CGNAT and Double NAT: Why Port Forwarding Fails

A port forward cannot repair a server process that is stopped, listening on a different port, or blocked by Windows Firewall. Prove the server locally first: connect from another device on the same home network using the host PC's private address and the game's configured port.

When LAN joining succeeds, the executable, world, and basic local path are working. The next test belongs at the router and internet edge. When LAN joining also fails, stay inside the PC and game configuration until the process is listening correctly.

Run ipconfig on the Windows host to identify its IPv4 address and default gateway. The IPv4 address is the destination for the router forward. The default gateway normally leads to the router's management page, where the WAN or internet address is shown.

Now compare that router WAN address with the public IPv4 address reported to an outside service. If they differ, another translation layer exists. A private WAN address often means a second router or modem is performing NAT. An address from 100.64.0.0 through 100.127.255.255 is the shared block reserved for service-provider CGNAT and is not globally routable.

Double NAT is common when an ISP gateway routes traffic and a personal router sits behind it. One forward on the inner router stops at the outer device. The cleanest correction is usually to place one device in an appropriate bridge or access-point mode, but the exact choice depends on which device supplies Wi-Fi, telephone, television, or ISP management services.

If the topology cannot be simplified, forward the one required game service through both devices: outer device to inner router, then inner router to the server PC. Keep the internal addresses reserved so neither target changes after a restart.

A home-router rule cannot program a carrier-grade translator you do not control. Ask the ISP whether the connection uses CGNAT and whether it offers a public IPv4 address, a static address, or an inbound-port option. Ask about price and whether the address can change before agreeing.

Some games provide a publisher relay or platform cross-play relay that avoids ordinary inbound IPv4 forwarding. Use it only when that game's own guide confirms it. An overlay network can work for a private group when every participant installs and trusts the same client, but it does not make a normal public server discoverable. Renting a compatible server is the final practical option when no inbound path exists.

Many home routers do not support NAT loopback consistently, so testing your public address from inside the same Wi-Fi network can fail even when outside access works—or appear to work through a special router behavior that outside players never use. Test with a friend on another provider or a device using mobile data.

Record the server version, host LAN address, external address, port, protocol, and exact time. If the attempt fails, that small record lets you inspect the correct server log and router event instead of changing several layers at once.