CGNAT range (100.64.0.0/10)
The CGNAT range is 100.64.0.0/10, the block of IPv4 addresses from 100.64.0.0 to 100.127.255.255. RFC 6598 reserved it in 2012 as shared address space for carrier-grade NAT (CGNAT), where an internet provider puts many customers behind a small number of public IP addresses. The range sits between the provider’s NAT and its customers’ routers, and isn’t routed on the public internet.
Why it’s a good overlay range
Section titled “Why it’s a good overlay range”An overlay network’s IPv4 range can’t overlap any range your hosts’ local networks use. The usual private ranges are crowded: home routers mostly use 192.168.0.0/16, and cloud VPCs and corporate networks use parts of 10.0.0.0/8 and 172.16.0.0/12. Home routers and cloud networks rarely hand out CGNAT addresses, so an overlay range taken from it is much less likely to collide.
New Managed Nebula networks are IPv6-capable, and adding an IPv4 range is optional. If you add one, we recommend a range inside 100.64.0.0/10 for this reason, such as 100.100.0.0/22, which holds 1,022 hosts with addresses that are easy to recognize. See Choosing a CIDR, and CIDR notation if you need a refresher on reading ranges like this.
When it can conflict
Section titled “When it can conflict”The CGNAT range is uncommon on local networks, but it isn’t unused. Some mobile carriers and internet providers give customers’ devices or routers addresses in it, and a host whose underlay address falls inside your overlay’s range can have trouble reaching the overlay. Other mesh VPNs also assign addresses from this range, so running two of them on the same device can lead to overlapping routes.
A modest range like 100.100.0.0/22 is less likely to collide than all of 100.64.0.0/10. A network’s IPv4 range can’t be changed after it’s created, so switching ranges means migrating to a new network. An IPv6 overlay sidesteps the issue, since its range is generated for you.
CGNAT and connectivity
Section titled “CGNAT and connectivity”Carrier-grade NAT, common on cellular connections, also makes direct connections between hosts harder, because many CGNATs can’t be hole punched. When that happens, Managed Nebula sends the traffic through a relay (see NAT traversal).