What Is CGNAT and Why It Affects Every Brunei Residential Internet User

If you have ever tried to set up a security camera, a game server, or remote access to your home computer from outside your home, and it mysteriously did not work despite following every guide, CGNAT is probably the reason. Most residential internet users in Brunei are behind Carrier-Grade NAT without realising it. Here is what that means and why it matters.

What Is CGNAT?

NAT stands for Network Address Translation. Your home router already does NAT: it takes the single public IP address assigned by your ISP and shares it among all your devices (phones, laptops, smart TVs) using private IP addresses like 192.168.1.x. This is how every home network works.

Carrier-Grade NAT (CGNAT) adds a second layer of NAT at the ISP level. Instead of giving your home router a public IP address, the ISP gives it a private IP address (usually in the 100.64.x.x range) and shares a single public IP address among many customers. Your home router does NAT, and then the ISP does NAT again. This is double NAT.

The reason ISPs use CGNAT is simple: the world has run out of IPv4 addresses. There are roughly 4.3 billion IPv4 addresses total, and they were all allocated years ago. ISPs cannot buy more. CGNAT lets one public IP address serve dozens or hundreds of customers.

How CGNAT Limits You

Under CGNAT, your home network does not have a public IP address. This means:

• No port forwarding: You cannot open a port on your router to allow incoming connections. Port forwarding requires a public IP address.
• No remote access: You cannot access your home devices (security cameras, NAS, home server) from outside your home using a direct connection.
• No self-hosting at home: You cannot host a website, game server, or any service from your home internet connection.
• Online gaming issues: Some games that use peer-to-peer connections may have trouble with matchmaking, voice chat, or hosting multiplayer sessions.

These limitations apply whether you are with DST, Progresif, or Imagine (formerly TelBru). All Brunei residential ISP connections go through UNN's national network, and CGNAT is standard for residential customers. Businesses typically get a static public IP address, but residential users do not.

How to Check If You Are Behind CGNAT

It is easy to check. Find your WAN IP address by visiting a site like whatismyipaddress.com. Then log into your home router and look for the WAN IP address that your router reports. If the router's WAN IP is different from what the website shows, you are behind CGNAT. If the router's WAN IP starts with 100.64 through 100.127, you are definitely behind CGNAT because that range is reserved for carrier-grade NAT.

Another sign: if you set up port forwarding on your router exactly as documented and it still does not work from outside your home, CGNAT is the most likely explanation. Port forwarding simply does not work under double NAT.

Brunei's Internet Infrastructure

Brunei's entire telecommunications infrastructure is managed by Unified National Networks (UNN), a government-linked company. UNN operates over 5,000 kilometres of fibre, more than 600 mobile base stations, and has connected over 159,000 homes. All ISPs (DST, Progresif, Imagine) resell connectivity over UNN's network.

UNN also offers colocation hosting and cloud hosting services for businesses that need public-facing infrastructure. This is one way out of CGNAT: rent a VPS or colocation space from UNN and host your services there instead of at home.

Need help working around CGNAT? VPS1 helps Brunei residents and businesses set up remote access, host services, and bypass CGNAT limitations with the right tools for your specific needs.