Stuck behind CGNAT? What it means for a small business

If your cameras won't show up in their app away from the office, remote desktop never connects, and the port forward you set up does nothing, your internet line may be behind CGNAT. Here is what that means in plain words, a two-minute check to find out, what it breaks, and the options that actually fix it.

What CGNAT is, in plain words

Every device on the internet that other people can reach needs a public address. There are not enough of the classic kind (IPv4) to go around, so many providers share one public address among many customers. The industry name for this is CGNAT, short for carrier-grade NAT.

Think of it as an office building with one street address and no suite numbers. Mail you send out gets back to you, because the front desk remembers who sent it. But a letter that arrives unannounced has no way of finding you. The front desk belongs to your provider, and you can't tell it where to deliver.

That is why browsing, email and video calls work fine behind CGNAT. They all start from inside. Anything that needs someone outside to reach in first stops at your provider's equipment.

It is very common on Starlink, on T-Mobile and Verizon 5G home internet, and with many rural and cellular providers. Some cable and fiber providers do it too.

How to tell: the two-minute check

1. Find your router's internet address. Open your router's status page or app and look for the WAN or Internet address. That is the address your router thinks it has.
2. Find the address the internet sees. From any computer or phone on the same network (Wi-Fi on, cellular off), open a "what is my IP" website, such as ifconfig.me.
3. Compare them. If the two match, you are not behind CGNAT, and your problem is somewhere else, such as a router or firewall setting. If they are different, something between you and the internet is translating your address a second time, and you can't forward ports through it.

A quick giveaway: if your router's address starts with 100.64 through 100.127 (for example 100.72.15.9), that range is set aside for exactly this kind of sharing. Some providers use ordinary private ranges instead, such as addresses starting with 10.. Same meaning: your router holds an address nobody on the internet can reach.

One more thing to check while you're there: if your router has two internet lines, check both. Each line has its own address from its own provider, and each one can be behind CGNAT on its own.

What breaks for a business

• Cameras and recorders. Many camera and NVR apps need to reach the recorder at the site. Behind CGNAT the app can't find it. Some brands route through their own cloud instead, which can work, but you are then tied to that brand's service.
• Remote desktop and remote support. Connecting straight to a computer or server at the site fails, because there is no address to connect to.
• Phone systems. On-site phone systems and some desk phones need to be reached from outside. Calls can fail to connect, or ring with no sound.
• Port forwarding. The rule on your router is correct and does nothing. It forwards traffic that never arrives, because your provider's equipment drops it first.
• Dynamic DNS. It keeps a name pointed at your current address. Behind CGNAT that address is shared with other customers, so the name points somewhere nobody can connect to.
• Services that only allow known addresses. Banks, suppliers, alarm monitoring companies and some software vendors let in only addresses they have on a list. A shared address that changes can't go on that list.

Your options, fairly

1. Ask your provider for a static IP or a business plan

Try this first. It can be one phone call. Some providers will give you a public address, or a static one, on a business plan, sometimes for a monthly fee. Ask for "a public IPv4 address, not CGNAT". Support staff often hear "static IP" as a different, more expensive product.

The catch: many providers, especially satellite and 5G home internet, don't offer it on every plan or in every area. And if you have two lines, you get two addresses from two providers. When the router switches to the backup line, people trying to reach you are still knocking on the first address.

2. A cloud relay service

Some camera brands, remote-desktop tools and remote-access services route the connection through their own servers. Your equipment connects out to them, and you connect to them too, so CGNAT doesn't get in the way.

These work well for the one job they were built for. The limits: each tool covers its own product only, you may need a separate service for each system at the site, and the address people reach belongs to the service, not to you. That doesn't help with an allowlist that wants your own fixed address.

3. A tunnel to an address you control

Your router keeps an encrypted tunnel open to a server that does have a public address. Traffic to that address comes down the tunnel to your site. Because your router starts the connection, CGNAT doesn't block it.

You can build this yourself with a rented server and some networking work, and many IT people do. Or you can use a service that provides the address and the setup for you. Either way, it works for any port and any device, and the address stays the same whichever line your site is on.

IPv6 is also worth a look for some uses. Many CGNAT providers give out real IPv6 addresses, but whoever connects to you needs IPv6 too, and many business networks and apps still don't have it.

Where TunnelNet Business fits

TunnelNet Business is option 3, done for you. Your router connects to us, and the whole site gets one dedicated public IPv4 address. It is $49 per site per month, including 1 TB of traffic.

• Its own public address. People and apps reach your cameras, recorders, door systems or servers at this address, and it does not change when your provider changes yours.
• Two internet lines, one address. Set up a main line and a backup, for example Starlink plus a cellular modem. If the main line stops carrying traffic, the router moves to the backup and the site keeps the same address. In our lab, a MikroTik router kept the same address reachable after switching lines in about 2 to 3 seconds, and an OPNsense router in about 4 to 6 seconds. Your time depends on your router and your lines.
• Every port closed until you open it, for the device you choose, and limited to the addresses you name if you want.
• Ready-made router setup. Pick your router, download its setup file and follow five steps. The router's private key is made in your browser and never sent to us.

It works today with MikroTik (RouterOS 7) and OPNsense routers. UniFi, Peplink and GL.iNet are coming soon. We list a router only once we have tested it.

One thing to know up front: the address is for people and apps reaching your site. Your staff's own browsing still goes out through your normal lines, as it does today. A whole-site mode, where all outgoing traffic leaves from the site's address, is coming soon. It is not available yet.

Want the details of how it works and how we tested it? Read One static IP across any internet line. Have a MikroTik router? See Setting up a MikroTik site in ten minutes. Or go to the TunnelNet Business page, or add your first site.

Questions? Email support@minakilabs.com. Support is by email only. TunnelNet is operated by MinakiLabs LLC.