CGNAT Port Block Planner

Plan carrier-grade NAT: how many subscribers fit behind a public pool, how large each port block should be, and the logging volume it will generate.

Calculator ISP Toolkit Runs in your browser
1000-4000 is typical; 512 is aggressive.
Try:

Result

Public addresses usable
254
203.0.113.0/24
Subscribers per address
31
Total pool capacity
7,874
subscribers
Addresses needed
162
Pool utilisation
63.5%
Ratio
31:1
Pool utilisation5,000 of 7,874

Port block size trade-off

Ports/subSubs per IPPool capacitySuitability
51212632,004Aggressive - expect complaints from heavy users
10246316,002Tight but workable for light users
2048317,874Common industry choice
4096153,810Comfortable, lower density
819271,778Comfortable, lower density

Logging implications

Deterministic logging
one record per subscriber per block assignment - negligible volume
Per-flow logging
roughly 5.4 GB/day at 300 flows/subscriber/hour
Recommendation
deterministic or port-block allocation, so a legal request needs only the block map
IPv6 is the pressure valve
CGNAT space is 100.64.0.0/10 (RFC 6598) on the subscriber side. Deploying IPv6 alongside it is the only real way to reduce CGNAT pressure - dual-stack subscribers move most of their traffic off the NAT entirely.

About CGNAT Port Block Planner

CGNAT capacity is governed by ports, not addresses. Each public address has 65,536 TCP and UDP ports, and how many subscribers you fit behind it depends entirely on how large a port block each one gets - a decision that trades address efficiency directly against user experience.

What subscribers notice

CGNAT is invisible until it is not. Inbound connections and port forwarding stop working, so cameras, NAS boxes and self-hosted services break. Some peer-to-peer and console traffic degrades to relayed mode with higher latency. Shared addresses attract CAPTCHAs and occasional outright blocks when another subscriber behind the same address misbehaves. Publishing a static port-block map and offering an optional public address for customers who need one resolves nearly all of the support load.

Choosing a block size

A modern household opens far more concurrent connections than people expect: a browser with many tabs, several streaming devices, a games console and an assortment of IoT devices comfortably reach several hundred. Blocks of 1024-4096 ports are the usual range. Below 512 you will get intermittent failures that are almost impossible for support to diagnose, because they depend on what else the household is doing.

Common use cases

  • Sizing a public pool before an IPv4 purchase or lease.
  • Choosing a port block size for a new CGNAT deployment.
  • Estimating whether per-flow NAT logging is storable at your scale.

Edge cases and gotchas

  • Some applications and websites rate-limit or block shared addresses outright - CGNAT subscribers will hit CAPTCHAs more often.
  • Inbound connections, port forwarding and some peer-to-peer protocols simply do not work behind CGNAT.

Frequently asked questions

How many subscribers per public IP is realistic?
At 2048 ports with 1024 reserved, about 31 subscribers per address. Operators commonly run between 20:1 and 60:1 depending on subscriber profile.
Deterministic or dynamic NAT?
Deterministic. It reduces logging to a static block map, which turns a legal disclosure request from a data-mining exercise into a lookup.