One IP Address, Many Users: Detecting Cgnat to Reduce Collateral Damage

Posted2 months agoActive2 months ago

vng13

8 points

3 comments

blog.cloudflare.comTechstory

calmpositive

Debate

20/100

CgnatIP Address ManagementCybersecurity

Key topics

Cgnat

IP Address Management

Cybersecurity

Cloudflare discusses detecting Carrier-Grade NAT (CGNAT) to mitigate collateral damage from IP-based security measures, with commenters exploring implications for rate limiting and abuse prevention.

Snapshot generated from the HN discussion

Discussion Activity

Light discussion

First comment

Peak period

0-12h

Avg / period

Key moments

01Story posted
Oct 29, 2025 at 9:22 AM EDT
2 months ago
Step 01
02First comment
Oct 29, 2025 at 11:35 AM EDT
2h after posting
Step 02
03Peak activity
1 comments in 0-12h
Hottest window of the conversation
Step 03
04Latest activity
Nov 3, 2025 at 2:20 AM EST
2 months ago
Step 04

Generating AI Summary...

Analyzing up to 500 comments to identify key contributors and discussion patterns

Discussion (3 comments)

Showing 3 comments

goofydumbo412

2 months ago

1 reply

DNS blocking works better than IP address based blocking because you can block domains and hosts instead of IP addresses. And it still blocks the domain/host even if its IP address changes.

vng13Author

2 months ago

Generally blocking DNS names works well for server-side blocking. But client IPs either do not have associated domain names, and even if there's a hostname associated with a client IP it'd cover all the clients behind the same public IP so the problem remains.

some_bird

2 months ago

We already knew that the poorer countries are impacted worse by the IPv4 shortages. CG-NAT didn't solve anything but only delayed long enough to do even more damage. Now these already poor countries also have to do CG-NAT, which is very expensive. They cannot afford this.

I guess that a poor country could go with only IPv6? Local services would be IPv6-only as well and most popular services already have IPv6. And everyone else would have to make this switch eventually, so there'd be benefits...

View full discussion on Hacker News

ID: 45746509Type: storyLast synced: 11/17/2025, 8:08:21 AM

Want the full context?

Jump to the original sources

Read the primary article or dive into the live Hacker News thread when you're ready.

Open link View on HN