Starlink Port Forwarding: Why It Fails on CGNAT and 4 Ways That Work
The Starlink router cannot forward ports and Residential plans sit behind CGNAT. How the Priority public IP, IPv6, a port-forwarding VPN or NordVPN Meshnet open access anyway.
Quick Answer
You cannot port forward on the Starlink router: it has no port forwarding or firewall settings. On Residential and Roam plans your IPv4 is also behind CGNAT (100.64.0.0/10), which blocks all inbound connections. Local and Global Priority plans can enable a public IPv4 in the account dashboard; then put the Starlink router in bypass mode and forward ports on your own router. On any other plan, use IPv6 through your own router, a VPN with port forwarding such as Proton VPN or PureVPN, or NordVPN Meshnet when only your own devices need access.
Starlink port forwarding does not work on the Starlink router itself: Starlink’s own help center says the router “does not support port forwarding.” On Residential and Roam plans the bigger obstacle is that your IPv4 address sits behind CGNAT (a shared address from 100.64.0.0/10), and that default policy “does not allow inbound traffic” no matter which router you use.
That leaves four routes that actually work: a public IPv4 on a Priority plan with your own router in bypass mode, IPv6 through your own router, a VPN with port forwarding that works on any plan, or NordVPN Meshnet when you only need to reach your own devices.
Can You Port Forward on Your Starlink Plan?
Starlink runs two IPv4 policies, “default” (CGNAT) and “public.” Which one you can get depends on the service plan, so this is the first thing to check before touching any router settings:
| Plan | IPv4 policy | Inbound connections | What to do |
|---|---|---|---|
| Residential, Residential Lite, Roam | Default policy: CGNAT (100.64.0.0/10) | No inbound IPv4 | VPN with port forwarding, NordVPN Meshnet, or IPv6 with your own router |
| Local Priority, Global Priority | Optional public IPv4 (enable it in the account dashboard) | Yes, through a third-party router in bypass mode | Public IPv4 + bypass mode + port forwarding on your own router |
| Any plan, IPv6 | Native IPv6 with a delegated /56 prefix | Only if your own router lets you open IPv6 firewall rules | Third-party router + IPv6 firewall rule; both ends need IPv6 |
To confirm CGNAT on your own line, compare the WAN address on a third-party router with the public IP shown by our NAT checker. A WAN address that starts with 100.64–100.127 is the shared space reserved for carrier NAT in RFC 6598. Our CGNAT check guide walks through it step by step.
Why Port Forwarding Rules Do Nothing on Starlink
The Starlink router has no menu for it
CGNAT drops inbound IPv4
Your own router adds double NAT
4 Ways to Open Ports on Starlink
1. Public IPv4 on a Priority plan
Best for: permanent servers, CCTV/NVR, anything that needs fixed ports
Switch to Local or Global Priority, enable the public IPv4 option in the account dashboard, put the Starlink router into bypass mode and forward ports on your own router. The address is reserved across reboots but is not truly static: relocating the dish or a software update can change it, so pair it with dynamic DNS.
2. IPv6 through your own router
Best for: Plex, web apps and SSH when every client has IPv6
Every Starlink gets a delegated /56 IPv6 prefix. The Starlink router has no firewall rules for IPv6, so use a third-party router (in bypass mode) and allow the port to the device’s IPv6 address. Clients on IPv4-only networks and many games and consoles still cannot reach you this way.
3. VPN with port forwarding
Best for: Residential and Roam plans, torrents, game hosting, remote cameras
The VPN server owns a public IPv4 address and forwards a port down your outbound tunnel, so CGNAT never sees an unsolicited connection. It works on any Starlink plan and with the stock Starlink router.
4. No open port: NordVPN Meshnet
Best for: reaching your own devices privately
NordVPN Meshnet links your devices into a private encrypted network that connects outbound from both ends, so CGNAT does not matter and nothing is exposed to the internet. It is free with a Nord Account (no paid plan needed), covers 10 of your own devices plus up to 50 invited ones, and runs on Windows, macOS, Linux, Android and iOS. Only devices with the app can connect, so it suits remote desktop, NAS access and private game sessions, not a public server.
How to Port Forward With a Starlink Public IP (Priority Plans)
- 1
Enable the public IPv4 option
In your Starlink account dashboard, turn on the public IPv4 setting for a Local or Global Priority service line. It is not offered on Residential or Roam.
- 2
Put the Starlink router into bypass mode
In the Starlink app go to Settings > Bypass Mode. This switches off the Starlink router’s Wi-Fi and routing. The app cannot turn it off again: only a factory reset does.
- 3
Connect your own router
Plug a third-party router into the Starlink router’s Ethernet port (or the Ethernet adapter on older kits). Its WAN address should now be the public IPv4, not 100.64.x.x.
- 4
Forward the ports on your own router
Reserve a LAN IP for the server, then add the port rules in your router (see our TP-Link, ASUS or UniFi guides). Allow the same port in the device firewall.
- 5
Add dynamic DNS
Starlink reserves the address across reboots, but relocating the dish or a software update can change it. A DDNS hostname keeps friends and apps pointed at the right IP.
- 6
Test from outside
Check the port from mobile data or with our NAT checker. Testing from inside your own network can fail even when the rule works.
Bypass Starlink CGNAT With a Port-Forwarding VPN
If you are on Residential or Roam, or you do not want to pay for Priority just to open one port, a VPN with port forwarding is the practical fix. Your device opens an outbound tunnel (which CGNAT allows), and the VPN server forwards a public port down that tunnel. Only a few VPNs still offer this; NordVPN, Surfshark and ExpressVPN do not. NordVPN’s Meshnet is a different tool: it reaches your own devices privately (route 4) but does not open a public port.
Proton VPN
- Port forwarding on all paid plans (Windows, Linux; macOS in early access)
- Works through Starlink CGNAT with the stock Starlink router
- One random port per connection; it usually changes when you reconnect
- WireGuard keeps the extra latency on top of Starlink low
- 30-day money-back guarantee
2-year plan
PureVPN
- Choose the exact port numbers your game, camera or NAS needs
- Optional dedicated IP so friends always connect to the same address
- Works on Residential and Roam plans where Starlink offers no public IPv4
- Apps for Windows, macOS, Linux and routers
- 31-day money-back guarantee
5-year plan·$1.69/mo $12.95/mo
This page contains affiliate links. If you sign up through them, NAT Checker may earn a commission at no extra cost to you.
Which one fits your use?
- The app accepts any port (qBittorrent, Soulseek, a game where you set the server port): Proton’s single random port is enough. Update the app when the port changes after a reconnect.
- The server needs a fixed port or several ports (Minecraft on 25565, Arma 3 on 2302–2306, an NVR app): use PureVPN and add those exact ports.
- Expect some extra latency. Pick a VPN server close to the Starlink gateway (PoP) you are routed through, not just close to your house.
Sources: Proton VPN port forwarding, PureVPN port forwarding. More providers are compared in our VPN port forwarding guide.
Best Route by What You Are Hosting
| You want to… | Best route on Starlink | Guide |
|---|---|---|
| Minecraft or other game server for friends | Public IPv4 (Priority) or PureVPN with the game port | Minecraft ports |
| qBittorrent / Soulseek showing “port closed” | Proton VPN port forwarding (one random port is enough) | qBittorrent setup |
| Plex remote streaming | IPv6 via your own router, Proton or PureVPN, or Plex relay | Plex guide |
| Security cameras / NVR viewing | Vendor cloud app, NordVPN Meshnet, or PureVPN with fixed ports | Hikvision guide |
| Remote desktop or SSH to your own PC | NordVPN Meshnet (free, no open port needed) | Meshnet guide |
| Console Strict NAT / party chat | Bypass mode + UPnP on your own router first; CGNAT still limits hosting | Starlink NAT type |
Ports Starlink Blocks (Even With a Public IP)
Starlink filters a short list of ports on its network. A public IP or a perfect router rule will not open these, so move the service to another port if you need one of them:
| Port | Protocol | Blocked direction | Common use |
|---|---|---|---|
| 25 | TCP & UDP | Outbound | SMTP (sending mail directly) |
| 135–139 | TCP & UDP | Both | NetBIOS |
| 445 | TCP (IPv4) | Outbound | SMB file sharing |
| 1900 | UDP | Inbound | SSDP |
| 11211 | UDP | Inbound | Memcached |
| 17, 19, 520 | UDP | Inbound | QOTD, CHARGEN, RIP |
Summarised from Starlink’s “What ports does Starlink block?” article, which also lists port 0, DHCP (67/546–547) and, in Indonesia, TCP 465.
Related Starlink and CGNAT Guides
Official sources (checked October 30, 2026):
- • Starlink: Can I port forward with the Starlink router?
- • Starlink: What IP address does Starlink provide? (CGNAT, public IPv4 on Priority, /56 IPv6)
- • Starlink: What is bypass mode?
- • Starlink: What ports does Starlink block?