Port forwarding on Starlink is difficult because most Residential and Roam connections use CGNAT, which prevents incoming IPv4 connections from reaching devices on your home network. The standard Starlink router also lacks the usual port forwarding controls. For direct access from the internet, Starlink's Local Priority and Global Priority plans offer a public IPv4 option, alongside a separate router configured in bypass mode. If you use a Residential or Roam plan, other solutions depend on what you want to access. A VPN with port forwarding works for game servers, Tailscale offers private access to devices such as NAS drives and security cameras, while tunnels and VPS hosting provide alternatives for running public websites and apps.
Last updated: November 9, 2026
Table of contents
- Check whether you are behind CGNAT
- Pick a fix by what you want to reach
- Fix 1: Public IPv4 with your own router
- Fix 2: A VPN with port forwarding
- Fix 3: A private mesh VPN
- Fix 4: A tunnel or your own VPS
- Fix 5: IPv6
- Common ports and how to reach them
- Security before you open anything
- Port still closed? Troubleshooting
- FAQ
Check whether you are behind CGNAT
Carrier-grade NAT (CGNAT) means many customers share one public IPv4 address, so a port opened on your router leads nowhere. The shared address block reserved for this is 100.64.0.0 to 100.127.255.255. Starlink states that its default IPv4 CGNAT policy does not allow inbound traffic.
| Test | How | What it means |
|---|---|---|
| Router WAN address | Open the status page of your own router, or use bypass mode and read its WAN IP | An address from 100.64.0.0 to 100.127.255.255 means CGNAT |
| Traceroute | Run tracert 1.1.1.1 on Windows or traceroute 1.1.1.1 on Mac and Linux | A hop inside 100.64.0.0 to 100.127.255.255 near the start confirms it |
| Address comparison | Compare the WAN address with the IP shown by a “what is my IP” site | Two different addresses mean a shared address in between |
Pick a fix by what you want to reach
The best fix depends on who needs to connect, not on which method sounds strongest. Start here.
| You want to | Best fix | Avoid |
|---|---|---|
| Host a game server for friends | Public IPv4 on a Priority plan, or a port-forwarding VPN | Relying on IPv6 alone, since many players lack it |
| Watch your Plex or Jellyfin library while traveling | A mesh VPN such as Tailscale, or public IPv4 | Pushing video through a free web tunnel |
| Reach your NAS, cameras or home automation yourself | A mesh VPN or WireGuard | Opening the admin page to the internet |
| Publish a website or web app | A VPS reverse proxy or a tunnel service | Hosting from home without a firewall |
| Seed torrents or fix a strict NAT on a console | A VPN that supports port forwarding | Hoping UPnP works behind CGNAT |
| Remote desktop or SSH | A mesh VPN | Forwarding the raw port at all |
Fix 1: Public IPv4 with your own router
This is the only route to ordinary port forwarding. Starlink offers a public IPv4 option on its Local Priority and Global Priority plans, and you switch it on in your account dashboard by setting the IP policy to Public IP. The Starlink router has no port forwarding or firewall rules for IPv4 or IPv6 on any plan, so you also need a third-party router. A public IPv4 address is not a static address, and Starlink does not offer static IP addresses.
| Step | What to do | Check |
|---|---|---|
| 1 | Move to a Local Priority or Global Priority plan if you are on Residential or Roam | Priority plans cost more, so check the current price on Starlink’s site |
| 2 | In your Starlink account, set the IP policy to Public IP | Reboot the dish afterward |
| 3 | Enable bypass mode in the Starlink app and connect your router’s WAN port to the Starlink router | Gen 3 has built-in Ethernet ports, and Gen 2 needs the Starlink Ethernet adapter. Check the cable or adapter for a Mini |
| 4 | Set your router’s WAN to DHCP | The WAN address should no longer start with 100.64 |
| 5 | Forward the port to your device’s fixed local address | Match TCP or UDP to the service |
| 6 | Test from mobile data, with Wi-Fi off | A test from inside your network can give a false result |
| 7 | Add a dynamic DNS name | The public address can change after a restart |
If you host a Minecraft Java world for five friends in different countries, this route means they join with a normal address and no extra software. To leave bypass mode later, factory reset the Starlink router, using the reset button on Gen 3 or the power-cycle method on Gen 2.
Fix 2: A VPN with port forwarding
A VPN with port forwarding gives you a public address on the VPN provider’s server. Friends or apps connect to that server’s IP and port, and the VPN carries the traffic to you. You keep your current Starlink plan, which makes this the cheapest route to inbound access. The trade-off is latency, since your traffic crosses the satellite link and then a VPN server.
| Provider | Port forwarding | Notes |
|---|---|---|
| Proton VPN | One dynamic port through NAT-PMP, on paid plans | Works on P2P servers and in the Windows and Linux apps. The port can change |
| PureVPN | Paid add-on with user-selected ports, up to 15 in one comparison | Works only on supported locations |
| Private Internet Access | Built into its apps | Limited to selected server locations |
| AirVPN | Up to 20 ports, reserved in the web dashboard | Manual setup, with no automatic mapping |
| Mullvad | Removed on July 1, 2023 | Not an option |
| NordVPN | Does not offer inbound port forwarding | Not an option |
Before you pay, confirm that your chosen server location supports forwarding and sits close to your players. If your friends are in Brazil and the only supported server is in Europe, the connection adds a long detour on top of satellite latency, and a Priority plan with public IPv4 will play better.
Fix 3: A private mesh VPN
A mesh VPN such as Tailscale, ZeroTier or your own WireGuard setup links your devices through an outbound connection, so CGNAT does not matter and no port is open to the internet. This is the safest way to reach a NAS, cameras, a home automation hub or a remote desktop.
| Strength | Limit |
|---|---|
| Works behind CGNAT with no Starlink plan change | Every device that connects needs the app |
| No open ports for attackers to find | Not suited to strangers or a public website |
| Traffic is encrypted between your devices | Relayed connections are slower when a direct path fails |
| A free personal tier exists for most users | Check the current limits before you rely on it |
If you want to open your Jellyfin library from a hotel in Tokyo, install the mesh app on the server and on your phone, then connect through the private address. Family members need the app too, so this suits a small group.
Fix 4: A tunnel or your own VPS
A tunnel service or a small rented server (VPS) accepts public traffic and passes it back to your home through a connection that your network opens. That works behind CGNAT because the connection starts from inside.
| Option | Good for | Limits |
|---|---|---|
| Cloudflare Tunnel | Websites and web apps with a domain name | Built for web traffic. Cloudflare’s terms restrict serving video and large non-HTML files through its network, and users disagree on whether tunnel traffic is covered, so read the current terms before streaming media |
| Your own VPS with WireGuard and a reverse proxy | Games, web apps and full control | Costs a monthly fee and adds a hop. Choose a plan with enough bandwidth |
| Game tunnel services such as playit.gg | Hosting a game server with no router changes | Support depends on the game, and speed depends on the provider’s servers |
| Tailscale Funnel | Sharing one web service quickly | Designed for light web traffic |
Fix 5: IPv6
Starlink provides native IPv6 and delegates a /56 prefix, so devices can have public IPv6 addresses that bypass the CGNAT path. It works only when the person connecting also has IPv6, and inbound traffic still needs a firewall rule. The Starlink router cannot create those rules, so use your own router in bypass mode and allow the port to one device’s IPv6 address.
Treat IPv6 as a bonus. If you host a game and one friend has an ISP without IPv6, that friend cannot join, which is why public IPv4 or a VPN is a safer main plan.
Common ports and how to reach them
| Service | Default port | Protocol | Best way behind CGNAT |
|---|---|---|---|
| Minecraft Java server | 25565 | TCP | Public IPv4, VPN forwarding or a game tunnel |
| Minecraft Bedrock server | 19132 | UDP | Public IPv4 or VPN forwarding |
| Terraria server | 7777 | TCP | Public IPv4, VPN forwarding or a game tunnel |
| Palworld server | 8211 | UDP | Public IPv4 or VPN forwarding |
| Valheim server | 2456 to 2458 | UDP | Public IPv4 or VPN forwarding |
| Plex | 32400 | TCP | Mesh VPN or public IPv4 |
| Jellyfin | 8096 | TCP | Mesh VPN or public IPv4 behind HTTPS |
| Home Assistant | 8123 | TCP | Mesh VPN or its cloud service |
| WireGuard | 51820 | UDP | Public IPv4, or a VPS as the meeting point |
| SSH and remote desktop | 22 and 3389 | TCP | Mesh VPN only, never forward them |
Security before you open anything
| Risk | What to do |
|---|---|
| Admin pages exposed to the internet | Keep NAS, router and camera admin pages behind a mesh VPN |
| Weak or default passwords | Change them and use unique passwords for every service |
| Unencrypted web access | Put services behind HTTPS with a reverse proxy |
| Outdated software | Update servers, firmware and containers on a schedule |
| Too many open ports | Forward only the ports you need, to one device each |
| Home network exposure | Put the server on a separate guest or VLAN network if your router supports it |
Port still closed? Troubleshooting
| Problem | Likely cause | Fix |
|---|---|---|
| WAN address still starts with 100.64 | The public IP option is off or has not applied | Check the IP policy in your account, then reboot the dish and router |
| Two routers and a double NAT warning | Bypass mode is off | Enable bypass mode in the Starlink app |
| Port test says closed | The test ran from inside your network | Test from mobile data |
| Works for a few days, then fails | The public address changed | Use dynamic DNS |
| Players connect but disconnect | TCP and UDP mismatch | Forward the right protocol, or both if the game needs both |
| Forwarding is set but the service is unreachable | The host firewall blocks it | Allow the port on the server’s own firewall |
| Lag with a VPN forward | Satellite latency plus a distant VPN server | Choose a closer server, or use a public IPv4 plan |
FAQ
Does Starlink use CGNAT?
Yes. Starlink’s default IPv4 policy is CGNAT, which does not allow inbound traffic. Addresses come from the 100.64.0.0 to 100.127.255.255 range.
Can I port forward on Starlink?
Not on the Starlink router. You can on a plan with the public IPv4 option, using your own router in bypass mode. Otherwise use a VPN with port forwarding, a mesh VPN, a tunnel or a VPS.
Which Starlink plans offer a public IP address?
Local Priority and Global Priority. You enable it in your account dashboard by setting the IP policy to Public IP. Residential and Roam plans use CGNAT.
Can I get a static IP address with Starlink?
No. Starlink does not offer static IP addresses. The public IPv4 option gives a reachable address that can change, so pair it with dynamic DNS.
Does Starlink bypass mode fix CGNAT?
No. Bypass mode turns off the Starlink router so your own router handles the network. Your router can then forward ports, but the address is still CGNAT unless your plan has the public IPv4 option.
Can I use a third-party router with Starlink?
Yes. Enable bypass mode and connect the router to the Starlink router’s Ethernet port. Gen 2 systems need the Starlink Ethernet adapter, and Gen 3 has Ethernet ports built in.
Is IPv6 enough to host a game on Starlink?
Only if every player has IPv6, and you open the port in a firewall you control. Many players do not have IPv6, so a public IPv4 address or a VPN is more reliable.
What is the best way to host Minecraft on Starlink?
A Priority plan with public IPv4 and your own router gives the best connection. A game tunnel service or a VPN with port forwarding is cheaper but adds latency.
How do I access Plex or Jellyfin on Starlink from outside?
Use a mesh VPN such as Tailscale on the server and your devices, or use public IPv4 with forwarding. Check Cloudflare’s current terms before sending video through a Cloudflare tunnel.
Is it safe to open ports on Starlink?
It is safe only with care. Forward only the ports you need, use strong passwords and HTTPS, keep software updated, and never expose admin pages, SSH or remote desktop. A mesh VPN avoids open ports entirely.
Does VPN port forwarding add latency on Starlink?
Yes. Your traffic crosses the satellite link and then the VPN server. Pick a server close to the people connecting, or choose public IPv4 for latency-sensitive games.











