Short answer: if the WAN IPv4 address on your router is between 100.64.0.0 and 100.127.255.255, or differs from the address websites see, you are behind CGNAT. Instead of forwarding ports, run a client that opens an outbound tunnel. The Zorven client does this with one command, on the free plan too.
What is CGNAT and why do ISPs use it?
There are not enough IPv4 addresses for every subscriber, so ISPs hand your router an internal address and translate traffic through a large NAT device in their own network. The block reserved for this is 100.64.0.0/10: RFC 6598 calls it "Shared Address Space", says it is not globally routable, and reserves it for links between carrier-grade NAT devices and customer equipment.
Your home router already does NAT for your 192.168.x.x network. With CGNAT there is a second NAT on top, run by the ISP. Outbound traffic (browsing, game clients, video calls) works fine. Inbound connections, which is what hosting a server needs, are dropped at the ISP's NAT because it does not know which customer they belong to. A port-forwarding rule on your router only changes your NAT, not theirs.
How can I tell if I am behind CGNAT?
- Read your router's WAN address. Open the router admin page and note the IPv4 address on the WAN, Internet or Status page.
- Find your public IP. From the same network, open any "what is my IP" page or query an IP echo service from a terminal.
- Compare them. If they match, you have a public IP and port forwarding should work. If they differ, there is another NAT in the path.
- Confirm with traceroute. Run
tracert -d 1.1.1.1on Windows ortraceroute -n 1.1.1.1on Linux and macOS. A hop in the 100.64-100.127 range right after your router means your traffic crosses the ISP's shared address space.
What the router's WAN address tells you:
| WAN IPv4 address | Meaning | Port forwarding |
|---|---|---|
| 100.64.0.0 – 100.127.255.255 | CGNAT (RFC 6598 shared address space) | Does not work |
| 10.x, 172.16-31.x, 192.168.x | Private address (RFC 1918): ISP NAT or a second router in your home | Usually does not work |
| Same as your public IP | You have a public IP (dynamic or static) | Works |
If the WAN address is private, first check for a modem-plus-router chain at home. That "double NAT" is something you can fix yourself; the ISP's NAT is not.
What are the options for CGNAT port forwarding?
Four common approaches, compared on cost, setup and limits:
| Criterion | Public/static IP from ISP | IPv6 | VPS + reverse tunnel | Tunnel service (Zorven) |
|---|---|---|---|---|
| Cost | Monthly add-on, varies by ISP | No extra cost | VPS rental | Free plan $0; paid plans from $5/month |
| Setup | Request it, configure router | Needs ISP and router support | WireGuard/SSH/frp config and upkeep | Install the client, one command |
| Who can connect | Anyone | Only visitors with IPv6 | Anyone | Anyone, or only signed-in visitors |
| HTTPS certificate | You set it up | You set it up | You set it up | Automatic |
| Limits | Not offered everywhere | Unreachable from IPv4-only clients | You run the server | Plan traffic and tunnel limits |
A public IP is the most direct fix but usually costs extra and some ISPs do not offer it on every product, so ask yours. IPv6 sidesteps CGNAT if both your ISP and your visitors have it, and you open the service in the router firewall. A VPS reverse tunnel (your home machine dials out to a VPS over WireGuard or SSH, and the VPS forwards inbound traffic back) is flexible, but you maintain and secure the VPS. A tunnel service gives you the same pattern ready-made.
How do I self-host behind CGNAT with Zorven?
The Zorven client opens one encrypted outbound connection to the Zorven server, and visitor traffic comes back to your device over it. No port forwarding and no static IP.
- Create a free account at panel.zorven.app, add a client and copy its token (it starts with
zrv_live_). - Install the client (packages for Windows, macOS and Linux are on the download page) with your token:
curl -fsSL https://zorven.app/install.sh | sudo bash -s -- --token zrv_live_... - Publish a web service. For an app on port 3000:
The output shows anzorven 3000https://<name>--<slug>.zorven.appaddress with a valid certificate. - For non-web services (SSH, a game server, a database), create a raw TCP tunnel under "New tunnel" in the dashboard with a target such as
tcp://127.0.0.1:22. The dashboard shows the connection address (zorven.app:PORT). - To bring the tunnel up at boot, install the background service:
sudo zorven service install --token zrv_live_... --server zorven.app:443
The Free plan includes 2 clients, 2 tunnels and 5 GB of traffic per month; when the quota runs out the connection is throttled to 1 Mbps, not cut. Custom domains start on Hobby, and IP allowlists and advanced UDP on Pro. See pricing for every limit and the docs for all commands. For home-server use cases see Zorven for individuals; for games, read Minecraft server without port forwarding; for webhooks, test webhooks locally. All guides are listed under guides.
When should you pick a different approach?
- BitTorrent and other peer-to-peer apps expect inbound connections on arbitrary ports. A tunnel is the wrong tool; you need a public IP.
- If traffic must never pass a third-party server, use a public IP or your own VPS. Zorven's core is open source (AGPLv3), so you can also run the server component on your own VPS.
- Heavy, sustained traffic such as multi-user video streaming: check the plan's monthly traffic first; a public IP may be cheaper.
Frequently asked questions
zorven 3000 gives a web app an HTTPS address; for SSH or a game server you create a raw TCP tunnel in the dashboard. The Free plan includes 2 tunnels and 5 GB of traffic per month.Sources
- RFC 6598: IANA-Reserved IPv4 Prefix for Shared Address Space (accessed: 2026-11-08)
- RFC 1918: Address Allocation for Private Internets (accessed: 2026-11-08)
- Zorven docs: install, CLI and tunnels (accessed: 2026-11-08)
- Zorven pricing and plan limits (accessed: 2026-11-08)