Skip to main content
Dualbuy VPN
Get started

How to access a MikroTik router remotely without a public IP

· · 4 min read

Behind CGNAT, Starlink or a 4G SIM you can't forward ports. Here is why, and how a tunnel started by the router lets you reach Winbox, Webfig, SSH and the API from anywhere.

A lot of MikroTik routers sit behind a connection you can't reach from outside: a 4G/LTE SIM, an ISP that uses CGNAT, or a plan that never gives you a public address. From the internet there is simply nothing to connect to, so Winbox can't find the router when you are away from the site.

Why the usual fixes don't work

  • Port forwarding needs a public IP on the router's WAN interface. Behind CGNAT the public address belongs to your ISP and is shared between many customers, so there is nothing for you to forward to.
  • MikroTik IP Cloud and dynamic DNS give the router a name, but that name points at the same unreachable address.
  • Asking the ISP for a static public IP works when it is offered, but it is often a paid extra and usually not available on mobile connections.

Even when it is possible, exposing Winbox to the internet is risky, because bots probe its default port around the clock. Our remote management security checklist shows how to harden a router if you do.

Starlink, 4G/LTE and other CGNAT connections

These are the connections where this problem shows up most. Mobile networks (4G/LTE and 5G SIMs) normally share one public address between many subscribers, and Starlink's standard residential service also places customers behind CGNAT. Whatever the cable or antenna, the router can still open an outgoing tunnel, so the approach in this guide applies to all of them. The full guide is MikroTik remote access behind Starlink, CGNAT and 4G.

The idea: let the router call out

Outgoing connections work fine behind CGNAT, because the router is the one starting them. If the router opens a VPN tunnel to a server that does have a public address, that server can send management traffic back through the same tunnel. You connect to the server, and the server hands your session to the router.

  1. The router connects to the server over SSTP, L2TP/IPsec or OpenVPN.
  2. The server gives the router a private address inside the tunnel.
  3. The server publishes the router's Winbox, Webfig, SSH and API services on ports reserved for you.
  4. You connect to the server's address and your port from anywhere, and the traffic is carried down the tunnel.

Nothing is opened on your side: no port forwarding, no static IP, and no change to the ISP's equipment.

Setting it up with Dualbuy

  1. Create an account and pick one of the MikroTik remote access plans.
  2. In the dashboard, choose the server location and the protocol for your device.
  3. Copy the ready-made line the dashboard gives you and paste it into the router's terminal (in Winbox: New Terminal). The router connects by itself.
  4. Use the address and ports shown on the device's card in the dashboard to open Winbox, Webfig, SSH or the API.
Admin access through ports works while the router is connected over SSTP, L2TP/IPsec or OpenVPN. It does not work over WireGuard.

Choosing a protocol

If your network blocks UDP, start with SSTP: it runs over TCP and passes through most firewalls. The four options are compared in MikroTik VPN protocols compared.

Before you rely on it

  • Set strong passwords and switch off the services you don't use (see the checklist).
  • Test the connection while you are still on site, so anything that goes wrong can be fixed locally.
  • Keep RouterOS up to date.

Keep reading