- What is CGNAT?
1.1 Carrier-Grade Network Address Translation (CGNAT) allows multiple customers to share a single public IPv4 address. It helps conserve IPv4 addresses and enhances baseline protection for many users.
1.2 Under CGNAT your modem/router receives a private (RFC 1918) address and your outbound traffic appears on the Internet from a shared public IPv4 address. - What CGNAT means for you
2.1 Everyday use (browsing, email, streaming, most cloud apps and many VPN clients) typically works without change.
2.2 Inbound connections initiated from the Internet to your premises network generally won’t work under CGNAT. Common scenarios affected include:
(a) hosting on-premises services (e.g., web/FTP/game servers, mail servers);
(b) inbound remote access (e.g., port forwarding to NAS, CCTV/NVR, RDP/VNC);
(c) some peer-to-peer and SIP/VoIP configurations that expect public inbound reachability;
(d) certain IoT or industrial devices that require inbound ports.
2.3 Some ports may be filtered or blocked for security or regulatory reasons (see Terms, clause 5.5). - Do you need a static public IP?
3.1 Consider a static public IPv4 address if you:
(a) require inbound access from the Internet to your site/services;
(b) run IP-based allow-lists (source IP whitelisting) to cloud/SaaS, firewalls or partner networks;
(c) use site-to-site VPNs or services that must reference a fixed endpoint; or
(d) need consistent reverse-DNS or logging/audit traceability tied to your service.
3.2 Static IP options are subject to availability and fees as set out in the Selected Options or Relevant Pricing. - Requesting a static public IP
4.1 Ask our team to add a static IP option to your service (where available). We’ll confirm pricing, lead time and any change window required.
4.2 After activation, you may need to adjust firewall/NAT rules and update any DNS records or allow-lists. - IPv6 (where available)
5.1 Where IPv6 is available on your access type, we can allocate IPv6 addressing to enable globally routable inbound connectivity using IPv6 standards. Your internal network and applications must be IPv6-capable to benefit. Availability varies by access technology and Supplier. - Security considerations
6.1 A static public IP can increase inbound visibility. You are responsible for securing exposed services (firewalls, patching, strong credentials, MFA, VPNs). Consider limiting exposure and using zero-trust or VPN solutions for remote access.
6.2 Regardless of CGNAT or static IP, you are responsible for your security posture (see Terms, clause 5.4). - Network management
7.1 We may implement reasonable traffic management, rate-limiting, filtering or port-blocking to protect network integrity and comply with legal or regulatory directions (see Terms, clause 5.5). We aim to apply measures proportionately and only where necessary. - Support
If you are unsure whether CGNAT or a static IP is right for your use case, contact us at support@symsafe.com.au with a brief description of your application (e.g., inbound access requirement, VPN type, ports/protocols). - Changes to this explainer
We may update this page as technologies and Supplier capabilities evolve. Material changes will be notified on the Website.