Can't port forward your Minecraft server? Check CGNAT

⚡ The short answer

If you forwarded the port on your router, the server starts, you can join from your own network and your friends still can't connect, the most likely cause is that your internet provider uses CGNAT. It isn't a fault and it isn't your mistake: it's how many providers hand out IP addresses, and it makes port forwarding on your router pointless. You can check it in two minutes, and there are several ways around it.

🌐 What CGNAT is

For someone outside to reach a server running in your home, your connection needs a public IP address of its own. IPv4 addresses have run out, and many providers no longer give one to each customer: they put many customers behind a single public IP, using a NAT like the one in your router but inside their own network. That is carrier-grade NAT, or CGNAT.

For browsing, streaming or playing on other people's servers you won't notice a thing. The problem only shows up when you want to receive connections: the port you opened on your router is open, but in front of it sits another device, the provider's, which you don't control and which lets nothing through to your home.

🔎 How to tell if you're behind it

• 1. Check your router's WAN IP. Log in to the router's settings and find the status or Internet page: it shows the address your provider assigned you.
• 2. Check your public IP. Search for “what is my IP” in a browser.
• 3. Compare. If they match, you have a public IP and the fault is elsewhere (the port, your PC's firewall). If they differ, there's another NAT in the way.

A clear sign: if the WAN IP starts with a number between 100.64 and 100.127, you're in the range set aside specifically for CGNAT. If it starts with 10., 192.168. or anything from 172.16 to 172.31, it may be CGNAT, or you may have two routers chained at home (the provider's modem and your own); in that case the port has to be forwarded on the first one as well.

🧭 Your options

Option	How it works	Worth knowing
Ask for a public IP	You contact your provider and request one	Some give it for free, some charge, some don't offer it
A tunnel	A program on your PC connects outwards to a service that does have a public address (playit.gg, for example); friends join through that address	No router changes, but all traffic takes a detour through that service
A VPN between friends	Everyone installs the same program (Hamachi, Radmin VPN, ZeroTier) and plays as if on the same network	Every player has to install and set it up
IPv6	If your provider gives you IPv6, that connection doesn't go through CGNAT	Only works if all your friends have IPv6 too
Hosting	The server no longer lives in your home	There's a monthly cost; in return, a fixed address and always on

🏠 What the home-made options don't fix

Even once your friends can get in, the server still depends on your PC: it has to stay on while anyone is playing, and it shares RAM with your own game. For a weekend session that doesn't matter. For a world where everyone logs in at a different time, it does.

☁️ When hosting starts to make sense

With Minecraft hosting, CGNAT stops being your problem: the server has a fixed address, you forward no ports, and it stays up when your PC is off. On ZentexNode it activates automatically on payment, there's no minimum term and Anti-DDoS protection is included. And you don't start from scratch: you can upload the world you already have and carry on where you left off.

If you're still deciding, how to create a Minecraft server to play with friends compares the three ways of doing it.

❓ Quick questions

Does this only affect Minecraft?
No. Any server hosted at home (Valheim, Terraria, Project Zomboid) needs to receive connections, and behind CGNAT they never arrive.

Can I turn it off myself?
No: it sits in your provider's network. Only they can give you a public IP.

Is it a security problem?
No. It's a way of sharing addresses that simply wasn't designed for hosting servers at home.