100.64.0.0/10: Carrier-Grade NAT Space

100.64.0.0/10 is "shared address space" from RFC 6598. ISPs use it between their carrier-grade NAT and your router. If your router's WAN IP starts with 100.64 to 100.127, you are behind CGNAT.

100.64.0.0/10 at a glance

Address range
100.64.0.0 – 100.127.255.255
Usable hosts
4,194,302
Total addresses
4,194,304
First usable
100.64.0.1
Last usable
100.127.255.254
Subnet mask
255.192.0.0
Wildcard mask
0.63.255.255
Type
Carrier-grade NAT (RFC 6598)

Is an address inside 100.64.0.0/10?

Yes — 100.72.14.9 is inside 100.64.0.0/10. It is address number 527,881 in the block (counting from 0).

What 100.64.0.0/10 is

It runs from 100.64.0.0 to 100.127.255.255 — the second octet goes from 64 to 127 because the /10 block size is 64.

It is not RFC 1918 private space, and it is not public either. It exists so ISPs can number millions of customer routers without clashing with the private ranges their customers use at home.

Who uses it

  • ISPs (CGNAT)

    Mobile networks and many fibre and cable ISPs put customers behind CGNAT, giving the router a 100.64/10 WAN address.

  • Tailscale

    Every device in a tailnet gets an address from 100.64.0.0/10, chosen because it rarely clashes with LANs.

  • AWS EKS custom networking

    AWS suggests adding a secondary VPC CIDR from 100.64.0.0/10 (often 100.64.0.0/16) for pod IPs when the main VPC range is running out.

Conflicts and gotchas

  • Port forwarding won't work. Behind CGNAT, the public IP is shared with other customers. Ask your ISP for a public IPv4, use IPv6, or use a tunnel service.
  • Tailscale on a CGNAT network. Both use the same range. It usually works because Tailscale routes only its own /32s, but subnet routes or exit nodes can clash.
  • Using it as LAN space. It is not meant for enterprise LANs. Some firewalls and SaaS tools treat it as public. Stick to RFC 1918 unless you have a clear reason. Check clashes with the overlap checker.

How to split 100.64.0.0/10

Worked example: into /16s

  1. Going from /10 to /16 borrows 16 − 10 = 6 bits from the host part.
  2. Each borrowed bit doubles the number of subnets: 26 = 64 subnets.
  3. Each /16 keeps 32 − 16 = 16 host bits: 216 = 65,536 addresses, so 65,534 usable after removing network and broadcast.
  4. The new mask is 255.255.0.0, so subnets step by 1 in the second octet: 100.64.0.0/16, 100.65.0.0/16, 100.66.0.0/16 … up to 100.127.0.0/16.
Ways to split 100.64.0.0/10
Split into Subnets Usable each First blocks Good for
/16 64 65,534 100.64.0.0/16, 100.65.0.0/16, … 64 /16s — e.g. one for an EKS secondary CIDR.
/12 4 1,048,574 100.64.0.0/12, 100.80.0.0/12, … Four /12s for a large ISP's regions.
/20 1,024 4,094 100.64.0.0/20, 100.64.16.0/20, … 1,024 /20s, small pod or tunnel pools.

100.64.0.0/10 FAQ

Is 100.64.0.0/10 a private IP range?

Not in the RFC 1918 sense. It is shared address space (RFC 6598) for ISP carrier-grade NAT. It is not routed on the public Internet.

How do I know if I'm behind CGNAT?

Compare your router's WAN IP with the IP shown by a what-is-my-IP site. If the router shows 100.64.x.x to 100.127.x.x, or the two differ, you are behind CGNAT.

What is the range of 100.64.0.0/10?

100.64.0.0 to 100.127.255.255, about 4.2 million addresses.

Related tools

CIDR to IP Range Every address in 100.64.0.0/10 CIDR Calculator Split 100.64.0.0/10 into any size Subnet Overlap Checker Check it against your other ranges VLSM Calculator Split it into different-sized subnets /10 explained Mask, block size and maths for any /10

Other well-known networks: 10.0.0.0/24, 10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 172.17.0.0/16, 192.168.0.0/16, 192.168.0.0/24, 192.168.1.0/24 · all networks