You misunderstand CGN deployments - there are still different address spaces on either side of the customer router. It's just now both of them are private/non r

You misunderstand CGN deployments - there are still different address spaces on either side of the customer router. It's just now both of them are private/non routable prefixes, or in some cases the telco side is done using six. There's no briding and UPNP will never work - once you are on CGN data paths have to be set up from the customer side.