100.64.0.0/10: the carrier NAT range explained

The 100.64.0.0/10 address range occupies an unusual position in network design. It is not private in the traditional sense (RFC 1918), yet it is not routable on the public internet. Instead, 100.64.0.0/10 is designated as Shared Address Space by RFC 6598 and is reserved specifically for Carrier Grade NAT (CGNAT) deployments. Understanding this range is essential for network engineers troubleshooting connectivity issues, designing carrier networks, or preparing for advanced certifications.

What is RFC 6598 Shared Address Space?

RFC 6598, published in 2012, defines 100.64.0.0 divided by 10 as a dedicated address space for use between a carrier's Customer Premises Equipment (CPE) and the carrier's Carrier Grade NAT device. This range contains approximately 4 million addresses (100.64.0.0 through 100.127.255.255). It was created to address IPv4 address exhaustion by allowing carriers to assign addresses from this space to end customers, then translate them at the carrier edge using CGNAT.

The key distinction: while RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are meant for internal use within organizations, 100.64.0.0/10 is specifically for carrier infrastructure. It is not suitable for general enterprise networks and should not be used outside the CGNAT context.

How Carrier Grade NAT uses 100.64.0.0/10

In a typical CGNAT scenario, a residential or small business customer receives a public IP address assignment from the carrier. However, that customer's internal network uses an address from 100.64.0.0/10. When traffic leaves the customer's CPE, the carrier's NAT gateway translates the source address from the shared space to a public address. Multiple customers can share the same public address by using different port ranges.

Customer A (internal): 100.64.1.50:12345
Carrier NAT gateway: Translates to 203.0.113.10:12345

Customer B (internal): 100.64.2.50:12345
Carrier NAT gateway: Translates to 203.0.113.10:54321

This design extends the usable IPv4 address space by allowing one public address to serve multiple customers. It is now standard practice among major ISPs, particularly in regions where IPv4 availability is constrained.

Why 100.64.0.0/10 is neither private nor public

• →Not private: Unlike RFC 1918 ranges, 100.64.0.0/10 is not intended for independent use by organizations. It is reserved and managed by carriers for a specific purpose.
• →Not public: Addresses in this range are not routable on the internet. If you attempt to ping 100.64.1.1 from outside a CGNAT network, the packet will not reach the destination.
• →Transitional: It exists in the middle ground between private and public, serving as a bridge during the IPv4-to-IPv6 transition.

Implications for network engineers

If you are working with ISP infrastructure, mobile networks, or large-scale carrier deployments, you may encounter 100.64.0.0/10 in production. Misconfiguring firewalls, access control lists, or routing policies around this range can break customer connectivity.

• →Do not use 100.64.0.0/10 in your enterprise network. Stick to RFC 1918 ranges.
• →When troubleshooting carrier networks, verify whether traffic originates from the shared address space.
• →Document CGNAT deployments clearly to avoid confusion during incident response.
• →Be aware that customers behind CGNAT may experience issues with peer-to-peer applications, gaming, or inbound port forwarding.

Recognizing address space categories is a core skill for network professionals. If you need to quickly classify an IP address or verify whether it belongs to a reserved range, use the tool below to check any address instantly.