CGNAT and security cameras in Australia and New Zealand
What CGNAT is, how to tell if a site is behind it, which providers use it, and the ways round it.
CGNAT (carrier-grade NAT) means a site shares one public internet address with many other customers, so nothing from outside can be forwarded to a camera or recorder there. Many Australian and New Zealand broadband providers turn it on by default, and 4G, 5G and Starlink connections are almost always behind it.
There are several ways round it: ask the provider to take the site off CGNAT, buy a static IP, use the camera maker's app, run a VPN, or put a box at the site that dials out. This guide explains each and compares them.
What CGNAT is
A home or business router normally has one public address. Port forwarding uses it: the router sends traffic for one outside port to one camera or recorder inside.
Public IPv4 addresses are scarce, so many providers now share one public address between many customers. The sharing happens in the provider's network, not in your router. That is carrier-grade NAT.
Behind CGNAT, the router has no public address of its own. A port forwarding rule on it does nothing, because traffic from outside never reaches it. Dynamic DNS has no address of the site's own to point at.
Providers say so themselves. Aussie Broadband lists security cameras and systems among the things CGNAT can stop working. 2degrees lists IP and security cameras among the devices affected. Both pages were read on 16 October 2026.
Outbound connections still work behind CGNAT. Browsing, email and a camera uploading to its maker's cloud all start from inside the site. Only connections that start outside are stopped.
How to tell if a site is on CGNAT
- Open the site router's status page and note its WAN address, sometimes called the internet or external address.
- From a computer at the site, open any "what is my IP" website and note the address it shows.
- Compare the two.
If the two addresses match, the site has its own public address. If they differ, the site is probably behind CGNAT.
The WAN address itself is often enough. An address from 100.64.0.0 to 100.127.255.255 (the range 100.64.0.0/10, set aside for CGNAT) means CGNAT. A private address, such as 10.x.x.x or 192.168.x.x, on the WAN side means another router or the provider is in front of yours.
Australian providers
What each provider does on NBN home plans, from WhistleOut's guide, which it last updated on 12 October 2026. Mobile and fixed-wireless home plans are separate rows.
| What the provider does | Providers | For cameras at the site |
|---|---|---|
| CGNAT on by default, opt-out available | AGL, Aussie Broadband, Dodo, Exetel (One plan), iPrimus, Moose, More, Southern Phone, Superloop, Swoop, Tangerine; SpinTel charges $2 a month to move to a public address | Ask the provider to take the service off CGNAT, or buy a static IP. Aussie Broadband asks for a reason, and its support team decides. |
| CGNAT, no opt-out reported | Belong, Flip, Kogan, Mate, Origin, Vodafone | A static IP where the provider sells one, or IPv6, or a method that dials out from the site. |
| No CGNAT on NBN plans | amaysim, iiNet, Optus (NBN), TPG | Port forwarding can work, if you can change the router. |
| Sources disagree | Telstra | WhistleOut says Telstra customers need not worry about CGNAT, because Telstra offers IPv6; Reviews.org lists Telstra with CGNAT and an opt-out. Check with Telstra. |
| CGNAT, no opt-out | Optus 4G Home and 5G Home; Starlink | A method that dials out from the site. |
Sources: WhistleOut, "What is CGNAT and how to opt out" (updated 12 October 2026) and, for Optus 4G and 5G Home, Starlink and Telstra, Reviews.org, "CGNAT explained" (17 October 2024). Both read 16 October 2026.
The two sources differ on more than Telstra. Reviews.org puts More among providers without CGNAT, Origin among those with an opt-out, and SpinTel's fee at $5 a month. Providers change these settings, so ask yours before you plan a site around them.
New Zealand providers
| Connection | What is published | For cameras at the site |
|---|---|---|
| 2degrees home broadband | Customers on a dynamic address are put on CGNAT; IP and security cameras are listed as affected. A static IP is NZ$10 a month on home plans. | Buy the static IP, or use a method that dials out from the site. |
| Starlink | Almost always CGNAT. | A method that dials out from the site. |
| 4G and 5G | Almost always CGNAT, unless a paid private APN or static-address plan. | A method that dials out from the site. |
| Other providers | Ask the provider, or check the router as above. | Depends on the answer. |
Source for the 2degrees row: 2degrees, "2degrees IP addresses", read 16 October 2026.
The ways round it
Ask the provider to opt out, or buy a static IP
Many providers take a service off CGNAT on request, and most sell a static IP for a monthly fee. The site then has a public address of its own again. This works only on fixed broadband: a normal 4G, 5G or Starlink plan has no public address to give.
Then forward the ports
A public address on its own reaches nothing. Someone still has to add a forwarding rule on the router for each camera or recorder. That needs router access, usually a site visit, and a new rule whenever a device changes. A forwarded port answers anyone who finds it, so the device's own login page is on the internet.
Use the camera maker's P2P cloud
Camera and recorder makers have their own apps and clouds for their own devices. The recorder is registered with the maker's cloud, and you reach it through the maker's app or portal. A control room's monitoring software, which connects by address and port, does not use that route.
Run a VPN on a computer at the site
Mesh VPNs such as Tailscale and ZeroTier cannot be installed on a camera or recorder. Instead, a computer at the site runs the VPN and passes traffic to the devices on its network: a subnet router (Tailscale) or a bridge (ZeroTier). It connects out, so CGNAT does not stop it. The computer has to stay on, and someone has to look after it.
Put a box at the site that dials out
This is what we do. A Relayant box plugs into a spare LAN port on the site's router and connects out over an encrypted WireGuard tunnel. Nothing is opened or forwarded on the router, so CGNAT makes no difference to it.
The options side by side
| Option | Cost | Effort | What it does not cover | Security |
|---|---|---|---|---|
| Opt out of CGNAT, then port forwarding | Often free to opt out; some providers charge (SpinTel $2 a month) | A call to the provider, then a router rule per device | Providers with no opt-out; 4G, 5G and Starlink | Each forwarded port answers anyone who finds it |
| Static IP, then port forwarding | A monthly fee to the provider (2degrees NZ$10 a month on home plans) | An order with the provider, then a router rule per device | Plans and providers that do not sell one | Each forwarded port answers anyone who finds it |
| The maker's P2P cloud | Set by the maker | The maker's app or portal, per device | Other makers' devices; monitoring software that connects by address and port | The connection goes through the maker's service |
| A VPN on a computer at the site | Free tiers for non-commercial use; paid tiers per user or per device | A computer at the site that stays on, set up and kept updated; the VPN on each control room PC | Sites with nowhere to run the computer | Only the VPN's members get in; with a Tailscale subnet router they reach every address on the site's subnet |
| A Relayant box | Priced per box per month | Plug it into a LAN port; choose devices in the portal | Networks that block outbound UDP; one more device to power, about 3 to 5 W | Only the device-and-port pairs you chose, from the addresses you allow |
The VPN row's tiers are from Tailscale's and ZeroTier's pricing pages, read 13 October 2026. The comparison pages go further, product by product: port forwarding, Tailscale and ZeroTier and camera makers' P2P clouds.
How it works with Relayant
- Plug the box into a spare LAN port on the site's router. It takes an address by DHCP; nothing on the router changes.
- The box connects out to Relayant over an encrypted WireGuard tunnel. It needs only outbound internet, so CGNAT, fibre, 4G, 5G and Starlink all work.
- The box finds the devices on the site's network. In the portal you choose which ones your control room needs, and which ports.
- Each device you choose gets one address and port on Relayant. It stays the same when the device changes address at the site.
- Only the internet addresses you list can reach it.
A router WAN address in 100.64.0.0/10 is expected and needs no action. The box relays video encrypted; we do not store it.
How Relayant works has the whole mechanism. Starlink and 4G sites covers sites with no fixed line, and Pricing has the plans.
Short answers
A site on CGNAT cannot take a port forward
Traffic from outside stops at the provider, before it reaches the site's router. A rule on the router has nothing to forward.
A WAN address starting 100.64 to 100.127 means CGNAT
That range is set aside for carrier-grade NAT. Compare it with what a "what is my IP" website shows: if they differ, the site is behind CGNAT.
Opting out is free at many providers, not all
Several Australian NBN providers opt a service out on request; some charge, and some offer no opt-out. Check with the provider, and see the tables above.
A static IP is not the only way in
A static IP brings back port forwarding, with its router work and open ports. A method that dials out from the site needs no public address at all.
Starlink and 4G need a method that dials out
Normal Starlink and mobile plans almost always use CGNAT. A box or VPN computer at the site that connects out works on them.
Something in this guide is wrong or missing? Tell us: hello@relayant.net.