When port forwarding can't work: CGNAT

Some providers park a whole neighborhood behind one shared public address. The scheme is called carrier grade NAT. Your router never touches the real internet, so no forwarding rule you create can help. Common on Starlink, T-Mobile Home Internet, and many newer wireless and fiber providers.

How to tell if you have it

Find your router's internet addressOn the router's status page it is called WAN address or Internet address.

Compare with what the world seesSearch “what is my ip” from any device at home. If the two numbers differ, you are behind CGNAT.

Or use the shortcutA WAN address between 100.64.0.0 and 100.127.255.255 means CGNAT, guaranteed. A WAN address starting with 192.168 or 10. means double NAT instead.

Your options

Ask your provider for a public IP. The magic words are “I need a public IP address”. Often a small monthly fee, sometimes free for the asking. This is the clean fix.
Live with Relay. Streams keep working through Plex's relay, capped around 720p. Fine for phones. Sad for TVs.
Tunnel out. Route Plex through a cheap cloud server with WireGuard or Tailscale. It works well and is firmly nerd territory.

CGNAT space is 100.64.0.0/10 (RFC 6598). IPv6 would sidestep the whole problem, and Plex's IPv6 story is still shaky enough that we can't recommend relying on it.

Fix it once. I'll watch it from here.

I watch your Plex from the internet and send word the moment it breaks. The pay is nothing. The setup is one sign-in.

Forget the Plex token after setup

What does this mean?

Plex gives us a token so we can see where your servers are. That token is allowed to do more than look up an address. Keeping it means you trust us with it. We never see your password. Some people would rather we not keep it. This is for them.

That's fine. I still watch your servers. We never see your password. If your home internet moves, you may get an alert. Sign in once more and I pick up the new address.

🤓 Nerd details

The token is allowed to do more than look up an address. We use it to find your servers, then we delete our copy and ask Plex to deactivate the Eyeball device. Open Authorized Devices in Plex. Eyeball should be gone. If it is still listed, remove it there.

How Eyeball works