Yes, Starlink’s CGNAT affects inbound remote access and IPv4 port forwarding, but it does not make every VPN unusable. Starlink’s default IPv4 service places customers behind carrier-grade NAT (CGNAT), using an address in 100.64.0.0/10. Your router therefore does not have an Internet-reachable public IPv4 address, and Starlink says its default policy blocks inbound traffic. A laptop or phone connecting outward to a work VPN can still work when the VPN uses NAT traversal over TCP or UDP. Reaching a server inside your Starlink network from the Internet is a different problem: it requires an eligible public IPv4 option or a properly configured IPv6 path, plus a router that can enforce forwarding and firewall rules.
What Starlink’s CGNAT changes
CGNAT lets many customer connections share Starlink-managed public IPv4 addresses. Starlink’s Help Center describes the default arrangement as DHCP assignment of private address space from the 100.64.0.0/10 prefix, followed by translation in Starlink’s network. You can see an address in that range on a router’s WAN status page, but it is not a public address that an outside device can route directly to your home.
As an Amazon Associate I earn from qualifying purchases.
The practical consequence is directional:
- Outbound connections—your device starts the connection to a website, VPN gateway, or cloud service—usually work normally.
- Inbound connections—an outside device starts a connection to a server, camera, NAS, or desktop at your Starlink location—are blocked by the default IPv4 policy.
A port-forward rule only tells your local router what to do with traffic that reaches it. Under CGNAT, unsolicited IPv4 traffic is stopped upstream before it reaches that router. Adding a rule, buying a different router, or changing a local firewall cannot remove Starlink’s upstream translation.
Free tools Windows power users keep installed
One-click scans. No signup required.
Starlink’s official IP guidance says, “The default IP policy using CGNAT blocks all inbound ports.”
#1 Best Overall
Elebase USB to USB C Adapter for iPhone 18 Pro Max,USBC Car Charger Adapter | 4Pack Type C Female to A Male Cable Converter for Apple Duo 17 16 15 14 Plus,iWatch Watch 12 11 10,iPad 9 8 Air,Airpods 5 4
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Does Starlink work with VPNs?
Starlink’s own VPN guidance says, “Yes. Starlink supports VPNs that use TCP or UDP.” The answer depends on whether the VPN is an outbound client connection or an inbound service hosted at your location, and on whether the protocol can traverse NAT.
Client-to-site VPNs
When a laptop or phone at home connects to an employer’s or provider’s VPN server, the session is outbound. Starlink lists SSTP, OpenVPN, and WireGuard as client-to-site protocols that generally work well through CGNAT. SSL-based VPNs typically work best because they are designed to operate over ordinary TCP or UDP flows.
Starlink lists PPTP and L2TP as generally not working well for this use. The protocol name alone is not a guarantee: authentication, transport selection, keep-alive behavior, and the VPN gateway’s NAT handling all matter. A configuration that works on one service can fail on another even when both use the same protocol family.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Site-to-site VPNs and network appliances
For permanent links between two offices or networks, Starlink identifies MPLS, IKEv2/IPsec, and OpenVPN as generally working well when the equipment supports NAT traversal. It identifies GRE, IPsec without NAT-T, and L2TP as generally not working well under its default CGNAT policy.
Starlink’s enterprise guidance says NAT traversal over TCP or UDP is required for VPN or SD-WAN appliances. It specifically identifies protocol numbers GRE (47), ESP (50), AH (51), and L2TP (115) as dropped by CGNAT. An IPsec design that uses UDP-based NAT-T is therefore materially different from raw ESP transport.
VPN performance and support limits
Encryption consumes processing capacity, and a VPN can add a longer or less direct network path. That can reduce throughput, increase latency, or change how an application behaves even when the tunnel connects successfully. Starlink says configurations vary and that it cannot guarantee compatibility, including when a customer has a public IP. VPN troubleshooting is outside the scope of its ordinary network support, so the VPN provider or appliance manufacturer may need to inspect logs and settings.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
| VPN scenario | Protocols Starlink lists as generally working well | Protocols or transport Starlink identifies as problematic |
|---|---|---|
| Client-to-site | SSTP, OpenVPN, WireGuard | PPTP, L2TP |
| Site-to-site | MPLS, IKEv2/IPsec, OpenVPN | GRE, IPsec without NAT-T, L2TP |
| Appliance or SD-WAN traversal | VPN encapsulated in TCP or UDP with NAT traversal | GRE (47), ESP (50), AH (51), and L2TP (115) through CGNAT |
Can you use remote access or host a service over IPv4?
Inbound IPv4 access requires a public address assigned to the Starlink service. Starlink’s current guidance limits its public IPv4 option to specified Priority plan categories, with availability dependent on the account and market. Check the plan and networking options shown in the customer’s Starlink account rather than assuming every subscription qualifies.
Public IPv4 is not a guaranteed static address
Starlink describes the public address as DHCP-based rather than permanently static. Its reservation system is intended to retain the address through a power-off or reboot, but relocation or software updates can change it. If you publish a hostname, use a dynamic-DNS service that can detect address changes, and design your remote-access process to recover when the address changes.
Router requirements
Starlink states that its Wi-Fi router does not support port forwarding. It also says customers need both a third-party router capable of port forwarding and firewall controls and a public IP assigned to the service. The third-party router improves local control; it does not bypass CGNAT by itself.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
A typical inbound IPv4 setup is:
- Confirm in your Starlink account that the service has an eligible public IPv4 option and note whether the address is currently public rather than in
100.64.0.0/10. - Use a third-party router with a documented port-forwarding feature, stateful firewall, and support for the WAN connection method provided by your kit.
- Connect the router to Starlink. If the kit requires an Ethernet adapter, use the adapter appropriate for that kit; Starlink says the required connection method varies by hardware generation.
- If you want the third-party router to manage the entire local network, enable Starlink’s Bypass Mode in the router settings when supported. This disables Starlink Wi-Fi management; it does not alter Starlink’s upstream CGNAT policy.
- Give the internal server a stable LAN address, preferably with a DHCP reservation.
- Create the narrowest forwarding rule needed, specifying the external port, internal address, internal port, and transport (TCP or UDP). Allow the same traffic in the third-party router’s firewall.
- Test from a genuinely external network, such as a phone using cellular data. Testing from inside the same LAN can produce a false result because some routers do not support hairpin NAT.
Do not expose administrative interfaces unnecessarily. Restrict source addresses where possible, use strong authentication and current software, and prefer an encrypted application protocol rather than forwarding an unprotected management port.
Can IPv6 avoid the IPv4 CGNAT problem?
Starlink supports native IPv6 and documents delegation of a /56 prefix. With IPv6, an outside client can potentially route directly to a device without IPv4-style carrier NAT. That is an option only when every important part of the path supports IPv6: the server, remote client, DNS, application, and router firewall.
Recommended Free Tools
Direct routability is not the same as safe exposure. Starlink says its Wi-Fi routers do not provide firewall rules for IPv4 or IPv6, so a third-party router or host firewall may be needed to define which IPv6 services are reachable. Check the delegated prefix, address assignment, and firewall policy after reboots or network changes. If the remote client is IPv4-only, an IPv6-only service will not solve that client’s access problem.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Port blocks that can still matter
CGNAT is not the only possible cause of a failed connection. Starlink’s published port guidance lists restrictions by IP version, transport, port, and direction. It explicitly identifies outbound TCP port 25, commonly used for SMTP, and outbound TCP port 445, commonly associated with SMB, among its restrictions. The same guidance includes additional inbound UDP and other blocked combinations.
If a service remains unreachable after you obtain a public address and configure a capable router, verify the service’s transport and port against Starlink’s current port table. Also check the server’s local firewall, the router’s forwarding rule, and whether the application is listening on the expected interface. A public address does not override a blocked port or a host that is not listening.
Choose the right approach for your goal
| What you need | Most relevant approach | Important limitation |
|---|---|---|
| Connect a laptop or phone outward to a work or commercial VPN | Use a VPN that supports TCP or UDP NAT traversal; Starlink lists OpenVPN and WireGuard among generally successful client-to-site choices. | Protocol labels do not guarantee a particular configuration. Expect possible throughput or latency changes. |
| Reach a home server over IPv4 from outside | Check eligibility for Starlink public IPv4, then use a third-party router with forwarding and firewall controls. | Availability is plan- and market-dependent, and the DHCP address can change after relocation or software updates. |
| Reach a service over IPv6 | Use compatible IPv6 endpoints and a router or host firewall that supports IPv6 rules. | End-to-end IPv6 support is required, and Starlink’s Wi-Fi router lacks firewall-rule support. |
| Build a site-to-site VPN or SD-WAN tunnel | Choose equipment that performs NAT traversal over TCP or UDP. | GRE, ESP, AH, and L2TP are identified as dropped by CGNAT; Starlink does not guarantee appliance compatibility. |
How to diagnose a failed connection
The router shows a 100.64.x.x WAN address
That indicates the default CGNAT arrangement is likely still in place. A local port-forward rule cannot make inbound IPv4 work in this state. Check whether your account offers the public IPv4 option and whether it has actually been assigned. If the account is not eligible, use an outbound relay or VPN architecture in which the home device initiates the tunnel to a reachable server, rather than trying to accept a direct inbound connection.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsThe VPN client cannot connect
- Confirm that the client is using TCP or UDP and that the selected transport is allowed by the VPN gateway.
- Test a supported profile such as OpenVPN or WireGuard when the provider offers one.
- For an appliance, enable its NAT-traversal or UDP-encapsulation mode and avoid raw GRE, ESP, AH, or L2TP through CGNAT.
- Review authentication, MTU, keep-alive, and split-tunnel settings with the VPN administrator.
- Compare behavior with and without the VPN before attributing every slowdown to Starlink; encryption and the remote server’s route can also be responsible.
The public-IP setup still fails
- Verify that the third-party router’s WAN address is genuinely public and not another private or shared range.
- Check that the server has a stable LAN address and is listening on the forwarded port.
- Confirm the forwarding rule uses the correct transport and that the router firewall permits it.
- Test from outside the Starlink network and allow for DNS records or dynamic-DNS updates to propagate.
- Check Starlink’s current blocked-port guidance, especially for TCP 25, TCP 445, and the relevant UDP service.
IPv6 works locally but not remotely
Confirm that the remote network has IPv6 connectivity, that the server has a current address from the delegated prefix, and that the host and router firewalls allow the service. A device can have an IPv6 address while still rejecting all unsolicited inbound traffic, which is the safer default.
Bottom line
Starlink’s CGNAT blocks unsolicited inbound IPv4 by default, so ordinary port forwarding cannot publish a home service. Outbound VPN clients can work, especially with TCP or UDP NAT traversal; Starlink lists SSTP, OpenVPN, and WireGuard as generally suitable for client-to-site use. For inbound IPv4, verify eligibility for Starlink’s public IPv4 option and pair it with a third-party router that supports forwarding and firewall rules. IPv6 may provide another path, but only with end-to-end IPv6 support and deliberate firewall configuration.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
