Why You Can't Host a Server
Port forwarding is the mechanism that lets you run a publicly accessible service from your home network. It works by telling your router: "Any incoming connection on port 25565 should be sent to the PC at 192.168.1.10." This works because your router owns the public IP — it's the authoritative endpoint for all traffic destined for that address.
CGNAT breaks this completely, and understanding why requires thinking about what "owning" an IP address means.
When you have a real public IP, the internet's routing tables say: "Traffic for 203.0.113.5 goes to this ISP, which delivers it to this specific customer's router." Your router is the final destination for that IP. It can decide what to do with incoming packets.
Under CGNAT, the ISP's edge router is the final destination for the public IP. Your home router sits behind it, invisible to the internet. When a packet arrives at the ISP's edge router destined for port 25565, the edge router looks at its NAT table and asks: "Which of my 1,000 customers did this packet come from?" For outbound traffic, it knows — it created the mapping when the customer's traffic went out. For inbound traffic with no prior outbound connection, there is no mapping. The packet has nowhere to go and is dropped.
The cascade of things that break:
| Use Case | Why It Breaks |
|---|---|
| Home web server | Incoming HTTP/HTTPS has no NAT mapping |
| Minecraft server | Clients can't reach your port 25565 |
| VPN server (WireGuard/OpenVPN) | Incoming VPN connections dropped |
| Remote desktop (RDP/VNC) | No inbound path exists |
| IP cameras (remote access) | DVR's port forward is invisible to internet |
| Self-hosted Plex (direct play) | Falls back to relay, degrades quality |
The key insight: Port forwarding is a configuration on your router. But under CGNAT, your router's WAN interface is not the public IP — it's a private address. You'd need to configure port forwarding on the ISP's edge router, which you don't have access to. Even if you could, the ISP's router is shared with thousands of other customers, so it can't forward a given port to just one of them.
Key Point: Some ISPs offer a workaround called port allocation or NAT-PMP/PCP (Port Control Protocol), where your router can request that the ISP's CGNAT device open a specific external port and map it to you. This is rare and ISP-dependent. RFC 6887 defines PCP for exactly this purpose, but adoption is inconsistent. If your ISP supports it, your router firmware may expose it as "CGNAT port forwarding" or "external port request."