You want to reach your home server, your NAS or your camera recorder from outside, and nothing works. The reason: Starlink puts you behind CGNAT, so you have no public IP and port forwarding is impossible. The good news is that the modern fix is free, takes about fifteen minutes, and is genuinely safer than opening ports ever was.
Use an outbound tunnel: Cloudflare Tunnel or Tailscale
Both are free for personal use and work perfectly behind CGNAT, because your machine connects out instead of waiting for connections in. No ports opened, nothing exposed.
What CGNAT actually means
Carrier-Grade NAT means Starlink shares one public IP address among many customers. Your router gets a private address, not a routable one. Consequences:
- Port forwarding does nothing. There is no public address pointing at you.
- Dynamic DNS doesn’t help. It would just point at Starlink’s shared address.
- Outbound traffic is completely normal — browsing, streaming, video calls, VoIP, game clients. Only inbound connections are blocked.
Starlink does offer a public IPv4 option on some business plans, but for a household it’s expensive overkill. The tunnel approach is better in every way.
Which one to pick
| Cloudflare Tunnel | Tailscale | |
|---|---|---|
| Best for | Publishing a web service at a real URL | Private access from your own devices |
| Public access | Yes, anyone with the link | No, only your devices |
| Non-web protocols (SSH, SMB) | Awkward | Excellent |
| Needs a domain | Yes | No |
| Cost | Free tier | Free up to 100 devices |
Plain rule of thumb: Tailscale if it’s just for you (NAS, cameras, remote desktop, SSH). Cloudflare Tunnel if others need to reach it in a browser.
Tailscale in five minutes
- Create a free account and install Tailscale on the machine you want to reach.
- Install it on your laptop and phone too, signed into the same account.
- That’s it — each device gets a stable private address and they can talk to each other from anywhere.
Handy extra: enable subnet routing on one machine at home and you reach your whole local network, including devices that can’t run Tailscale themselves, like a camera recorder or a printer.
Cloudflare Tunnel, briefly
- Point a domain you own at Cloudflare (free plan is fine).
- Install
cloudflaredon your machine and authenticate it. - Create a tunnel and map a hostname to your local service, for example
localhost:8080. - Your service is live at that hostname over HTTPS, with a certificate handled for you.
Add Cloudflare Access on top and you can require a login before anyone reaches the service — a meaningful upgrade over a port left open to the internet.
An open port is scanned continuously by bots within hours of opening. A tunnel exposes nothing: there is no inbound door to find. CGNAT, which felt like a limitation, ends up pushing you toward the safer architecture.
What works fine behind CGNAT anyway
- Commercial VPNs (the kind you subscribe to) — outbound, no issue.
- VoIP and video calls. See the home phone guide →
- Cloud-based cameras and doorbells.
- Online gaming, though strict NAT can occasionally limit hosting a lobby.
- Remote desktop services that broker the connection for you.
Frequently asked questions
Does a tunnel slow things down?
Slightly, but for a NAS or a camera feed it’s not noticeable. Your upload speed is the real limit.
Can I self-host a website on Starlink?
Yes, via Cloudflare Tunnel. Bear in mind your upload capacity and that residential terms of service may restrict commercial hosting.
Does IPv6 solve this?
Starlink does provide IPv6, which can allow inbound connections. But too many networks you’d connect from are still IPv4-only, so a tunnel remains the reliable answer.
Will a business plan fix it?
A public IP is available on some business tiers, but at a price that makes no sense for a household when free tunnels do the job.
No Starlink yet?
CGNAT is a solved problem. Check availability and get your first month free.
Third-party service features and free tiers change; check current terms. Last updated: September 1, 2026.
*1 mois d'abonnement Starlink gratuit (équivalent à votre forfait) crédité automatiquement 30 jours après l'activation de votre service, en commandant via notre lien de référral officiel RC-DF-7650727-61403-46. Programme officiel SpaceX. Aucun coût supplémentaire pour vous : prix identique à starlink.com. FastSat.ca reçoit une compensation (140 $ en argent ou en crédit) pour chaque référral, ce qui finance le site.