Relayant and port forwarding

Port forwarding is the oldest way to reach a camera from outside. On a fixed line with a public address it still works. Here is where it stops working, and when to keep using it.

What it is good at

Port forwarding costs nothing and puts no one in the middle

A forwarding rule on the site's router sends one outside port to one device inside. There is nothing to buy and no third party in the path.

On a fibre or DSL line with a public address, it works. Someone who knows the router can set it up in minutes.

Dynamic DNS adds a name that follows the router's public address when the internet provider changes it. It has free and paid tiers.

Where it falls short

Behind CGNAT a forwarding rule does nothing

Each of these is a fact about the mechanism, not a complaint about a product.

Why nothing needs to be forwarded in First, devices at a site behind carrier-grade NAT with no box: the control room's packets reach the carrier's shared address and are dropped. Then a Relayant box is added at the site beside the devices. It dials out through the same address, a tunnel opens to the cloud relay, and traffic flows in both directions. Site Carrier NAT shared public address Camera Recorder Controller Control room Controlroom Nothing gets in no box yet Cloud relay Cloudrelay Relayant box Relayantbox Tunnel opened from the site box added
Behind carrier-grade NAT the site has no public address of its own, so a packet sent in from outside is stopped at the carrier. Add a box at the site and it opens the connection outward, and traffic then flows both ways.
Mobile and satellite sites have no address to forward to
4G, 5G and Starlink sites are almost always behind CGNAT. CGNAT is carrier-grade NAT: the site shares a public address with many others, so nothing can be forwarded to it. The router has no public address of its own, so a rule does nothing. Dynamic DNS has no address of the site's own to point at.
The device's own login page goes on the internet
A forwarded port answers anyone who finds it. What they reach is the device's login page, with whatever password it has.
Every change needs the router, and usually a visit
A new camera, a changed address or a new control room address means a new rule. That needs router access, and often someone at the site.
Nothing tells you when a camera stops answering
A forwarding rule only carries traffic. Our box also checks that each device answers, every minute, and tells you when one stops.

Side by side

Eight things a control room asks, answered for both

Relayant and a port forward with dynamic DNS. The port-forwarding column is from No-IP's post of 6 May 2026, read on 13 October 2026, and from the mechanism itself.
The question Relayant Port forwarding and dynamic DNS
Behind CGNAT, on 4G, 5G or Starlink Works. The box connects out over an encrypted tunnel, so nothing is forwarded. Does nothing. Behind CGNAT the router has no public address to forward to.blog.noip.com, 13 October 2026
When the site's public address changes Each device keeps one address and port on Relayant. The tunnel follows the new address by itself. Dynamic DNS keeps a name pointed at the router's public address. Behind CGNAT there is no address of the site's own to point at.blog.noip.com, 13 October 2026
Changes at the site's router None. The box plugs into a LAN port and takes an address by DHCP. A rule per device, which needs router access and usually a site visit.The mechanism; nothing to cite
Who can reach a device Only the internet addresses you list. Anyone who finds the port reaches the device's own login page.The mechanism; nothing to cite
Knowing when a device stops answering The box checks every device every minute and reports when one stops answering. A forwarding rule carries traffic and checks nothing.The mechanism; nothing to cite
What it costs Priced per box at a live site. Nothing beyond the router. Dynamic DNS has free and paid tiers.A router feature; nothing to cite
Telling whether a site is behind CGNAT A router WAN address in 100.64.0.0/10 means CGNAT. Nothing needs doing: the box connects out anyway. Compare the router's WAN address with the address an outside site shows for you. If they differ, the site is probably behind CGNAT.blog.noip.com, 13 October 2026
What a dynamic DNS provider advises behind CGNAT Our box also uses an outbound tunnel to a relay. No-IP points customers behind CGNAT to an outbound tunnel to a managed relay instead.blog.noip.com, 13 October 2026

A tick or a cross says whether the question is answered well for a control room. Where a row has no tick or cross, the answer is a plain fact and the reader can weigh it.

When to choose it anyway

A fixed line, a public address and one or two devices

Choose a port forward when the site has a fixed line with a public address: fibre, DSL, or a plan that includes one. There are one or two devices, and someone who maintains the router is reachable. The device will sit behind a VPN or a strict source-address rule, not on the open internet. If the address never changes and nobody needs to know when a camera stops answering, a forward is the least to set up. There is nothing to pay.

Our box earns its place when the site is behind CGNAT, when addresses change, or when there are many sites. It earns it again when someone must be told that a device has gone quiet.

Tell us how your sites connect

Say how many sites you look after, how they reach the internet and what monitoring software you use. We reply by email.

Email [email protected] Sign in

Checked against No-IP's published information on 13 October 2026. Tell us if something has changed: [email protected].

Product names belong to their owners.