Every new subscriber needs an address, and IPv4 ran out years ago. The transfer market settled what one is worth: buying a /24 to give every household a public IPv4 is no longer defensible for an operator adding thousands of lines a year. IPv6 is the endgame, but no provider can move its installed base — or the rest of the internet — onto it on a schedule of its own choosing.
Carrier-grade NAT covers that gap. In a cgnat deployment many subscribers share one public address: each gets a block of ports, the translator rewrites source addresses and ports both ways, and one address serves dozens to hundreds of customers depending on how generous the port allocation is. That is the difference between buying addresses and buying capacity.
Three details decide whether the deployment is comfortable to live with.
Logging. Per-session logging turns into terabytes and a legal liability the moment an abuse request arrives. Deterministic NAT avoids it: port blocks follow a fixed rule, so a subscriber is identified from address, port and timestamp by computing the mapping instead of searching logs.
Inbound connections. Anything expecting to be reached from outside — console gaming, self-hosting, some VPN and camera setups — breaks behind shared addressing. Plan the exceptions up front: port forwarding, static allocations, or a paid public address on request.
Sizing. Capacity is bounded by concurrent sessions, not bandwidth alone. A modern page opens dozens of connections, so a thin port budget shows up as intermittent failures long before any link saturates.
Where CGNAT runs has changed too. It was appliance territory for a decade; software forwarding stacks on commodity x86 now handle hundreds of gigabits per server, and independent testing — EANTC has published validations of large-scale software deployments — made that a normal procurement option. Capacity then grows in server increments, on whatever virtualization the network already runs.
None of this makes CGNAT a destination. It buys the years an IPv6 programme actually takes, while DS-Lite and NAT64 let both stacks coexist until the migration finishes. Treat it as a bridge with a maintenance plan, not as a permanent answer to address scarcity.
None of this makes CGNAT a destination. It buys the years an IPv6 programme actually takes, while DS-Lite and NAT64 let both stacks coexist until the migration finishes. Treat it as a bridge with a maintenance plan, not as a permanent answer to address scarcity.