CGNAT

CGNAT lets many subscribers with private addresses share a few public addresses. The router’s CGNAT is deterministic: each subscriber gets one fixed port block on one public address. Both clients and services are included.

How the blocks are counted

• The port range is 1024–65535 by default.
• A block is 2048 ports by default.
• So one public address holds 31 subscribers (64512 ports ÷ 2048).
• Capacity = public addresses × blocks per address. 16 public addresses hold 496 subscribers.

Smaller blocks mean more subscribers per public address but fewer connections for each.

Turn it on

dtvsol cgnat set enable iface bond0 pool XXX.XXX.XXX.64-XXX.XXX.XXX.79
dtvsol cgnat

• iface is the uplink, where the public pool is routed to the router.
• pool is a comma-separated list of single addresses and ranges (first-last).
• block <n> sets the ports per subscriber.
• exempt <cidr,cidr> lists private networks sent out without NAT.

Caution

Give the pool as addresses and ranges, not as a network with a prefix. Also make sure your border router routes the pool to this router.

dtvsol cgnat shows the state, the pool, the capacity, how many blocks are assigned and free, and a sample of assignments.

What a change does

• Turning CGNAT off cuts every private subscriber off the internet until it is on again.
• Changing the interface, the pool, the port range or the block size works out every subscriber’s public address and port block again. Their open connections drop (games, calls and downloads restart).
• Changing only the exempt list does not move anyone.

In the monitor (Settings → Protection → CGNAT), the first two kinds of change ask you to type CGNAT before the button works. See Settings.

The mapping log

Every assignment and release is written to /opt/dtvsol/log/cgnat-mappings.log with a time:

[2026-09-25 10:30:00] ASSIGN AA:BB:CC:DD:EE:FF 100.64.16.9 -> XXX.XXX.XXX.64:3072-5119 slot=1
[2026-09-26 08:00:00] RELEASE AA:BB:CC:DD:EE:FF slot=1

A subscriber keeps the lowest free block when it is added, and keeps it while it exists. This log is your record for legal requests. It is included in the router’s daily backup.

Look up who used an address and port

dtvsol cgnat lookup XXX.XXX.XXX.64 4000

The answer names the subscriber that holds that block now (MAC, private address, hostname, and the block’s port range). For a past date, check the mapping log for the block’s assignments around that time.

CGNAT and capacity alarms

The alarm register warns when the CGNAT pool is nearly full. See Alarms and the wall.