What Is CGNAT and Why It Breaks IP Geolocation

Carrier-grade NAT, or CGNAT, is a method used by Internet Service Providers (ISPs) and mobile carriers to conserve IPv4 addresses. Rather than giving each customer their own public IP address, CGNAT assigns a single public IP address to a large group of users, typically those within a single household or geographical area. This is because IPv4, the current version of the Internet Protocol, has only about 4.3 billion possible unique addresses, and these were largely exhausted by the early 2010s.

When a user connects to the internet through CGNAT, their traffic is routed through the ISP's network and then mapped onto the small pool of shared public IPv4 addresses. This process involves two layers of translation. First, the user's local router translates the private IP address (usually in the 192.168.x.x range) to a non-routable address used by the ISP. Then, the ISP translates this address again to a public IPv4 address that can be routed across the internet.

Because of this NAT444 setup (NAT for three address realms: the private network, the CGNAT's non-routable address space, and the public IPv4 address space), many unrelated customers can share one public IP address. This can lead to inaccurate geolocation data. For example, a mobile device in one town might appear to be located in a city 200 km away, while a rate limit set for one abuser might inadvertently affect many other users on the same CGNAT pool.

The issue is exacerbated by mobile networks, where the public IP address reflects the carrier's gateway rather than the specific device. This can result in geolocation errors of up to 207 km for mobile connections, compared to just 16 km for fixed broadband connections. Even country-level geolocation looks up may still be relatively accurate, with fewer than 1% of observations landing in the wrong country.

One direct consequence of CGNAT is that many rate-limiting or banning systems designed for IP-based identification will be less effective, as they treat each IP address as a unique user. However, since many mobile users are geolocated hundreds of kilometers away due to CGNAT, relying solely on city-level geolocation can also lead to inaccurate results. Therefore, it's recommended to treat the country as a stable factor, the city as a potential hint, and never to treat the IP address as a unique user identifier.

The widespread use of CGNAT is largely due to the depletion of IPv4 addresses and the slow rollout of IPv6. As such, it is unlikely to disappear anytime soon. Developers who rely on IP data for geolocation, rate-limiting, or user identification should be aware of these potential inaccuracies, especially in mobile traffic.