SSH to a device behind CGNAT
Behind carrier-grade NAT your router has no public IP, so no setting on it can let a connection in. The device has to dial out.
Check if you are behind CGNAT
- Look up the WAN IP on the router's status page.
- Look up your public IP on any "what is my IP" site.
-
Different numbers, or a WAN IP between
100.64.0.0and100.127.255.255? That is CGNAT or double NAT.
It is common on mobile (4G, 5G) and satellite links.
Starlink
Starlink's default IPv4 setup is CGNAT, and it lets no inbound traffic in. A public IPv4 is an option on Priority plans only. Its routers have no port forwarding. Every plan has native IPv6, but only devices and networks that use IPv6 can be reached that way. Source: Starlink's support pages, read on 22 October 2026.
So the usual Starlink fix is the same: let the device dial out. On a mobile router instead, see SSH over 4G or LTE.
What works
A reverse SSH tunnel to a server with a public IP is fine for one machine. You own the server and the reconnects.
A mesh VPN, like Tailscale, works through CGNAT and may fall back to a relay of theirs.
A hosted relay, like RescueShell, is built for devices you ship to other people's networks.
RescueShell on a CGNAT link
The device needs outbound HTTPS and nothing inbound. A dropped link reconnects by itself; the schedule is on the 4G and LTE page. You open the shell from the browser, with nothing to install on your side.
€0.10 a device a month, billed yearly, at least €6 a year. Also see SSH without port forwarding.