists further downstream:<\/p>\n\n\n\n
session-ABC\n      \u2193\nResidential Endpoint X\n      \u2193\nISP CGNAT\n      \u2193\nPublic IPv4<\/code><\/pre>\n\n\n\n
These should not be confused.<\/p>\n\n\n\n
The proxy system may continue routing traffic to the same residential endpoint while the underlying ISP network changes how that endpoint reaches the public internet.<\/p>\n\n\n\n
Therefore:<\/p>\n\n\n\n
Same Proxy Session\n       \u2260\nGuaranteed Permanent Public IP<\/code><\/pre>\n\n\n\n
The exact behavior depends on the residential network and proxy architecture.<\/p>\n\n\n\n
This is why session identity, endpoint identity, and public IP identity should be monitored separately.<\/p>\n\n\n\n
\n\n\n\n
How IPv6 Changes the NAT Equation<\/h2>\n\n\n\n
IPv6 dramatically expands the available address space.<\/p>\n\n\n\n
Instead of using 32-bit addresses like IPv4, IPv6 uses 128-bit addresses.<\/p>\n\n\n\n
This reduces the need to conserve globally unique addresses using traditional IPv4 NAT techniques.<\/p>\n\n\n\n
A simplified IPv6 architecture can look more like:<\/p>\n\n\n\n
Device\n   \u2193\nGlobally Unique IPv6 Address\n   \u2193\nRouter \/ Firewall\n   \u2193\nISP\n   \u2193\nInternet<\/code><\/pre>\n\n\n\n
That does not mean IPv6 removes firewalls, privacy mechanisms, address changes, prefix delegation, or all forms of translation.<\/p>\n\n\n\n
It means the fundamental pressure that drove widespread IPv4 address sharing is different.<\/p>\n\n\n\n
This is one reason many modern ISP networks operate with combinations such as:<\/p>\n\n\n\n
IPv6\n+\nCGNAT IPv4<\/code><\/pre>\n\n\n\n
A subscriber can receive native IPv6 connectivity while IPv4 traffic continues through carrier-grade translation.<\/p>\n\n\n\n
\n\n\n\n
Dual-Stack Residential Networks Can Have Two Very Different Identities<\/h2>\n\n\n\n
Consider a dual-stack household.<\/p>\n\n\n\n
Its IPv4 path might be:<\/p>\n\n\n\n
Device\n  \u2193\nHome NAT\n  \u2193\nCGNAT\n  \u2193\nShared Public IPv4<\/code><\/pre>\n\n\n\n
while IPv6 might look like:<\/p>\n\n\n\n
Device\n  \u2193\nIPv6 Prefix\n  \u2193\nISP\n  \u2193\nPublic IPv6<\/code><\/pre>\n\n\n\n
The same physical device therefore participates in two very different addressing models.<\/p>\n\n\n\n
A website reached over IPv4 may see a shared carrier address.<\/p>\n\n\n\n
A website reached over IPv6 may see an address belonging to a delegated IPv6 prefix.<\/p>\n\n\n\n
This makes the statement:<\/p>\n\n\n\n
\n
“What is this user’s IP?”<\/p>\n<\/blockquote>\n\n\n\n
less straightforward than it appears.<\/p>\n\n\n\n
A device can simultaneously have multiple network identities depending on protocol and connection path.<\/p>\n\n\n\n
\n\n\n\n
NAT Type Can Matter More Than Users Realize<\/h2>\n\n\n\n
Not every NAT implementation handles mappings identically.<\/p>\n\n\n\n
Mapping behavior can depend on factors such as:<\/p>\n\n\n\n
Source address\nSource port\nDestination address\nDestination port\nTransport protocol\nTimeout policy<\/code><\/pre>\n\n\n\n
Different NAT behaviors can affect peer-to-peer connectivity, UDP applications, long-lived flows, and inbound reachability.<\/p>\n\n\n\n
For ordinary outbound HTTP and HTTPS proxy traffic, many of these details remain invisible to the application.<\/p>\n\n\n\n
But for network engineers, they help explain why two residential networks using NAT can still exhibit different connection behavior.<\/p>\n\n\n\n
\n\n\n\n
How to Detect Whether a Network May Be Behind CGNAT<\/h2>\n\n\n\n
From inside a network, one useful clue is comparing the WAN-side IPv4 address assigned to the customer equipment with the public IPv4 address observed by an external service.<\/p>\n\n\n\n
For example:<\/p>\n\n\n\n
Router WAN IP:\n100.72.x.x\n\nExternal IP:\n203.0.113.x<\/code><\/pre>\n\n\n\n
Because 100.64.0.0\/10<\/code> is shared address space intended for service-provider use, seeing an address from that range on the ISP-facing side can be evidence of carrier-grade translation upstream.<\/p>\n\n\n\n
Another possible pattern is:<\/p>\n\n\n\n
Router WAN IPv4\n        \u2260\nObserved Public IPv4<\/code><\/pre>\n\n\n\n
However, network architectures vary, and this alone should not be used as a universal classification method without additional context.<\/p>\n\n\n\n
The important point for proxy analysis is that the public address seen by a website does not expose the entire path behind it.<\/p>\n\n\n\n
\n\n\n\n
A Better Data Model for Residential Proxy Observations<\/h2>\n\n\n\n
Instead of recording only:<\/p>\n\n\n\n
{\n  \"ip\": \"203.0.113.x\"\n}<\/code><\/pre>\n\n\n\n
a more useful network observation can include:<\/p>\n\n\n\n
{\n  \"exit_ip\": \"203.0.113.x\",\n  \"ip_version\": 4,\n  \"asn\": \"AS64500\",\n  \"network_type\": \"residential\",\n  \"country\": \"JP\",\n  \"session_id\": \"session-abc\",\n  \"first_seen\": \"2026-09-24T08:00:00Z\",\n  \"last_seen\": \"2026-09-24T08:18:00Z\"\n}<\/code><\/pre>\n\n\n\n
If the system controls endpoint-level telemetry, it can separately track an internal endpoint identifier.<\/p>\n\n\n\n
Conceptually:<\/p>\n\n\n\n
Endpoint ID\n     \u2193\nSession ID\n     \u2193\nPublic IP\n     \u2193\nASN\n     \u2193\nTimestamp<\/code><\/pre>\n\n\n\n
This makes it possible to detect two important relationships:<\/p>\n\n\n\n
One Endpoint \u2192 Multiple Public IPs<\/code><\/pre>\n\n\n\n
and:<\/p>\n\n\n\n
One Public IP \u2192 Multiple Endpoints<\/code><\/pre>\n\n\n\n
Those relationships cannot be understood from public IP strings alone.<\/p>\n\n\n\n
\n\n\n\n
Why This Matters When Measuring Residential Proxy Networks<\/h2>\n\n\n\n
Suppose a test observes:<\/p>\n\n\n\n
100,000 unique public IPs<\/code><\/pre>\n\n\n\n
It would be incorrect to automatically conclude:<\/p>\n\n\n\n
100,000 unique devices<\/code><\/pre>\n\n\n\n
or:<\/p>\n\n\n\n
100,000 unique households<\/code><\/pre>\n\n\n\n
because NAT, CGNAT, dynamic address assignment, and endpoint churn can break those one-to-one assumptions.<\/p>\n\n\n\n
Likewise, observing the same public IP repeatedly does not prove that every connection originated from the same physical endpoint.<\/p>\n\n\n\n
Therefore, different measurements should answer different questions:<\/p>\n\n\n\n
Unique Public IPs\n\u2192 Address diversity\n\nUnique ASNs\n\u2192 Network diversity\n\nUnique ISPs\n\u2192 Provider diversity\n\nUnique Endpoints\n\u2192 Endpoint diversity, if measurable\n\nSession Lifetime\n\u2192 Routing persistence\n\nPublic IP Lifetime\n\u2192 Address persistence<\/code><\/pre>\n\n\n\n
A professional proxy benchmark should avoid using one metric as a substitute for another.<\/p>\n\n\n\n
\n\n\n\n
Where ColaProxy<\/a> Fits Into NAT and CGNAT Networks<\/h2>\n\n\n\n
Residential proxy infrastructure such as ColaProxy operates within the broader architecture of consumer ISP and mobile networks.<\/p>\n\n\n\n
A simplified path can be represented as:<\/p>\n\n\n\n
Application\n     \u2193\nColaProxy Gateway\n     \u2193\nResidential Proxy Endpoint\n     \u2193\nLocal \/ ISP Network\n     \u2193\nNAT or CGNAT Where Applicable\n     \u2193\nPublic Internet\n     \u2193\nDestination<\/code><\/pre>\n\n\n\n
Different residential endpoints can exist behind different ISP architectures.<\/p>\n\n\n\n
One endpoint may have a directly assigned public IPv4 address.<\/p>\n\n\n\n
Another may operate behind CGNAT.<\/p>\n\n\n\n
Another may use dual-stack IPv4 and IPv6 connectivity.<\/p>\n\n\n\n
For permitted web automation and data collection, developers therefore benefit from treating the observed exit IP as one property of the connection rather than assuming it uniquely identifies the underlying device or subscriber.<\/p>\n\n\n\n
Proxy routing, residential endpoint selection, ISP addressing, and destination-side application state are separate layers of the complete system.<\/p>\n\n\n\n
\n\n\n\n
The Better Mental Model: IP Addresses Identify Network Paths, Not People<\/h2>\n\n\n\n
The simplest way to avoid confusion is to stop treating an IP address as a universal identity.<\/p>\n\n\n\n
A public IP tells you something important:<\/p>\n\n\n\n
\n
This network connection reached the destination using this public internet address.<\/p>\n<\/blockquote>\n\n\n\n
But it does not automatically tell you:<\/p>\n\n\n\n
Who the person is\nHow many devices are behind the address\nHow many subscribers share it\nWhether the same subscriber will use it tomorrow\nWhether the same endpoint used it yesterday<\/code><\/pre>\n\n\n\n
A better model is:<\/p>\n\n\n\n
Person\n   \u2193\nApplication\n   \u2193\nDevice\n   \u2193\nLocal Network\n   \u2193\nSubscriber Connection\n   \u2193\nNAT \/ CGNAT\n   \u2193\nPublic IP\n   \u2193\nInternet Service<\/code><\/pre>\n\n\n\n
Each layer represents a different type of identity.<\/p>\n\n\n\n
Collapsing all of them into “the IP” creates incorrect assumptions.<\/p>\n\n\n\n
\n\n\n\n
Conclusion<\/h2>\n\n\n\n
CGNAT proxy<\/strong> infrastructure should be understood in the context of the modern residential internet, where public IPv4 addresses are increasingly shared, dynamically assigned, and separated from individual devices by multiple network layers.<\/p>\n\n\n\n
Traditional home NAT already allows many devices to share one public address.<\/p>\n\n\n\n
CGNAT extends that model by allowing an ISP or carrier to share public IPv4 resources across multiple subscriber connections.<\/p>\n\n\n\n
As a result:<\/p>\n\n\n\n
One IP\n\u2260\nOne Device\n\u2260\nOne User\n\u2260\nOne Household<\/code><\/pre>\n\n\n\n
The reverse relationship can also occur. One residential endpoint can use different public IP addresses over time because of dynamic addressing or changes in the underlying network.<\/p>\n\n\n\n
For proxy infrastructure, this means public IP count, endpoint count, subscriber count, and network diversity should be treated as separate concepts.<\/p>\n\n\n\n
IPv4 exhaustion helped make address sharing increasingly important. IPv6 changes the economics of address scarcity, but the modern internet will continue to contain a mixture of IPv4, IPv6, NAT, CGNAT, and dual-stack networks.<\/p>\n\n\n\n
The most useful principle is therefore simple:<\/p>\n\n\n\n
\n
A residential IP describes a network-facing identity\u2014not a guaranteed one-to-one identity for a person, device, or household.<\/strong><\/p>\n<\/blockquote>\n\n\n\n
\n\n\n\n
Frequently Asked Questions<\/h2>\n\n\n\n
What is CGNAT?<\/h3>\n\n\n\n
Carrier-Grade NAT is a network architecture in which an ISP or carrier translates traffic from multiple subscriber connections through a shared pool of public IPv4 addresses.<\/p>\n\n\n\n
Does one residential IP mean one user?<\/h3>\n\n\n\n
No. A public residential IP can represent multiple devices in one household, and with CGNAT it can potentially be shared by multiple subscriber connections. An IP address should not be treated as a unique user identifier.<\/p>\n\n\n\n
Can multiple households share the same public IPv4 address?<\/h3>\n\n\n\n
Yes. When an ISP uses CGNAT, multiple subscribers can share public IPv4 resources while their connections are distinguished internally through NAT mappings.<\/p>\n\n\n\n
What is the difference between NAT and CGNAT?<\/h3>\n\n\n\n
Traditional NAT commonly operates at the customer’s router and lets multiple local devices share an internet connection. CGNAT operates inside the ISP or carrier network and can allow multiple subscribers to share public IPv4 addresses.<\/p>\n\n\n\n
What is the 100.64.0.0\/10 network?<\/h3>\n\n\n\n
100.64.0.0\/10<\/code> is shared IPv4 address space reserved for service-provider environments such as carrier-grade NAT. It is distinct from ordinary RFC 1918 private ranges such as 192.168.0.0\/16<\/code>.<\/p>\n\n\n\n
Does CGNAT change a residential proxy’s public IP?<\/h3>\n\n\n\n
CGNAT can affect how a residential endpoint reaches the public internet. The public address visible to a destination can be an ISP’s carrier-side NAT address rather than an IPv4 address uniquely assigned to the endpoint.<\/p>\n\n\n\n
Is CGNAT the same as a rotating proxy<\/a>?<\/h3>\n\n\n\n
No. CGNAT is an ISP networking mechanism for sharing public IPv4 resources. Proxy rotation is a proxy-routing mechanism for selecting or changing exit paths. They operate at different layers.<\/p>\n\n\n\n
Does IPv6 eliminate CGNAT?<\/h3>\n\n\n\n
IPv6 greatly reduces the need to conserve addresses in the same way as IPv4, but real networks can use multiple technologies simultaneously. A subscriber may have native IPv6 while IPv4 traffic still passes through CGNAT.<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
CGNAT proxy infrastructure exists inside an internet where one public IP address no longer necessarily represents one device, one subscriber, or even one household. Network Address Translation (NAT) a\u2026<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-1997","post","type-post","status-publish","format-standard","hentry","category-proxy"],"_links":{"self":[{"href":"\/blog\/wp-json\/wp\/v2\/posts\/1997","targetHints":{"allow":["GET"]}}],"collection":[{"href":"\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"\/blog\/wp-json\/wp\/v2\/comments?post=1997"}],"version-history":[{"count":1,"href":"\/blog\/wp-json\/wp\/v2\/posts\/1997\/revisions"}],"predecessor-version":[{"id":1998,"href":"\/blog\/wp-json\/wp\/v2\/posts\/1997\/revisions\/1998"}],"wp:attachment":[{"href":"\/blog\/wp-json\/wp\/v2\/media?parent=1997"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"\/blog\/wp-json\/wp\/v2\/categories?post=1997"},{"taxonomy":"post_tag","embeddable":true,"href":"\/blog\/wp-json\/wp\/v2\/tags?post=1997"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}