diff --git a/server.ts b/server.ts
index ada80a1..0e74f45 100644
--- a/server.ts
+++ b/server.ts
@@ -109,6 +109,11 @@ function isPrivateIp(ip: string): boolean {
   if (v4 === "127.0.0.1" || ip === "::1") return true;
   if (v4.startsWith("10.")) return true;
   if (v4.startsWith("192.168.")) return true;
+  // CGNAT range (RFC 6598) — used by Railway's internal proxy
+  if (v4.startsWith("100.")) {
+    const second = parseInt(v4.split(".")[1] ?? "", 10);
+    if (second >= 64 && second <= 127) return true;
+  }
   if (ip.startsWith("fc") || ip.startsWith("fd")) return true;
   if (v4.startsWith("172.")) {
     const second = parseInt(v4.split(".")[1] ?? "", 10);