Metronet Fiber CGNAT & Static IP Setup Guide
Metronet Fiber assigns all standard residential accounts a private Carrier-Grade NAT (CGNAT) address within the RFC 6598 range (100.64.0.0/10), which blocks inbound port forwarding for Plex, security cameras, and gaming servers. To host local services, you must purchase Metronet's $10/month Static IP add-on or deploy zero-trust tunnels like Tailscale or Cloudflare.
- CGNAT Symptom Check: If your router's WAN IP begins with
100.64.x.xthrough100.127.x.xwhileifconfig.meshows a different IP, you are behind CGNAT. - The $10/mo Static IP Solution: Purchasing a static IPv4 block from Metronet bypasses the CGNAT translation pool and provides a dedicated public IP for traditional port forwarding.
- Free Tunneling Alternatives: Tailscale Subnet Routers and Cloudflare Tunnels punch through Metronet CGNAT without paying monthly fees or exposing public ports.
- Direct ONT Connection: You can replace Metronet's rented eero mesh nodes by plugging your own router directly into the Nokia ONT via standard DHCP.
How to Verify If Your Metronet Connection Is Behind CGNAT
Carrier-Grade NAT (CGNAT), standardized under RFC 6598, is a network virtualization technique used by fiber and cellular ISPs to conserve scarce IPv4 addresses. Instead of allocating a unique public IPv4 address to every subscriber home, Metronet assigns private addresses within the reserved 100.64.0.0/10 block (spanning 100.64.0.0 to 100.127.255.255). Up to 64 or 128 homes share a single public IP at the ISP boundary.
To confirm whether CGNAT is blocking your network services, perform this two-step diagnostic:
- Log into your router's web administration panel and locate the WAN Status / Internet IP field.
- Open a browser tab and visit a public IP inspection tool (such as
https://ifconfig.meorhttps://icanhazip.com).
If your router reports an IP address starting with 100.64.x.x, 100.70.x.x, or 100.115.x.x, while the browser displays a completely different IP (e.g., 65.182.x.x), your traffic is being translated through Metronet's CGNAT gateways. Under this topology, any inbound connection attempt initiated from the outside internet hits Metronet's carrier firewall and is dropped because the carrier has no translation rule routing that external port to your specific router.
When You Need Metronet's $10/Month Static IP Add-on
For standard web browsing, streaming 4K Netflix, and outbound video calling (Zoom/Teams), Metronet's CGNAT operates transparently with zero speed penalties. However, specific prosumer, gaming, and remote-access use cases strictly fail behind CGNAT:
- Plex / Emby Remote Streaming: Without a public IP, Plex falls back to Plex Relay, which throttles streams to 1 Mbps (or 2 Mbps for Plex Pass subscribers), turning 4K HDR video into pixelated 720p.
- Console Gaming (Strict NAT / Type 3): Peer-to-peer multiplayer games on PlayStation 5, Xbox Series X, and Nintendo Switch cannot accept inbound lobby matchmaking packets, resulting in severe matchmaking errors and disabled party voice chat.
- Self-Hosted VPN Servers: Running a WireGuard or OpenVPN server on your home router or NAS fails because incoming connection handshakes cannot penetrate the CGNAT boundary.
- Security Camera NVR Direct Access: Standalone Blue Iris, Frigate, or Synology Surveillance Station setups cannot receive inbound RTSP viewer streams.
If your workflow relies on traditional port forwarding, you must call Metronet customer support (1-877-407-3224) and request a Static IPv4 Address. Metronet charges a standard $10.00/month recurring fee for this service, which removes your line from the CGNAT pool entirely.
How to Configure Metronet Static IP on Your Router
When Metronet provisions your static IP, their engineering department will send an email containing four critical parameters. You must manually enter these into your router's WAN configuration page:
- Static IP Address: Your dedicated public IPv4 address (e.g.,
65.182.140.42). - Subnet Mask: Typically
255.255.255.252(/30 point-to-point link) or255.255.255.248(/29). - Default Gateway: The upstream Metronet router interface IP (e.g.,
65.182.140.41). - Primary & Secondary DNS: Metronet's nameservers, or public resolvers like Cloudflare (
1.1.1.1) and Quad9 (9.9.9.9).
To apply these settings on an ASUS, UniFi, Netgear, or TP-Link router: navigate to WAN Settings, change WAN Connection Type from Dynamic IP (DHCP) to Static IP, enter the values exactly as provided, and click Apply. Power-cycle the Metronet Nokia ONT for 60 seconds to force the optical gateway to re-bind the upstream routing interface.
Free Alternatives to Avoid Paying the $10/Month Static IP Fee
If you only need remote access for yourself or family members and do not want to add $120/year to your Metronet bill, modern overlay networking technologies eliminate the need for a public IPv4 address entirely:
Option 1: Tailscale Subnet Router (Best for Home Labs): By installing Tailscale on an Apple TV, Raspberry Pi, or NAS inside your home and enabling subnet routing (tailscale up --advertise-routes=192.168.1.0/24), you establish an encrypted WireGuard mesh network. Tailscale uses DERP relays and STUN hole-punching to penetrate Metronet's CGNAT seamlessly, granting you full access to your LAN from your phone or laptop anywhere in the world.
Option 2: Cloudflare Tunnels (Best for Web Services): If you host Home Assistant, Nextcloud, or personal dashboards, the lightweight cloudflared daemon creates an outbound-only TLS connection to Cloudflare's edge network. External users can access your services over HTTPS with free Cloudflare Access SSO authentication without opening a single WAN port.
Option 3: IPv6 Pinholes: Metronet is rolling out dual-stack IPv6 in select markets. If your router receives an IPv6 /56 prefix delegation, internal devices possess globally routable IPv6 addresses, allowing direct connections via IPv6 firewall rules.
Metronet CGNAT vs Static IP vs Zero-Trust Overlay Comparison
| Feature / Capability | Default Residential CGNAT | Metronet Static IP ($10/mo) | Tailscale Mesh VPN (Free) | Cloudflare Tunnel (Free) |
|---|---|---|---|---|
| Monthly Cost | $0.00 / Month | $10.00 / Month ($120/yr) | Free (Up to 100 devices) | Free (Personal Use) |
| Port Forwarding | Blocked (Strict NAT) | Fully Supported (Open) | Not Needed (Overlay Mesh) | Not Needed (Outbound Daemon) |
| Plex Remote Access | Throttled to 1-2 Mbps Relay | Full Direct Play 4K HDR | Full Direct Play (On Mesh) | Violation of TOS (Video Streams) |
| Console Gaming NAT | Strict (Type 3) | Open (Type 2) | Unsupported on Xbox/PS5 | Unsupported for Consoles |
| Setup Difficulty | Automatic / Zero Setup | Requires Manual WAN Setup | 5-Minute Client Install | Requires Custom Domain |
Metronet CGNAT Troubleshooting & Verification Checklist
- Compare router WAN IP against curl ifconfig.me to confirm RFC 6598 100.64.0.0/10 address.
- Call Metronet support at 1-877-407-3224 to request a Static IP if traditional port forwarding is required.
- Input the Static IP, Subnet Mask, and Gateway accurately into your router WAN configuration.
- Power cycle the Metronet optical terminal (ONT) for 60 seconds after static IP activation.
- Verify that UPnP or manual port forwards reflect Open NAT status in gaming console network tests.
- Consider setting up a free Tailscale Subnet Router to avoid paying the monthly $10 fee for remote LAN access.
Frequently Asked Questions
Why does Metronet use CGNAT on residential fiber?
IPv4 addresses have been completely exhausted globally. As a high-growth fiber ISP, Metronet uses CGNAT to share blocks of public IPv4 addresses across multiple customers, preserving IPv4 supply while charging a nominal fee for subscribers who require dedicated static addresses.
Can I use my own router with Metronet without paying for a static IP?
Yes. You can unplug Metronet's rented eero router and connect your own router directly to the Metronet ONT via Dynamic DHCP. You only need a static IP if you want to forward ports, host home servers, or fix gaming strict NAT issues.
Does Metronet provide IPv6 to bypass CGNAT?
Metronet has begun deploying native IPv6 in select upgraded regional markets, but residential availability remains inconsistent. Where active, native IPv6 allows direct peer-to-peer connections without CGNAT interference.
Will a static IP improve my internet speed or ping on Metronet?
No. A static IP does not alter your fiber bandwidth or raw optical latency. It only removes the carrier translation layer, enabling inbound connections and resolving double-translation routing overhead.
Related Router Troubleshooting & Engineering Guides
- How to Get Open NAT (Type 2) on PS5, Xbox & PC Without Using DMZ — Fix Strict or Moderate NAT on PS5, Xbox Series X, and PC without exposing your console in the DMZ. Set up DHCP reservations, port forwarding, or Secure UPnP.
- Cloudflare Tunnel vs Reverse Proxy vs WireGuard VPN: Which to Use? — Compare Cloudflare Tunnel (cloudflared), Nginx/Caddy reverse proxies, and WireGuard or Tailscale VPNs for secure remote home lab and NAS access behind CGNAT.
- How to Fix Double NAT on Home and Office Networks — Diagnose and fix Double NAT from chained ISP modem-routers and mesh WiFi systems using Bridge Mode, IP Passthrough, or AP Mode, vs ISP CGNAT (100.64.x.x).
- How to Reset a Router Safely Without Losing Internet — Reset your WiFi router safely without losing internet by backing up PPPoE credentials, ISP VLAN IDs, MAC clones, and DHCP reservations before pressing Reset.