The fourth private range nobody voted for.

The problem it solves, one layer up

RFC 1918 solved the address shortage for you in 1996: your home network reuses a shared pool of private addresses, and one public address per household is enough. It worked so well that IPv4 survived two decades longer than the math said it should.

Then, around 2012, the pool ran dry at a higher level. The providers themselves ran out of public addresses to hand out. A new customer signing up for mobile data or fibre could no longer be guaranteed a public IPv4 at all. The industry’s answer was carrier-grade NAT: put a second, giant NAT inside the provider’s network and let hundreds of customers share a single public address, exactly the way your household already shares one.

But that second NAT needs addresses of its own for the link between you and it. And this is where a subtle, expensive trap appears.

Why the old private ranges wouldn’t do

The obvious move was to reuse RFC 1918 space for the provider’s side. It is free, it is private, it is right there. The problem: your home already uses it. If your ISP ran its NAT on 192.168.x, and your router hands out 192.168.x inside your house, the two would collide. Your router would see the same range on both its inside and its outside, and the packets would have nowhere sensible to go.

This is the core of RFC 6598, and it is a genuinely clean piece of reasoning. Reusing public space that belongs to someone else would break connections to that someone. Asking for a fresh block of real public addresses defeated the whole point, since public addresses were the thing in short supply. The least-bad option left was to carve out one new /10, roughly 4.2 million addresses, that nobody had ever been told to use for anything, and reserve it strictly for this provider-to-customer plumbing.

The apartment building, one floor up

Keep the RFC 1918 picture: the internet is a city, your home is an apartment building, your public IP is its one street address, and inside, apartments are numbered privately.

Carrier-grade NAT is what happens when even the streets run out of addresses. Now a whole housing estate shares one street address and one central mailroom. Your building’s “street address” turns out to be just an internal unit number in the estate, meaningful only to the estate’s mailroom, which is your provider’s CGN. Shared Address Space is simply the rule that says which numbers the estate may use for those internal unit numbers, so they never clash with the apartment numbers already painted on doors inside each building.

The catch is the same catch, doubled. An apartment number means nothing outside its building; now a building number means nothing outside its estate. Mail addressed to your building specifically, an inbound connection, cannot find its way in, because from the city’s point of view your building does not have an address at all.