Remote access behind CGNAT, 4G/5G and Starlink, with no port forwarding

Every device on the internet needs an address to be reached at. There aren't enough of the classic (IPv4) addresses to go round, so many providers, especially mobile, fixed-wireless and satellite ones, give one public address to a whole group of customers. That's carrier-grade NAT, or CGNAT.

Going out works normally: you browse, stream and video call as usual, because replies find their way back to the connection you started. But nothing on the internet can start a connection to you. Your router doesn't own a public address, so a port forwarding rule on it has nothing to forward from. Dynamic DNS doesn't help either, because the address it would point at is shared with strangers.

Ordinary home routers have a milder version of the same problem, explained in remote desktop without port forwarding. CGNAT is the case where even port forwarding can't fix it.

1. 1

   Step 1: Find your router's internet address

   Sign in to your router's settings page (often printed on a sticker on the router) and look at its status page for the internet, WAN or mobile address.

2. 2

   Step 2: Find the address the internet sees

   From a device on the same connection, open our free What's my IP tool.

3. 3

   Step 3: Compare them

   If they're different, you're behind some kind of shared address. If the router's address is between 100.64.0.0 and 100.127.255.255, the range set aside for CGNAT, you can be sure. If you already forwarded a common port such as 3389 or 22, our open port checker shows whether it's really open from the internet; behind CGNAT it won't be.

The usual fixes are to ask your provider for a public address (some offer one, sometimes at a cost), rely on IPv6 (only if both ends have it), or run your own VPN server somewhere public. With a relayed remote access app, you don't need any of them.

Think of two people whose phones can make calls but can't receive them. They can still talk if both ring the same switchboard and the operator connects them. That's what a relay does.

The RemoteAccessApp Agent on your PC keeps an outgoing connection to your account. When you open the PC from another PC, a browser or your phone, that device connects out too, and the relay joins the two. Both connections are outgoing, which is exactly what CGNAT allows, so the PC's address never matters: it can be shared, change every day, or sit behind two layers of routers. The same idea lets you SSH into your home server from your phone without opening a port.

From the Windows app, the session is encrypted end to end between your console and the PC, so the relay passes along data it can't read. In a browser it's encrypted too, but not end to end. Nothing is recorded either way.

1. 1

   Step 1: Install RemoteAccessApp on the PC you want to reach

   Download it from the download page and run it on that PC. There's nothing to set on the router, the modem or the satellite dish.

2. 2

   Step 2: Add the PC to your free account

   Choose Set up this PC and sign in, or type the 6-digit setup code from Add a PC on your dashboard. The PC shows as online within seconds.

3. 3

   Step 3: Keep it awake and signed in

   Leave Start RemoteAccessApp with Windows ticked and set the PC not to sleep while it's plugged in. For a PC nobody sits at, turn on unattended access at the PC.

4. 4

   Step 4: Connect from anywhere

   Open the PC from the RemoteAccessApp Console on another Windows PC, or sign in at remoteaccessapp.com in any browser. It doesn't matter what kind of internet the other end has either.

What makes a remote screen feel quick is mostly the delay and the upload speed at the PC you're reaching, because the picture is sent from there, as remote desktop latency explained simply shows. Mobile and satellite links vary through the day, so a few settings help:

• Low-bandwidth mode in the Windows app: open Connection health in a session (Ctrl+Alt+Shift+I) to see live speed, delay and quality, and switch it on with one click. It sends a smaller, lighter picture at up to 10 frames a second, and it's remembered for that PC.
• Saves data quality in a browser session, for the same reason.
• One monitor. In Display, pick a single monitor rather than all of them, and close video or big downloads on the PC.
• Let it reconnect. A dropout, a satellite handover or a switch from Wi-Fi to mobile data shows Reconnecting, and the session picks up again by itself.
• Check the line. Our speed test measures delay and speed to RemoteAccessApp and says how a session will feel.

CGNAT itself never blocks RemoteAccessApp, but a few things can: the PC being asleep or offline, a firewall that stops new programs connecting out, or a very strict network. The relay and firewall help page walks through them, and remote desktop keeps disconnecting covers sessions that drop.