If your ISP uses CGNAT, a port-forward rule on your home router cannot create a public inbound route. For Plex on your own devices, use Tailscale. For ordinary sharing, ask your ISP for a public IPv4 address.
CGNAT is an upstream routing limitation, not a reason to buy a new NAS. Before paying for hardware or VPN subscriptions, verify what address your ISP assigns to your router.
What to do next
Follow these steps before changing your NAS or buying new hardware.
If the router WAN IP is in 100.64.0.0/10 or a private range, suspect upstream NAT.
If the WAN and public addresses differ, ask the ISP whether you are behind CGNAT.
Use Tailscale for your own devices or request a public IPv4 address for ordinary external Plex clients.
Which Plex setup fits your situation?
Pick the result you want and get a direct recommendation.
Current NAS Enclosure Deals on Amazon
Compare complete NAS systems from Synology, QNAP, UGREEN, ASUSTOR and TerraMaster.
Asustor Drivestor 4 Pro Gen2 AS3304T v2, 4 Bay NAS, Home Cloud Backup | Photo File Backup, Remote...
Asustor Xpanstor 4 AS5004U, 4 Bay Expansion Unit for NAS/PC (Diskless) | USB 3.2 Gen 2 Type C...
TERRAMASTER F4-425 Pro NAS 4-Bay, Intel N305 8-Core, 8GB RAM (Diskless) | 5GbE LAN x 2, M.2 Slot...
TERRAMASTER F4-425 4-Bay NAS Intel x86 Quad-Core CPU 4GB RAM (Diskless) | 2.5GbE LAN, Network Attached Storage Multimedia...
TERRAMASTER F2-425 2-Bay NAS Intel x86 Quad-Core CPU 4GB RAM (Diskless) | 2.5GbE LAN, Network Attached Storage Multimedia...
TERRAMASTER F4-212 4-Bay NAS Quad Core CPU, 2GB RAM (Diskless)
Other deals you might like for a Plex NAS setup
A NAS enclosure is only part of the setup. Add compatible NAS hard drives, an independent backup drive, or faster networking when needed. Confirm fit before ordering.
NAS Hard Drive Deals
CMR-focused IronWolf, WD Red Plus/Pro and Toshiba N300 options for storage pools.
Seagate IronWolf Pro, 16 TB, Enterprise NAS Internal HDD –CMR 3.5 Inch, SATA 6 Gb/s, 7,200 RPM, 256...
Seagate IronWolf Pro 24TB Enterprise NAS Internal HDD Hard Drive – CMR 3.5 Inch SATA 6Gb/s 7200 RPM...
Seagate IronWolf Pro, 20 TB, Enterprise NAS Internal HDD –CMR 3.5 Inch, SATA 6 Gb/s, 7,200 RPM, 256...
Western Digital 12TB WD Red Pro NAS Internal Hard Drive HDD - 7200 RPM, SATA 6 Gb/s, CMR,...
Backup Drive Deals
External desktop storage for an additional copy of important media and files.
LaCie d2 Professional 10TB External Hard Drive Desktop HDD – USB-C USB 3.0 7200 RPM Enterprise Class Drives,...
Seagate Expansion Desktop 16TB External Hard Drive – USB 3.0, 3.5" HDD for Windows & Mac, Plug-and-Play Backup...
Seagate Expansion Desktop, 4TB, External Hard Drive, USB 3.0 (STKP4000400)
Network Upgrade Deals
Real multi-gig Ethernet switches for compatible NAS and home networks.
NETGEAR MS308 8-Port 2.5G Multi-Gigabit Ethernet Switch | 𝐒𝐮𝐩𝐞𝐫𝐢𝐨𝐫 𝐍𝐞𝐭𝐰𝐨𝐫𝐤 𝐏𝐞𝐫𝐟𝐨𝐫𝐦𝐚𝐧𝐜𝐞 | Desktop Wired | Cloud Care's 3...
TP-Link TL-SG105PP-M2, 5 Port 2.5 Gigabit PoE Switch | Multi Gigabit, 4 PoE++ Ports 123W, Fanless Metal Design,...
TP-Link TL-SG2210P V3 | Jetstream 8 Port Gigabit Smart Managed PoE Switch | 8 PoE+ Ports @61W, 2...
TP-Link TL-SG2210MP | Jetstream 10 Port Gigabit Smart Managed PoE switch | 8 PoE+ Ports @ 150W, 2...
Detailed guide: How to fix Plex behind CGNAT
Answers to the questions that matter before you change your setup.
How do I tell if I am behind CGNAT?
Open your router status page and note the WAN IPv4 address. Addresses in the 100.64.0.0/10 shared range and the RFC1918 private ranges are signs that your router is not directly reachable from the public internet. Compare with the public address reported by an internet IP-check service. If they do not match, contact the ISP for confirmation. Double NAT inside your own home can produce similar symptoms and should be excluded.
Why does port forwarding fail?
Your router only controls its own translation table. If the ISP translates your address again upstream, an unsolicited internet request cannot traverse that translation unless the ISP supports it. Opening port 32400 on your router does not change the ISP equipment. For direct public Plex access, you need a reachable public endpoint plus correct firewall and router mapping.
Does buying a commercial VPN solve it?
Usually not. A commercial VPN can change your outgoing public IP, but most provider services are not an inbound hosting product. Unless the provider explicitly supports an inbound forwarded port and compatible routing, it will not make Plex publicly reachable. A VPN subscription bought solely to fix CGNAT can therefore leave you with the same problem.
What if I only stream to my own phone?
Tailscale is an efficient first option. Put the Plex server and authorized client devices on the same tailnet, test the private host IP, then open Plex on its internal service port. This avoids exposing Plex to every internet user. If the overlay uses a relay, test throughput with your normal media files and inspect your home upload bandwidth.
What if other family members stream remotely?
If those viewers can use Tailscale reliably, a private tailnet can work. For many people, nontechnical clients or devices that cannot run Tailscale, normal Plex remote access backed by a public IPv4 address is often more practical. Ask your ISP about static or dynamic public IPv4, pricing, and whether inbound ports are permitted before considering a tunnel service.
Frequently asked questions
Will replacing the NAS fix CGNAT?
No. CGNAT is controlled by your internet provider and remains even if you buy a more expensive NAS.
What is the shared CGNAT address range?
100.64.0.0/10 is reserved for shared address space, often used by ISPs for CGNAT.
Sources and setup documentation
Before changing your router, NAS firewall or Plex service configuration, consult the official platform documentation:
Amazon pricing is shown only when backed by a verified API observation within the past 24 hours. Older observations are retained but are not presented as a current deal. Models, capacities, stock and compatibility must be confirmed on Amazon before purchase. As an Amazon Associate, CloudZat may earn from qualifying purchases.