Are you behind CGNAT? Check your address
Carrier-grade NAT is why the usual "set up a VPN server on your router" guide stops working halfway. This page tells you whether your connection is behind it.
The address this page sees
216.73.217.36
Probably not. This looks like an ordinary public IPv4 address.
Port forwarding should work, assuming your router is the device holding this address. Check the router’s WAN page to be sure: if it shows something in 100.64 to 100.127 while this page shows a public address, there is a second layer of NAT above you and the answer is really yes.
What the ranges mean
| Range | What it is | Can you forward a port |
|---|---|---|
| 100.64.0.0 to 100.127.255.255 | Carrier-grade NAT, shared between subscribers | No |
| 10.x, 172.16 to 172.31.x, 192.168.x | A private network, so something local is rewriting your address | Not from here |
| Anything else in IPv4 | An ordinary public address | Usually yes |
| IPv6 | Your own address, firewalled rather than translated | Open the firewall instead |
If you are behind CGNAT
Three ways out, in the order most people find useful.
- Ask your provider for a public IPv4 address. Some hand one out free on request, some charge a small monthly fee, some will not do it at all. One phone call settles it.
- Use something that does not need an inbound port: a mesh VPN, or a service that arranges the connection for you and falls back to a relay when a direct path cannot be made. Our guide compares five options, including the ones we do not build.
- Use IPv6 if both ends have it. It sidesteps the problem, though the far end has to support it too, and that is the part that usually fails.
Why we built this
SparkUp connects two devices directly when it can and relays when it cannot, so carrier-grade NAT is a daily fact of life for us rather than a footnote. On a mobile carrier that uses it, our own coordinated-punch test brought up a direct path in about 700 ms and moved 42 Mbps, where the same pair without the punch managed roughly 1 Mbps over IPv6. The check on this page is the first question we ask when a connection will not come up.
Nothing here is stored. The address is read from your request to render the answer and then it is gone: no log, no analytics, no cookie.