Remote access guide
What is CGNAT?
Carrier-grade NAT lets an ISP share one public IPv4 address across many customers, but it also means your router may not receive a unique public IPv4 address that outside visitors can reach directly.
How to tell if you are behind CGNAT
- Check the WAN address shown by your router.
- Compare it with the public IP shown by an external IP-checking service.
- If the addresses differ, your ISP may be translating traffic upstream.
- If port forwarding never works even when configured correctly, CGNAT is a common reason.
Why Dynamic DNS alone is not enough
Dynamic DNS helps when your public IP changes. CGNAT is a different problem: the home network may not have a usable public IPv4 endpoint at all. In that case, a hostname can still point somewhere, but inbound traffic still has no direct route into the home network.
What to use instead
Use Public Tunnel when you want to expose a browser-based local app through an outbound connection. Use Static-IP Relay when you need a stable public endpoint for SSH, RDP, VPN, cameras, or another TCP service.
Think CGNAT is the thing blocking you?
Start with the deeper guide, then choose the Remote Access path that matches the service you need to reach.