CCTV on 4G: why remote access is hard, and what works
Why a 4G site is hard to reach from outside, what to check in its setup, and how a box that dials out gets round it.
CCTV on 4G works, but a 4G SIM is almost always behind CGNAT, so nothing from outside can be forwarded to the cameras. Remote access needs something at the site that connects outward, such as the camera maker's app, a VPN computer or a box that dials out.
This page explains why, what to look for in a site's 4G setup, and how a box at the site gets round it. For the full installation steps, power sizing and antennas, see Remote sites on Starlink and 4G.
A 4G SIM sits behind CGNAT
CGNAT is carrier-grade NAT: the site shares a public address with many other customers, so nothing can be forwarded to it. 4G and 5G connections are almost always behind it.
The exceptions are paid ones: a private APN or a static-address plan from the mobile provider. Without one, the SIM has no public address of its own. In Australia, for example, Optus 4G Home and 5G Home use CGNAT with no opt-out (Reviews.org, 17 October 2024, read 16 October 2026).
To confirm it, look at the 4G router's WAN or mobile address. An address from 100.64.0.0 to 100.127.255.255, or a private address, means CGNAT. At a 4G site that is expected.
What that means for remote access
Every method that waits for a connection from outside fails on a normal 4G SIM:
- Port forwarding has no public address to forward from.
- Dynamic DNS has no address of the site's own to point at.
- A VPN server on the 4G router cannot be reached, for the same reason.
Methods that start the connection from inside the site still work. The camera maker's app reaches the maker's own devices through its cloud. A mesh VPN on a computer at the site that stays on reaches the devices behind it. remote.it also works through an always-on computer at the site; see our remote.it alternative for camera sites. A box that dials out reaches the devices you choose. How to reach CCTV without a static IP compares them.
4G cameras and 4G routers
There are two common ways to put CCTV on 4G.
A camera with its own SIM. The camera connects straight to the mobile network, behind CGNAT like any SIM. Remote viewing goes through whatever its maker provides. Each camera is its own connection, with its own SIM and its own data.
A 4G router with the cameras on its network. A 4G SIM router for CCTV gives the site one internet connection. The cameras, a recorder and anything else connect to the router's LAN ports, often through a PoE switch.
A box at the site can reach only devices on the site's own network. A camera with its own SIM is not on that network, so the box cannot reach it. For a site you want to reach through a box, put the cameras on a 4G router's network.
What to check in a 4G setup
- Outbound UDP. Our tunnel needs outbound UDP. Some private APNs and business firewalls block it; check before you install.
- Signal. Read the router's signal before mounting and again after. RSRP above −90 dBm is good and below −105 dBm is poor; SINR above 13 dB is good and below 0 dB is poor. Use both MIMO antenna connectors.
- Power. Most remote-site outages are power. Size the battery and solar for the worst week of the year, and fit a low-voltage disconnect.
- Data. Our tunnel and its monitoring traffic currently use a few megabytes a day per site; measure on your first sites. Video is what uses the allowance: one camera's main stream is about 1 to 2 GB an hour. Set apps and monitoring software to the sub-stream, and turn on the router's data-limit alerts.
- A second connection. A dual-WAN router can use Starlink with 4G as backup, or two SIMs. When it switches, the tunnel follows the new address by itself, with a short gap.
- The router itself. A spare LAN port is all a box needs. To run our software agent on a Teltonika router instead, it needs about 9 MB of free flash and 128 MB of RAM. If the router is managed in Teltonika RMS, our Teltonika RMS alternative page shows how the two fit.
Mobile networks carry packets in smaller pieces than fixed broadband. Our tunnel uses a 1320-byte MTU, so its packets are not fragmented on them.
The Starlink and 4G guide has the antenna advice, power sizing steps, data table and a troubleshooting table.
How a box at the site helps
- Plug the Relayant box into a spare LAN port on the 4G router. It takes an address by DHCP; nothing on the router changes.
- The box connects out to Relayant over an encrypted WireGuard tunnel. CGNAT makes no difference to it.
- In the portal, choose which devices your control room needs and which ports. Each gets one address and port on Relayant.
- Only the internet addresses you list can connect. The relay reaches only the device-and-port pairs you chose.
- The box checks each monitored device every minute and reports when one stops answering.
If the 4G drops or the power fails, the box reconnects by itself when the site has internet and power and Relayant is reachable. Nobody needs to visit the router. Starlink and 4G sites has the three ways to put Relayant at a remote site, and Pricing has the plans.
Short answers
Port forwarding does not work on a normal 4G SIM
The SIM is behind CGNAT, so there is no public address to forward from. A paid private APN or static-address plan is the exception.
A static-IP SIM brings back port forwarding, not the rest
With a static address, port forwarding works again. Each forwarded port then answers anyone who finds it, and each change needs the router.
A camera with its own SIM is outside the site network
It connects straight to the mobile network, so remote viewing goes through whatever its maker provides. A box at the site reaches only devices on the router's network.
Video, not the tunnel, uses the data
Our tunnel currently uses a few megabytes a day per site. Viewing a camera's main stream uses about 1 to 2 GB an hour.
Something in this guide is wrong or missing? Tell us: hello@relayant.net.