Overcoming CGNAT: Direct Device Access Without Port Forwarding

Posted on January 15, 2026 | Category: Networking | Reading time: 8 minutes

What is CGNAT?

Carrier-Grade Network Address Translation (CGNAT) is increasingly used by ISPs to manage their IP address space. While economical, CGNAT prevents traditional port forwarding, making it difficult to access devices remotely from the public internet.

The Problem

Behind CGNAT, your public IP is shared with other customers. This means you cannot:

  • Forward ports on your router
  • Run public-facing services
  • Access internal devices via their public IP

The Solutions

1. Cloudflare Tunnels

Cloudflare Tunnels (formerly Argo Tunnel) create a secure outbound-only connection from your network to Cloudflare's network.

sudo cloudflared tunnel create my-network
sudo cloudflared tunnel route dns my-network device.example.com
sudo cloudflared tunnel run my-network

Advantages: Free tier available, DDoS protection, simple setup, no open ports needed.

2. WireGuard VPN

Set up a WireGuard server on a public VPS and create a VPN tunnel back to your network.

wg-quick up wg0
ip link set wg0 up
iptables -A FORWARD -i wg0 -o eth0 -j ACCEPT

Advantages: Fast, lightweight, full control, ideal for site-to-site connectivity.

3. Hybrid Approach

Use FDS Remote MikroTik for seamless integration with your existing infrastructure.

Recommended Setup for MikroTik

For ModernISP/Mikrotik systems behind CGNAT:

  1. Register for FDS Remote MikroTik service
  2. Configure secure access to your MikroTik routers
  3. Monitor tunnel status from ModernISP admin panel
  4. Access your devices remotely and securely from anywhere via Winbox or WebFig

Conclusion

CGNAT doesn't have to limit your network capabilities. By using FDS Remote MikroTik, you can achieve secure, reliable remote access without traditional port forwarding.

Have questions about FDS Remote MikroTik setup? Contact us for a free consultation.