DS-Lite and CGNAT explained simply – and why your home VPN can’t be reached

What does DS-Lite mean?

DS-Lite stands for Dual-Stack Lite. Your provider gives your router a native IPv6 connection with its own address, but no public IPv4 address. The router wraps IPv4 traffic inside IPv6 and sends it through a tunnel to the provider, which unwraps it and sends it on from a public IPv4 address shared by many customers.

The reason is scarcity: AVM says providers use DS-Lite when they don’t have enough public IPv4 addresses for their customers. The method is specified in the IETF standard RFC 6333, published in 2011.

The three building blocks

• B4 is the part in your router. It packs IPv4 packets into IPv6 (an IPv4-in-IPv6 tunnel).
• AFTR is the endpoint at your provider. It unpacks the packets and uses NAT to put them on a public IPv4 address that many customers share.
• IPv6 runs natively, with no tunnel and no translation. Your line has a real IPv6 address of its own.

Day to day, you usually won’t notice: AVM says almost all IPv4 applications work without restriction. Trouble starts when something outside wants to connect in – say, your phone reaching the VPN server on your FRITZ!Box.

What is CGNAT, and how does it relate to DS-Lite?

CGNAT stands for carrier-grade NAT. Your provider translates many customers’ addresses onto a few public IPv4 addresses, so your router only gets a non-public IPv4 address. DS-Lite uses exactly this kind of NAT at the provider but also carries IPv4 through an IPv6 tunnel. For incoming connections, the effect is the same.

You already use NAT at home: your router shares one address among all the devices on your network. With CGNAT the same thing happens a second time at the provider, across many lines at once. RFC 6333 explicitly calls the translation in the AFTR a carrier-grade NAT.

How can I tell whether I have DS-Lite?

Your router tells you fastest. On a FRITZ!Box, open Internet > Online Monitor and look at the “Internet, IPv4” line. If it shows a DS-Lite tunnel notice or an address between 192.0.0.0 and 192.0.0.7, you have DS-Lite. For a definitive answer, ask your provider.

1. Open the FRITZ!Box user interface, click “Internet”, then “Online Monitor”.
2. Find the “Internet, IPv4” line. If no address appears, switch on the advanced view first.
3. Compare the address with the table below.

The table follows AVM’s guide to IPv4 address ranges. On other routers, look for the internet or WAN address on the status page. Another clue: if an IP-checking website shows a different IPv4 address from the one your router reports, there’s a NAT in between.

Why does a home VPN server fail on DS-Lite?

A VPN server – on a FRITZ!Box, with WireGuard or with OpenVPN – waits for connections from outside. On DS-Lite, though, the public IPv4 address belongs to your provider and is shared. Incoming IPv4 connections end at the provider, not at your home. Port forwarding on your own router can’t help, because the block sits at the provider.

Outgoing connections are fine, because the provider remembers who asked. An incoming connection has no such mapping, so the AFTR can’t tell which customer it’s for. As AVM puts it, without a public IPv4 address, servers on your home network can’t be reached from the internet via IPv4.

The usual symptom: your VPN app can’t find the server even though port forwarding is set up correctly. MyFRITZ! doesn’t help over IPv4 either: on a DS-Lite line the FRITZ!Box is only reachable via IPv6, according to AVM. The same goes for any remote access, such as to a NAS.

“Usually”, because some hotel and company networks block encrypted connections. For the options specific to the FRITZ!Box, see our comparison FRITZ!Box VPN or a ready-made kit.

What are the options without a public IPv4 address?

There are four routes: ask your provider for a public IPv4 address or dual stack, use PCP if your provider supports it, connect over IPv6, or use a tunnel or relay service that your home network connects out to by itself. Each one comes with its own requirements and limits.

If you want to run your own server, a public IPv4 address is the cleanest fix. Some providers switch you to dual stack on request, others only on certain tariffs, for a surcharge or not at all.

IPv6 is the obvious route on DS-Lite, but AVM points out that both ends need it – and some mobile networks and Wi-Fi hotspots don’t have it. A relay turns the direction around instead: both ends connect out to a server on the internet, and outgoing connections are no problem on DS-Lite or CGNAT. You can build one yourself with a server and WireGuard, or use a ready-made one.

How does a relay like Homvoya get around it?

The Homvoya Kit is two small routers, already paired. The home box plugs into your router at home; the travel box comes with you. Both connect out on their own to a relay server in the EU. That’s why your line needs neither a public IPv4 address nor port forwarding.

The relay joins the two boxes, encrypted with WireGuard. Your traffic leaves through your connection at home, so websites see your home IP, not the hotel’s. Every device on the travel box’s Wi-Fi uses that connection, with no software to install. The details are on how Homvoya works.

The limits

• Upload at home: it caps your speed on the road. We recommend at least 10 Mbit/s. More in our guide to upload speed.
• Hardware: the manufacturer states up to 65 Mbps WireGuard throughput for the GL.iNet Opal (lab test).
• Internet and power at home: if either goes down, the connection doesn’t work.
• An extra hop: the relay server is run by Homvoya. The content of your traffic is not logged; we keep connection metadata for 7 days for operation and abuse prevention.
• Location: Homvoya only changes the IP address websites see. It doesn’t hide other location signals such as Wi-Fi positioning, time zone or GPS.

Use the compatibility check to see whether your connection suits the Homvoya Kit. If you already have a public IPv4 address and enjoy setting things up, your own VPN server is often the cheaper choice.