CGNAT (Carrier Grade NAT) blocks all inbound connections on 4G, 5G and Starlink connections. If your router cannot accept remote connections for CCTV, VPN or telemetry, CGNAT is almost certainly why.
Request your free IPv4 Guide and we will follow up with the right solution for your installs.
What is CGNAT?
Carrier Grade NAT lets mobile operators share a single public IPv4 address across thousands of devices. Your device receives an address in the 100.64.0.0/10 range — not a routable public IP. Nothing on the internet can initiate a connection to your device.
Which UK networks use CGNAT?
| Network | CGNAT on standard SIM? | Static IP option |
|---|---|---|
| EE | Yes | M2M business SIM only, extra cost |
| Vodafone | Yes | M2M business SIM only, extra cost |
| O2 | Yes | M2M business SIM only, extra cost |
| Three | Yes (standard APN) | 3internet APN — at risk post-merger |
| Starlink | Yes — all plans | Not available on any plan |
| All MVNOs | Yes | Rarely, if ever |
What CGNAT blocks
| Application | Behind CGNAT | With Speedroute |
|---|---|---|
| Remote NVR / CCTV access | Blocked | Working |
| VPN hosting | Blocked | Working |
| IP whitelisting (BESS, SCADA, monitoring) | Fails | Working |
| Out-of-band management | Blocked | Working |
| Payment terminal reach-back | Blocked | Working |
| Standard outbound internet | Working | Working |
How to check if you are behind CGNAT
Visit ifconfig.me from a device on the network. If the IP starts with 100.64 through 100.127, you are behind CGNAT.
How Speedroute solves CGNAT
Speedroute establishes a WireGuard tunnel from your router to the Speedroute London hub. A dedicated static public IPv4 from a BGP-announced /24 block is assigned to your tunnel. All inbound traffic for that IP arrives at the hub and is forwarded through the tunnel to your device. The underlying WAN — 4G, 5G, Starlink or broadband — does not matter. The IP never changes.
Request your free IPv4 Guide and we will follow up with the right solution for your installs.