Short answerYour SIM almost certainly gives the router a private address behind the network’s carrier-grade NAT (CGNAT), so nothing on the internet can start a connection to it. Fix it with a fixed public IP SIM, a private APN, or a VPN or cloud service that the router connects out to.
It is the most common 4G support question we see. The router is online, the cameras record, and yet nobody can log in from the office. Port forwarding is set up correctly and still nothing. The router is not the problem.
How to tell if you are behind CGNAT
- Look at the WAN or mobile IP address on the router’s status page.
- From a device behind the router, visit any “what is my IP” site.
- If the two addresses differ, you are behind NAT in the network. Addresses starting 10., 100.64 to 100.127, 172.16 to 172.31 or 192.168. on the router’s mobile interface are private.
Option 1: a fixed public IP SIM
The SIM is provisioned on an APN that gives the router a public address that never changes. You connect straight to it. It is the simplest fix for a handful of sites and works with any software that expects an IP address. The trade-off is exposure: the address is visible to the whole internet, so the router’s firewall needs to be set up properly. More in fixed IP 4G SIM cards.
Option 2: a private APN
All your SIMs join a private network, linked to your office or data centre by a VPN or a leased line. Each router gets a private address that you choose, and nothing is reachable from the public internet. This suits larger estates, such as utilities, retailers and local authorities, where many devices need to talk back to central systems.
Option 3: let the router dial out
Because outbound connections work on any SIM, the router can open a tunnel to a server you control (OpenVPN, WireGuard or IPsec) or to a cloud service. Teltonika’s RMS is one example: the router connects out to RMS, and you reach the router and devices behind it through that connection. Router Store has a short explainer on what Teltonika RMS is, and another on VPNs on cellular routers.
This works on multi-network and roaming SIMs, where a fixed IP is harder to get, but you depend on the server or service being available.
Which to choose
| Fixed IP SIM | Private APN | VPN / cloud tunnel | |
|---|---|---|---|
| Setup effort | Low | High | Medium |
| Best for | 1 to 50 sites | Large estates | Any size, mixed SIMs |
| Exposed to internet | Yes, firewall it | No | No |
| Works with multi-network SIMs | Sometimes | Sometimes | Yes |
| Ongoing cost | Per SIM | Setup plus per SIM | Server or service fee |
Frequently asked questions
Will IPv6 fix CGNAT?
In theory a public IPv6 address can be reached directly, but UK mobile data SIMs and much industrial kit still rely on IPv4. Do not plan remote access around IPv6 without testing it end to end.
Can a dynamic DNS service get round CGNAT?
No. Dynamic DNS keeps a name pointed at a changing public address. Behind CGNAT the router has no public address of its own, so there is nothing to point at.
Is a fixed IP SIM safe?
It is as safe as the firewall in front of it. Open only the ports you need, restrict them to known sources and change default passwords.
NANick Appleby
Nick Appleby has worked in UK telecoms since 1998, starting at BT, and has spent most of that time on cellular routers, data SIMs and the antennas that connect them for business and industrial sites. He writes 4G SIM to explain how the networks and the kit actually behave, in plain English.