CG-NAT¶
Under carrier-grade NAT (CG-NAT) many subscribers share a single public IPv4 address, so the address alone no longer identifies a subscriber. Platform Filter handles this by mapping on the IPv4 address plus a port range, and by partitioning overlapping address space into regions.
Inside the zone versus outside the gateway¶
Where the filter sits relative to the CG-NAT gateway decides what it can see, and therefore how the mapping has to be keyed:
- Inside the CG-NAT zone. The DNS server sees the subscriber's own IP address — the address on the inside of the CG-NAT gateway, before translation. Each subscriber still has a distinct address here, so a plain whole-IP lookup is enough, exactly as in a non-CG-NAT deployment.
- Outside the CG-NAT gateway. The DNS server only sees the shared public IP after translation. The single thing that distinguishes one subscriber from another is the range of source ports the CG-NAT gateway has allocated to them. The mapping therefore has to be keyed on the IP address together with the port, and the lookup uses the query's source port to pick the right subscriber.
The port only matters in the second case. A deployment that can see the subscriber's pre-translation address does not need port information at all.
IPv4 port-range allocations¶
To support the outside-the-gateway case, an IP Mapper allocation can be an IPv4 address with a port range rather than a whole address. Each subscriber that shares an address owns a slice of the port space, and the filter matches a query by checking which slice its source port falls into. This is why allocations accept IPv4 port ranges alongside plain addresses and CIDRs.
Not every data source can produce port-range allocations yet. The RADIUS Listener does not support them (this limitation will be removed in a future release), and static IP mappings cannot express them at all. Today port-range allocations come from integrations that know the allocated port block and push it through the modern APIs.
Regions¶
CG-NAT address ranges are private and can be reused, so two different parts of the network can legitimately use the same IPv4 address and port range for different subscribers. A single flat mapping cannot hold both without collision.
Regions solve this. A region names a partition of the address space, and the same IPv4 address and port range in two different regions are kept as two separate mappings. Sessions carry an optional region, and the IP Mapper keys CG-NAT allocations per region. See IP Mapper → Regions.
On the read side, each user-plane node's Settings Syncer syncs one region, pulling that region's CG-NAT mappings into its local LMDB. A node therefore serves the subscribers of the region it is placed in. See Settings Syncer → Region.