100.64.0.0/10 — the CGNAT range
If your router's WAN address is something like 100.87.14.2, your ISP is putting you behind carrier-grade NAT. 100.64.0.0/10 is "shared address space" from RFC 6598: 4,194,304 addresses reserved for the link between your router and your ISP's core network, spanning 100.64.0.0 to 100.127.255.255.
It looks private, quacks private, but is deliberately not an RFC 1918 private range — and the difference trips up firewall rules everywhere.
| Range start | 100.64.0.0 |
| Range end | 100.127.255.255 |
| Subnet mask | 255.192.0.0 |
| Wildcard mask | 0.63.255.255 |
| Total addresses | 4,194,304 |
These are mathematical range boundaries. 100.64.0.0/10 is shared address space (RFC 6598) — ISPs assign from it on CGNAT links, so the usual "network/broadcast unusable" convention doesn't describe how it's deployed.
Why ISPs needed a fourth private-ish range
When IPv4 exhaustion bit hard, ISPs started putting multiple customers behind each public address — NAT444, or carrier-grade NAT. Your router gets a 100.x address, and the ISP's CGN box translates a second time. But they couldn't use RFC 1918 space for this: your home network already uses 192.168.x or 10.x, and if the ISP's side of your router also used it, routes would collide. 100.64.0.0/10 was carved out in 2012 specifically to be the address space nobody else is allowed to squat on.
What CGNAT breaks for you
Behind CGNAT you don't have a public address at all, so inbound connections are impossible: no port forwarding, no self-hosted game server, no direct SSH to home. Dynamic DNS won't save you — there's no public address to point at. The workarounds are tunneling (Tailscale, Cloudflare Tunnel), IPv6 if your ISP offers it, or asking the ISP for a public IP, often a paid add-on.
To check whether you're behind CGNAT: compare the WAN address on your router's status page with what a "what is my IP" site reports. A 100.64–100.127 WAN address, or a WAN address that differs from the public one, means double NAT.
Not RFC 1918 — don't filter it like it is
RFC 6598 space is shared, not private: it must not appear on the public Internet, but it legitimately appears *inside* ISP networks and on customer WAN interfaces. Overzealous "block all non-public ranges" firewall rules that include 100.64/10 will cut off CGNAT customers' WAN links and break Tailscale. Bogon filter lists handle it as its own category for this reason.
Tailscale deliberately assigns every tailnet node an address out of 100.64.0.0/10 (via its 100.100.100.100 MagicDNS, for instance). Since real devices virtually never sit on ISP CGNAT space and Tailscale space simultaneously, the collision risk was judged lower than burning RFC 1918 space that corporate networks already use.
CIDR Calculator
Run the math on 100.64.0.0/10 — or any other block
Frequently asked questions
Is 100.64.0.0/10 a private IP range?
Not in the RFC 1918 sense. It's "shared address space" (RFC 6598) reserved for carrier-grade NAT — the segment between your router and your ISP. Like private ranges it must never be routed on the public Internet, but it is managed by ISPs, not by you.
Why is my IP address 100.x.x.x?
Your ISP uses carrier-grade NAT: your router's WAN address comes from 100.64.0.0/10 and gets translated a second time in the ISP's network. It means you share a public IP with other customers, so inbound port forwarding won't work.
What is 100.100.100.100?
Tailscale's MagicDNS resolver address. Tailscale assigns every device on a tailnet an address from 100.64.0.0/10, so 100.x addresses on a Tailscale interface are normal and expected.
How many addresses are in 100.64.0.0/10?
4,194,304 (2^22) — the range spans 100.64.0.0 through 100.127.255.255.