How to host a Minecraft server behind CGNAT

How to confirm you are behind carrier-grade NAT, why port forwarding cannot work when you are, and what does.

Carrier-grade NAT means your ISP has put you behind a shared public address. Many customers sit behind the same IP, and the translation happens on the ISP's equipment rather than in your home.

The practical consequence: there is no port on a public address that belongs to you, so there is nothing to forward to. No router setting fixes this, because the equipment that would need changing is not yours.

#How to confirm you are behind CGNAT

Two checks, about a minute, conclusive.

Compare two addresses. Log into your router and find the WAN or Internet address it reports. Then load any "what is my IP" site from a device on that network. If the two differ, there is another layer of translation between you and the internet and it belongs to your ISP.

Look at the range. If the router's WAN address falls between 100.64.0.0 and 100.127.255.255, that range is reserved specifically for carrier-grade NAT. Seeing an address there settles it.

A WAN address starting 10., 172.16 through 172.31, or 192.168 means the same thing by a different route: the address is private, so nothing outside can reach it.

#Why port forwarding cannot work

A port forward tells your router that traffic arriving on a given port should go to a given machine. It only helps if traffic actually arrives at your router.

Under CGNAT a player connecting to the public address reaches your ISP's equipment, which is handling many other customers on that same address at the same time. It has no way to know port 25565 was meant for you rather than for someone else, and no rule you can set to tell it. Your forward is correct and useless simultaneously.

This is why normal troubleshooting fails here. That advice is aimed at a misconfigured forward, and yours is not misconfigured.

#What your ISP can do

Worth asking first, because it is sometimes cheap and it is the cleanest fix.

• A public IPv4 address. Many ISPs sell one for a small monthly fee and some will move you off CGNAT on request at no charge. Ask specifically for a public IPv4 address. Asking for a "static IP" can get you a static private one, which does not help.
• A business tariff. Usually includes a public address and usually costs meaningfully more.
• IPv6. Many CGNAT deployments hand out real IPv6 alongside the shared IPv4, and a Minecraft server can listen on it. The catch is that every player needs working IPv6 too, and plenty of home and mobile connections still do not have it. Treat this as a bonus rather than a plan.

#The three approaches that work regardless

A tunnel. A client on your machine dials out to a relay, and players connect to the relay. Outbound connections are unaffected by CGNAT, so this sidesteps the problem rather than working around it. Lowest friction for players, who install nothing.

A mesh VPN. Tailscale, ZeroTier and similar build a private network between machines. Also unaffected by CGNAT and invisible from outside, but every player installs a client and joins.

Host elsewhere. Free or paid hosting takes your connection out of the path entirely, and is the only option here that also survives your PC being off.

#What does not work

To save you the search, none of these address what CGNAT does:

• Port forwarding rules, in any configuration
• UPnP, which asks your router to open a port it does not control either
• DMZ mode, for the same reason
• Dynamic DNS, which solves a changing address rather than an unreachable one
• Restarting the router, unless your ISP happens to move you off CGNAT on reconnection, which is uncommon and not worth relying on

Each of these is widely recommended for connection problems generally, which is why they keep coming up.

#Does CGNAT affect performance?

Not in a way you would notice while playing. The translation adds a small amount of latency and the equipment is built for the load.

What it can affect is long idle connections, because NAT table entries expire. Minecraft sends keepalive packets as part of its protocol, which normally prevents this from mattering.

#Where Self Hostd fits

We make one of the tools described above, so weigh this accordingly. Self Hostd is a tunnel built for this case: the launcher sits beside your server, dials out, and players get a fixed address that works regardless of what your ISP does with IPv4.

If you need the server up when your PC is off, a tunnel does not solve that, and hosting is the better answer.

Written and maintained by the Hostd engineering team. Last updated 2026-08-11. Notice a mistake? Tell us.