Port forwarding not working (CGNAT / double NAT) Networking Origin: Network OSI layer 3 · Network Last updated 5 Nov 2026

Networking: Port forwarding configured but the port stays closed — carrier-grade NAT (CGNAT) or double NAT

Your router forwards the port correctly, but another NAT in front of it (your ISP or a second router) blocks inbound connections.

Exact message you may see carrier-grade NATdouble NAT port forwarding not workingWAN IP 100.64port forwarding not working
Explore the map of this error Full error map →
Seen on: Networking Linux

Meaning

If the router's WAN IP is in 100.64.0.0/10, 10.x, 172.16-31.x or 192.168.x, it isn't a real public IP. Ask the ISP for a public (or static) IP, put the upstream router in bridge/DMZ mode, or use a tunnel/reverse proxy (Cloudflare Tunnel, Tailscale, WireGuard to a VPS).

Common causes

  • ISP uses CGNAT (WAN IP 100.64.x.x)
  • Router behind another router (double NAT)
  • Port forward to the wrong LAN IP or protocol
  • Host firewall blocks the port
  • ISP blocks inbound ports (e.g. 80/25)

⚡ Quick fix

  1. Compare the router WAN IP with curl ifconfig.me
  2. Bridge the upstream modem or ask for a public IP
  3. Use a tunnel or VPS reverse proxy

Detailed fix by platform

Shell

  1. text
    curl -s ifconfig.me; echo
# if this differs from the router's WAN IP, you are behind CGNAT/double NAT

How to diagnose

  1. WAN IP — Matches public IP?
  2. Upstream device — Router mode?
  3. Forward — Correct IP/protocol?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

arp -a shows (incomplete) — Networking: `arp -n` shows (incomplete) / Destination Host Unreachable — no ARP reply from the next hop (Networking)arp -a shows (incompl…Cannot assign requested address (EADDRNOTAVAIL) — Networking: connect: Cannot assign requested address — ephemeral port range exhausted by TIME_WAIT connections (Networking)Cannot assign request…DHCPDISCOVER: no free leases — Networking: dhcpd: DHCPDISCOVER from aa:bb:cc:dd:ee:ff via eth0: network 192.168.1.0/24: no free leases (Networking)DHCPDISCOVER: no free…Idle connections silently dropped by firewall/NAT — Networking: Connection works, then fails after being idle — firewall/NAT idle timeout dropped the TCP session (use keepalive) (Networking)Idle connections sile…MAC flapping / broadcast storm (spanning tree loop) — Networking: %SW_MATM-4-MACFLAP_NOTIF: Host is flapping between ports / broadcast storm (Networking)MAC flapping / broadc…NAT gateway SNAT port exhaustion (ErrorPortAllocation) — Networking: NAT gateway ErrorPortAllocation / SNAT port exhaustion — intermittent outbound connection timeouts (Networking)NAT gateway SNAT port…Native VLAN mismatch / wrong VLAN, no connectivity — Networking: %CDP-4-NATIVE_VLAN_MISMATCH / device on the wrong VLAN can't reach the gateway (Networking)Native VLAN mismatch …nc/telnet hangs: firewall DROP vs REJECT — Networking: nc -vz hangs then times out — firewall silently DROPs packets (REJECT would answer "Connection refused") (Networking)nc/telnet hangs: fire…Port forw…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.