BEAD: CGNAT or Buy?

The Real Cost Comparison for Subsidized Rural Networks

If you’re engineering a BEAD-funded build these days, someone in your organization has already said it: “We’ll just run CGNAT.” It’s the reflexive answer to IPv4 scarcity, and it’s not a crazy one. Carrier-grade NAT is mature, standardized, and running in production at some of the largest networks on earth.

But “we’ll just run CGNAT” treats a genuine architectural decision as a foregone conclusion. For a low-density rural footprint built with public money (a network that will be reported on, audited, and watched by a state broadband office for years) the CGNAT-versus-public-addressing question deserves actual numbers. The IPv4 market has changed enough since most operators last priced it that the instinctive math is probably wrong in one direction or the other.

This blog works through both sides of the ledger: what CGNAT really costs at rural scale once you count logging, support burdens, and hardware lifecycles, and what an IPv4 maintenance model really costs at 2026 market prices amortized over the BEAD compliance timeframe. CGNAT wins some of these comparisons. Public addressing wins others. The goal is a framework that lets you make the case for whichever fits your build.

The horizon you’re planning against

BEAD’s statutory clock matters to this analysis. Subgrantees must deploy and begin providing service within four years of receiving the subgrant, and with most states executing grant agreements and starting construction in 2026, that puts deployment obligations running through roughly 2030. Of course, reporting and monitoring obligations continue throughout. Whatever addressing architecture you choose, you’ll operate it under scrutiny for at least that long, and realistically far longer, because nobody re-architects a working access network in year five.

That horizon changes the math. A one-time capital cost divided over four years looks very different divided over ten. Keep both timeframes in mind.

What CGNAT actually costs at rural scale

The hardware line item is the part everyone prices first, and at rural scale it’s genuinely modest. A WISP or fiber operator serving 2,000–5,000 subscribers doesn’t need a chassis-scale NAT appliance. Software-based CGNAT on commodity x86 (e.g. VyOS, a Linux/nftables build, or a licensed BNG-integrated product) can handle multi-gigabit translation. Even purpose-built carrier appliances sized for this subscriber count typically land in the low tens of thousands of dollars. Call it $15,000–$50,000 for a redundant pair with licensing and support, depending on how much vendor you want between you and a 2 a.m. state-table problem. Redundancy is not optional: a CGNAT box is a stateful single point of failure for every subscriber behind it, and “the internet is down for the whole county” is exactly the headline a subsidized network cannot afford.

The less-visible line items are where CGNAT budgets slip:

Hardware Lifecycles.

The amortization comparison often omits hardware replacement cycles. A 10-year operating horizon will likely require at least one costly forklift upgrade of the NAT appliances, effectively doubling that baseline hardware capital over the life of the network.

Logging infrastructure.

A CGNAT deployment without translation logging is a network that cannot answer a subpoena. When abuse or a lawful-intercept request traces to a shared public IP, you must be able to say which subscriber held which external IP and port range at a given timestamp. Per-session NAT logging at even a few thousand subscribers generates a firehose; most operators mitigate it with deterministic NAT or port-block allocation, which shrinks log volume dramatically but adds configuration complexity and constrains ports per subscriber. Either way you’re buying and operating a log pipeline that includes collectors, storage sized to your retention policy, and a retrieval process an engineer can execute under legal deadline. Budget real money and real staff time here, because this is the component that gets tested by a US Attorney’s office rather than by your monitoring system.

Public addresses anyway.

CGNAT doesn’t eliminate your IPv4 requirement; it compresses it. At a conservative 16:1 subscriber-to-address ratio, 4,000 subscribers still need roughly a /24 for NAT pools, plus untranslated public space for infrastructure, CPE management, servers, and every subscriber who demands a real address. Push ratios harder (some vendors advertise up to 100:1) and you save addresses at the cost of port exhaustion complaints from households full of simultaneous sessions.

DDoS Mitigation and Security.

CGNAT introduces a severe security blast radius. If a shared public IP is targeted by a Distributed Denial of Service (DDoS) attack, the mitigation efforts and the attack itself will simultaneously impact all 16 to 100 subscribers sharing that address. This turns an isolated incident for one user into a localized network outage.

BEAD Performance Testing Compliance.

BEAD funding requires rigorous, ongoing speed and latency testing. Stateful CGNAT processing can occasionally introduce micro-jitter or latency under peak loads, which might complicate compliance reporting and artificially degrade the performance metrics you report to state broadband offices.

Support burden.

This is the cost item that never appears in the capital budget and always appears in the operating one. CGNAT breaks inbound connectivity by design: port forwarding dies at your equipment no matter how correctly the subscriber configures their router. The predictable ticket categories are gaming (strict NAT types, peer-to-peer session failures), self-hosted anything (cameras, NVRs, home servers, remote desktop), some VPN and video-conferencing edge cases, and IP-reputation collateral damage. One bad actor behind a shared address can get the whole pool blacklisted or captcha-walled, and every subscriber sharing it inherits the punishment. Each of these becomes a truck-roll-adjacent support interaction in a service area where truck rolls are measured in hours of windshield time. If your loaded cost per escalated ticket is $25–$50 and CGNAT generates even one extra escalation per hundred subscribers per month, that’s a permanent $3–$6 per subscriber per year tax, before counting churn from the customers who leave over it.

The scrutiny factor.

A privately funded ISP can decide its tolerance for these complaints internally. A BEAD subgrantee can’t, entirely. Subsidized networks answer to state broadband offices, publish performance data, and operate in communities where “the government-funded internet can’t run my security cameras” travels fast. None of this makes CGNAT unacceptable as plenty of well-run subsidized networks use it but it raises the price of getting the subscriber experience wrong.

What public IPv4 actually costs: The IPv4 Maintenance Model

Here’s where instinct is most likely to be stale. Operators who priced IPv4 during the 2021 peak remember $50–$60 per address and rising. That market is gone. Mid-2026 analyses of publicly priced transfers put the average around $20 per address (roughly a third of the late-2021 peak) with transfer volumes at record highs. Smaller blocks carry a premium: /24s, the minimum routable unit, trade in roughly the $20–$25 per address range, while larger blocks price closer to the mid-teens.

Run the model for a 4,000-subscriber build with one public IPv4 per subscriber plus infrastructure overhead, call it a /20 (4,096 addresses):

• Purchase, at $20–$25 per address for a mid-size block: $82,000–$102,000 one-time, or about $20–$26 per subscriber. Amortized over the four-year BEAD deployment window, that’s $5–$7 per subscriber per year; over a ten-year operating life, $2–$3. And unlike a NAT appliance, addresses don’t depreciate to zero. They remain a transferable asset on your books, whatever their future market value turns out to be.

• Lease, at prevailing rates of roughly $0.30–$0.45 per address per month: $15,000–$22,000 per year for the /20, or $4–$6 per subscriber per year, with no capital outlay and no transfer process. Leasing converts the whole question into a clean opex line. This is attractive when BEAD capital is already committed to construction but at the cost of never building equity in the space and carrying renewal-price risk.

Adopting Public IPv4 is an ongoing Maintenance Model, not just a one-time transaction. Owning or leasing addresses avoids stateful hardware limitations, but managing public space isn’t zero-touch. You must account for IP Address Management (IPAM) overhead, maintaining accurate geolocation databases so subscribers don’t get misrouted, managing RPKI/ROAs for routing security, and directly handling abuse complaints. However, this maintenance is largely administrative and scales linearly, rather than introducing hardware bottlenecks and single points of failure.

Against that, the honest CGNAT comparison isn’t zero. It’s the redundant appliance pair (plus future replacement cycles), the logging stack, the compressed-but-real address pool, support and license renewals, and the recurring support-ticket tax. For a small rural operator, the fully loaded CGNAT number frequently lands in the same range as simply buying the addresses and is sometimes above it.

When CGNAT wins

Very high subscriber counts against fixed capital.

The CGNAT cost curve is flat-ish. The appliance pair and logging stack cost roughly the same at 5,000 subscribers as at 20,000. while public addressing scales linearly with subscribers. Somewhere north of the small-operator range, translation gets structurally cheaper per subscriber, which is exactly why mobile carriers and large cable operators run it.

IPv6-forward architectures.

If you’re deploying dual-stack or IPv6-only with translation (464XLAT, MAP-T, DS-Lite), most traffic volume like the big streaming and cloud platforms rides native IPv6 and never touches the NAT. CGNAT sized for residual IPv4 traffic is a smaller, cheaper box, and the subscriber-experience blast radius shrinks with it. A greenfield BEAD build that skips native IPv6 in 2026 is making an unforced error regardless of what it does with IPv4.

Cash-constrained builds with existing gear.

If your BNG platform includes CGNAT capability you’ve already licensed, the marginal hardware cost approaches zero and the comparison narrows to logging plus support burden versus address cost.

When public addressing wins

Small and mid-size subscriber counts.

Below a few thousand subscribers, CGNAT’s fixed costs are spread thin and a $20 address amortized over a decade is close to a rounding error. This describes a large share of rural BEAD footprints.

Networks selling to businesses and power users.

Anchor institutions, small businesses, and work-from-home professionals in your footprint will need static public addresses. If a meaningful fraction (or a “vocal” and/or “influential” portion) of your base ends up carved out of CGNAT anyway, you’re running two addressing architectures and paying for both.

Operators who can’t staff the logging obligation.

A three-engineer WISP that would struggle to produce port-mapping records under a 48-hour legal deadline should think hard before creating that obligation. Handing a subpoena a public IP with a standard DHCP lease record is an operational problem you already know how to solve.

Anyone optimizing for subscriber experience under public scrutiny.

One address per home makes port forwarding, gaming, cameras, and geolocation just work. On a network whose performance is a matter of public record, that’s worth something hard to capture in a spreadsheet.

Making the case with numbers

The decision framework, compressed: model your fully loaded CGNAT cost (redundant translation, future hardware lifecycles, logging pipeline, residual address pool, support delta) and your fully loaded addressing cost (purchase amortized or lease annualized, your IPv4 maintenance model overhead, over an honest operating horizon, net of residual asset value) at your actual subscriber count. Then check the qualitative overlays, including IPv6 architecture, business-customer mix, legal-response staffing, and the visibility that comes with public money.

At current market prices, the surprising result for many rural builds is that the “expensive” option, just buying public IPv4, is now one of the cheapest line items in the project. The reflexive answer deserved a spreadsheet. Now it has one.