Addresses, NAT, and CGNAT

Private IPv4 addresses such as 192.168.1.50 are meaningful only inside a local network. A public IPv4 address is assigned by the ISP to the router or server. IPv6 addresses may be globally routed, while link-local addresses beginning fe80:: are only for the local link.

ip addr
ip -4 route
ip -6 addr
ip -6 route
getent hosts mail.example.com

NAT rewrites a private IPv4 connection to use a public IPv4 address. Port forwarding creates an inbound mapping. Double NAT means two routers translate in sequence; a rule on the inner router is not enough because the outer router must forward to it too. Put the ISP modem in bridge mode only if you understand the loss of its routing/firewall role, or forward deliberately through both layers.

Carrier-grade NAT places many customers behind an ISP-controlled private layer. If the router's WAN address differs from the public address observed by a remote service, or lies in carrier ranges such as 100.64.0.0/10, inbound IPv4 forwarding may be impossible. Ask for a public/static IPv4, use native IPv6, or use a reachable tunnel/relay you control.

For IPv4, read the Internet/WAN status page on the router and write down its assigned address. Then ask a remote machine you control to report the source address of a connection from your network, or inspect a service you operate at the far end. If those two values differ, you have another translation or proxy in the path. Saphira may offer optional AKADATA/VM2 helper endpoints, but they are convenience checks only: manually entering the address and using standard DNS and network tools must always work.

1. 1. Record the router WAN IPv4

   Look under Internet, WAN, Broadband, Connection, or Status. Do not confuse this with the LAN gateway address such as 192.168.1.1.

2. 2. Classify it

   RFC1918 private ranges (10/8, 172.16/12, 192.168/16) and 100.64.0.0/10 indicate it is not an ordinary exclusive public IPv4 address.

3. 3. Compare at an independent end

   Make an outbound connection to an SSH server, web server, or logging endpoint you control and read its connection log. It sees the address the Internet actually receives.

4. 4. Test an inbound service

   From that independent network, attempt one deliberately published TCP service. This proves more than knowing an address: it checks provider policy, routing, forwarding, host firewall, and listener.

# On a remote Saphira host you control, after the home connection reaches SSH:
# journalctl/daemon logs or an SSH verbose session reveals the source address.
ss -tn '( sport = :22 )'

# On the home Saphira machine, record local facts separately.
ip -4 addr
ip -4 route
ip -6 addr
ip -6 route

# Reverse-DNS checks use the public address you recorded, not an address guess.
dig -x 203.0.113.25 +short
dig -x 2001:db8:1200::25 +short