One way, although I suspect it's dieing, is some of the network equipment supports header injection. So what will happen, if you go to an approved URL, the netw

One way, although I suspect it's dieing, is some of the network equipment supports header injection. So what will happen, if you go to an approved URL, the network will inject headers into the HTTP request that contain you're 10.xx IP address, IMSI, etc, which can allow it to survive a NAT. This tends to get used mostly for internal traffic and partners where an agreement exists, although I think I read once that a US carrier messed up their configuration once and the header injection was happening on every site. For encrypted traffic, I'm not sure what's happening these day's.