Home / Guides / Self-hosting behind CGNAT

Security cameras behind CGNAT: why remote viewing fails

Your cameras record fine, and you can watch them on home Wi-Fi, but remote viewing to your recorder times out. If your ISP uses CGNAT, the connection from outside never reaches it.

Why CGNAT gets in the way

Viewing a camera or recorder directly from outside your home means connecting into your network, usually through a forwarded port. Behind CGNAT, your router doesn't hold a public IPv4 address, so that connection stops at the ISP's NAT (RFC 6269, section 5.2.1).

What works and what doesn't

Recording and local viewing on your home network: unaffected.
Cameras that upload to, or are viewed through, an online service: they connect out, so they usually keep working.
Connecting directly to your own recorder from outside over IPv4: blocked, unless your ISP gives you a public IPv4.
Direct viewing over IPv6: can work if your ISP gives you IPv6, the viewing device's network has IPv6, and your router's IPv6 firewall allows it.

Check whether you're behind CGNAT

Compare your router's WAN address with your public IP using the CGNAT checker or the step-by-step guide. A WAN address between 100.64.0.0 and 100.127.255.255 is the CGNAT range (100.64.0.0/10 explained). If the two addresses match, CGNAT isn't your problem; check the port forward and any inbound port blocks your ISP lists.

What to ask your ISP

"Can you move my line off CGNAT and give me my own public IPv4?" Some ISPs do this for free on request; others only with a paid static IP.
"Do you sell a static IP on residential plans, and what does it cost?" Some ISPs only sell it on business plans.
"Is IPv6 available on my line, and is it turned on?" IPv6 doesn't go through the CGNAT, but the other side needs IPv6 too.
"What upload speed does my plan really have?" Every remote video stream uses your upload, so several cameras can fill a slow one.

If you do open a port to a camera or recorder, change the default password and keep its software up to date, since anything you open can be found by others on the internet.

Which ISPs make this easier

Of the 41 ISPs we track, 12 give home customers a public IPv4 by default, 3 offer a free CGNAT opt-out and 8 sell a static IP on home plans, per our sources. See ISPs without CGNAT, ISPs that use CGNAT, or filter the ISPs without CGNAT that sell a static IP on home plans in your state. Each ISP page also quotes what the terms say about running servers at home.

FAQ

Why can't I view my security cameras remotely?

If your ISP uses CGNAT, your router doesn't have its own public IPv4 address, so a direct connection from outside to your camera or recorder stops at the ISP's NAT. Forwarding the port on your router isn't enough.

Do my cameras still record behind CGNAT?

Yes. Recording and viewing on your home network don't depend on a public IP.

What should I ask my ISP?

Ask whether it can move your line off CGNAT to a public IPv4, whether it sells a static IP on home plans, and whether IPv6 is available and turned on. Check your upload speed too, since remote viewing uses it.

This site sticks to ISP facts. It doesn't review or recommend third-party products or services.