"With CNAT, you still show a public IP to websites."
Yes but there is a private ip network between you and the public ip which is why you can't forward.
"That IP can be traced to multiple people"
" If that user happens to be behind carrier-grade NAT, other users sharing the same public IP with the spammer will be mistakenly blocked"
It was not clear from your statements that the block is against the public ip of the private lan you are going through. After all you can't block a private ip address in a public namespace. In most cases of NAT its many to one as in one public ip to many, but not the same, private ip addresses. And actually you can't trace past the public wan ip if there is any kind of proper config/firewall and you couldn't trace to people. If you could trace it would be devices.
"which is to say the IP assigned to your cellular device may also be used by someone else at the same time"
I see this differently. The cellular device would have a private ip address which would be unique on that lan. What I think you saying is that you are talking about the public ip address that the cellular devices has to go through to get to the public ip.
Think of using CNAT with a router as two private routers in series [public ip(wan interface)<>router<>(lan interface)<>private ip(wan interface)<>router<>(lan interface)<>hosts in private ip lan where the cameras would be.
"you go out of your way to correct me"
Not my intention. Thought I was clarifying.
"Which is it; will cellular work or not work for OP's issue?"
Worked fine for the building site and their security cameras. It was quite a while into the project before telephone /fiber were delivered to the site. Cameras could pan the entire 180 degree of each camera. Certainly worth talking to a wireless carrier.
Edited by Wand3r3r, 13 August 2016 - 03:10 PM.