# Networking: Port forwarding configured but the port stays closed — carrier-grade NAT (CGNAT) or double NAT

**Code:** `Port forwarding not working (CGNAT / double NAT)` · **Category:** Networking · **Seen on:** Networking, Linux

Your router forwards the port correctly, but another NAT in front of it (your ISP or a second router) blocks inbound connections.

## Meaning

If the router's WAN IP is in 100.64.0.0/10, 10.x, 172.16-31.x or 192.168.x, it isn't a real public IP. Ask the ISP for a public (or static) IP, put the upstream router in bridge/DMZ mode, or use a tunnel/reverse proxy (Cloudflare Tunnel, Tailscale, WireGuard to a VPS).

## Common causes

- ISP uses CGNAT (WAN IP 100.64.x.x)
- Router behind another router (double NAT)
- Port forward to the wrong LAN IP or protocol
- Host firewall blocks the port
- ISP blocks inbound ports (e.g. 80/25)

## Quick fix

1. Compare the router WAN IP with `curl ifconfig.me`
2. Bridge the upstream modem or ask for a public IP
3. Use a tunnel or VPS reverse proxy

## Detailed fix by platform

### Shell

1. 

```
curl -s ifconfig.me; echo
# if this differs from the router's WAN IP, you are behind CGNAT/double NAT
```


## How to diagnose

1. **WAN IP** — Matches public IP?
2. **Upstream device** — Router mode?
3. **Forward** — Correct IP/protocol?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/networking/cgnat-port-forwarding-not-working)