Remote access behind CGNAT
On carrier-grade NAT your device shares one public address with thousands of other subscribers. There is nothing to forward and nothing to point a hostname at. An outbound connection is the way through.
You are probably behind CGNAT if…
- The router's own address starts with 100.64 through 100.127, and not with 192.168 alone.
- The address your router shows does not match the one a "what is my IP" page reports.
- Forwarding a port changes nothing from outside.
- You are on mobile broadband, a fixed-wireless link, or a newer fibre plan without a static address.
Some providers will sell you a public address. Many will not, and none of that is under your customer's control on the day the machine needs support.
The device makes the only connection
Nothing has to reach in. The agent opens an authenticated outbound connection and keeps it, so the shared carrier address never matters.
No inbound path needed
The agent dials out over ordinary HTTPS, the same way a browser or an update check does.
Both ends prove who they are
Every device holds its own CA-issued certificate. The private key is generated on the device and never leaves it.
A name that stays put
Many devices share one address, demultiplexed by hostname — no port-per-device sprawl.
CGNAT questions we get
Do I need a static IP or a public address?
No. Neither the device nor the network needs a public address, because nothing connects towards it.
Will this survive the carrier changing my address?
Yes. If the connection drops the agent redials, and the hostname you use does not change.
Is a VPN not simpler?
A VPN also works outbound, but it puts the whole network in scope and needs client software everywhere. The comparison page lays out both.
Can the relay read what passes through?
Passthrough traffic is never decrypted at the relay. We route by TLS SNI without reading a single byte of your payload.
The hardware people run into this with
A Raspberry Pi on home broadband, an ESP32 on a mobile router, or a machine gateway on a site link. Same model, no port forwarding — see why that matters.
Reach the device your carrier hid
Free tier, no card required.