MikroTik remote access behind Starlink, CGNAT and 4G
By Alaa Ezat · · 5 min read
Why Winbox fails remotely behind Starlink and 4G SIMs, how to tell your router is behind CGNAT, and a comparison of the four ways to reach a MikroTik without a public IP.
If your MikroTik reaches the internet through Starlink or a 4G or 5G SIM, the usual way of getting to it remotely, opening the Winbox port or using DDNS, will most likely fail. In most cases the cause is CGNAT: your provider puts your router behind a NAT of its own, so no connection coming from the internet ever reaches it. This guide shows how to confirm it, why the usual fixes fail, and which options actually work.
Why can't I reach my MikroTik remotely over Starlink or a 4G SIM?
Because the provider does not give your router a public IP address of its own; it puts it behind a network-level NAT called CGNAT. Connections that your router starts towards the internet work normally, but connections coming from the internet towards it stop at the provider's equipment and never reach you.
That is why browsing and apps work fine while Winbox, SSH and Webfig from outside the network do not respond. It is common on mobile networks, and specialist sources note that Starlink commonly uses CGNAT for residential IPv4, although public-address options vary by plan and region.
How do I know my MikroTik is behind CGNAT?
Compare the address of the router's WAN interface with the public address websites see for you: if they differ, you are behind another NAT, most likely your provider's CGNAT. If the WAN address is inside 100.64.0.0/10, that is direct evidence of CGNAT, because the range is officially reserved for Carrier-Grade NAT in RFC 6598.
How to check:
- In Winbox open IP → Addresses and look at the address on the WAN interface (for example
lte1orether1). - From a device on the same network, open any website that shows your public address.
- If the two addresses differ, or the WAN address starts between 100.64 and 100.127, direct access from outside will not work.
Or list the addresses from the terminal:
/ip address printWhy doesn't opening the Winbox port or using DDNS work behind CGNAT?
Because opening a port (dst-nat) happens inside your own router, while the incoming connection is rejected before that, at the provider's equipment. And DDNS updates a name with your shared public address, but that address belongs to the provider's device and is shared with other customers, so it does not lead to your router.
Even if you do get a public address, exposing Winbox to the internet invites constant scanning. We cover that in detail in the remote management security checklist for MikroTik.
What are my options for reaching a MikroTik behind CGNAT?
Every solution that works behind CGNAT relies on one idea: the router starts the connection towards a point on the internet, and you come in through that point. What differs is who runs that point and what you can do through it.
| Option | Works behind CGNAT? | Router access (Winbox, SSH) | What it takes |
|---|---|---|---|
| Ask the provider for a public IP | Removes CGNAT if offered | Yes, but the port is exposed to the internet | Depends on the provider and plan, often at an extra cost |
| MikroTik Back To Home | Yes, directly or through relay servers | Yes, over a VPN tunnel to the router and its network | RouterOS 7.12 or newer, and ARM, ARM64 or TILE hardware |
| Your own VPS with a VPN tunnel | Yes | Yes | Setting up, maintaining and securing the server and tunnel yourself |
| A ready-made access service such as Dualbuy | Yes | Yes, through Winbox, Webfig, SSH and API | Pasting one command into the router's terminal |
Back To Home: a MikroTik feature that sets up VPN access to your router and network from anywhere, even when the router has no public address. According to MikroTik's Back To Home documentation, if the router is not directly reachable from the internet the connection goes through MikroTik relay servers, and speed could be limited in that case. It requires RouterOS 7.12 or newer and ARM, ARM64 or TILE hardware, so it is not available on routers that don't meet that.
Your own VPS: full control, but you become responsible for another server: updating it, securing it and watching that it stays up.
A ready-made service: moves the server burden to someone else, which is what Dualbuy offers: your router connects to our server, and we publish the Winbox, Webfig, SSH and API ports for your device.
Which VPN protocol works best over Starlink and mobile networks?
Start with SSTP if the network blocks UDP, because it runs over TCP and passes through most firewalls. If your goal is managing the router through Winbox, choose SSTP, L2TP/IPsec or OpenVPN, because administrative access through ports on Dualbuy does not work over WireGuard.
We compare the four protocols in detail in MikroTik VPN protocols compared.
How do I set up remote access behind CGNAT with Dualbuy?
Create an account and pick a plan, then paste the ready-made command from the dashboard into the MikroTik terminal (Winbox → New Terminal). The router then connects to our server by itself, and you reach it through Winbox from anywhere, even behind Starlink or a 4G SIM.
- Create your account in the Dualbuy dashboard.
- Pick the remote access plan that fits your number of devices.
- Copy the command from the dashboard and paste it into New Terminal.
- Use the address and port shown in the dashboard to connect through Winbox.
For a broader explanation of the same idea without the focus on CGNAT, read how to access a MikroTik router remotely without a public IP.