What it means
Your router may translate local addresses once, while the provider translates them again upstream. Browsing usually works because connections start inside. An incoming request cannot automatically identify which subscriber should receive it. CGNAT does not mean your devices are publicly reachable, nor does it replace their security.
How this affects everyday use
Remote access, game hosting or some peer connections can fail despite a correct local forwarding rule. A router WAN address in 100.64.0.0/10 suggests shared address space, but provider confirmation is more reliable than one test.
A practical example
A home server works locally yet cannot be contacted from mobile data outside the house.
What to check
- Compare the router's WAN address with a trusted public-address check.
- Ask the provider whether the connection uses CGNAT.
- Test the service locally before investigating incoming access.
Practical next steps
- Use a supported authenticated outbound remote-access solution where appropriate.
- Ask about a suitable public-address service without assuming availability.
- Remove unsuccessful exposure rules.
Keeping it reliable
Prefer least-privilege access and maintain updates. IPv6 needs separate firewall consideration; it is not a reason to expose the server broadly.