Port forwarding is the process of taking traffic heading for a public IP address, and redirecting it to another IP address or port. This process happens behind the scenes, and isn’t visible to the user. For that reason, network administrators use port forwarding as a security tool to control outside access to internal networks.
Port forwarding isn’t just useful for businesses. Home users might need it to run a game server, web server, or to access things like security cameras. Starlink doesn’t support port forwarding with the included router, but there are several workarounds. In this article, I will explain a few of the common methods that people use to forward ports using Starlink satellite internet.
Table of Contents
How Starlink Assigns IP Addresses
There are two types of IP address protocols, IPv4 and IPv6. IPv4 is widely used by ISP’s like Starlink, while IPv6 is the newer, less utilized future of IP addressing. The internet has rapidly expanded around the world in the last few decades, and there simply aren’t enough unique IPv4 addresses to go around. As a workaround, ISP’s like Starlink use a system called CGNAT to dynamically assign IPv4 addresses.
Since Starlink uses CGNAT to assign you an IPv4 address, it is dynamic, and can change from time to time. This makes port forwarding a challenge. You can’t set up port forwarding when your IP address changes often.
Starlink also supports IPv6 addresses, but rollout has been slow and inconsistent. Unlike IPv4, there are plenty of IPv6 addresses to go around. Starlink is able to assign each customer a static IPv6 address. With a static IP address, you can set up port forwarding. Unfortunately, even if you are assigned a static IPv6 address from Starlink, the default router that comes with Starlink doesn’t support port forwarding. Luckily, you can simply bypass the Starlink router and use a 3rd party router that supports port forwarding.
IPv6 Method
If you have been assigned an IPV6 address from Starlink, you can use a 3rd party router that supports port forwarding. To check to see if you have an IPv6 address on Starlink, use an online IPv6 checker.
An aftermarket router will be required to take advantage of a static IPv6 address if you are lucky enough to get one from Starlink. You can set up your port forwarding on the 3rd party router, and then use your IPv6 address to access your services from outside the local network.
I have complied a list of the best aftermarket routers for Starlink if you need recommendations. Once an aftermarket router is installed, you’ll need to bypass the Starlink router.
VPN Workaround
Stuck with an CGNAT and IPv4? No problem, there are a couple of workarounds that you can try to use in place of proper port forwarding. The first option is to use a VPN that supports port forwarding. The idea here is to install the VPN client on your devices, and then set up the forwarding in the VPN settings. Your VPN provider will issue you a static IP address that you can use for external connections.
I consider this a workaround because using a VPN can cause some issues. First, some additional latency is involved. Traffic has to be routed from the device, to the VPN server, and then back to your local network. This isn’t ideal for all situations, such as hosting a game server. Second, some VPN providers limit bandwidth, limit open ports, or randomly assign ports.
The VPN service that I recommend is Private Internet Access, which supports forwarding one random port for all subscription tiers, on VPN servers around the world. I provide more recommendations in my article on Starlink and VPN’s.
ngrok Workaround
If you don’t want to rely on a VPN, there is a similar method that you can use to create a secure tunnel from outside devices, to inside your local network. Services like ngrok can be deployed as a workaround for port forwarding with Starlink. The basic process looks like this:
- Install ngrok on your device
- Run the command to start a tunnel and define the port
- Use the provided unique address to access the device from outside the network
I’m not experienced with products like ngrok, but I did find a great tutorial on using ngrok to get around CGNAT issues. There is also this Reddit post that shows how one Starlink customer used ngrok to access a Plex server remotely.
Getting A Static IP With Starlink Business
Finally, one method to consider would be to upgrade to Starlink Business. With the Business plan, you can request a static IPv4 address. Combine the static IP with an aftermarket router to set up port forwarding. This option really only applies to business users, as the cost is significantly higher than the Residential plan.
Hy , I’m totally nerd in config routers and stuff and I’m looking for a simple procedure to access my alarm at home from outside. Before Starlink I could do simply with having an account on no-ip. Com and tracking my ip with that service setting the port forwarding to the router and specifying the ddns provider address to the router. Now, more I read and more I’m confused
Is this possible again only with a 3rd party router? Thank!!
The Starlink router doesn’t have a port forwarding feature, so you would need 3rd party if your security system requires it for access. Your Starlink’s IP is dynamic, so using a VPN or service like no-ip would be necessary for access.
When I used other ISP’s I could port forward my server IP address and add that to my DNS host to get my websites online to the internet. Besides my Starlink router I have a Netgear Nighthawk 7200 router.
How can I get my websites back online now that I am using Starlink?
Of all the things I could recommend in terms of getting your Starlink to do this, hosting your websites with a web hosting service is the cheapest and easiest by far.
I’ve heard that this option can be unsuccessful even with 3rd party routers that support upnp/port forwarding is it guaranteed that this option will work
I can’t guarantee anything because sometimes the software or hardware doesn’t play nice with the various methods here. I suggest trying things until you find something that works with your setup.
Hi, Noah! I JUst installed Starlink at my retirement home which is in a rural part of No. California. There have been some recent breakins in the immediate area and I need to implement some type of “near-real-time” video surveilance. Here is my idea; I have located a cloud based service that allows me to set up a web-folder with a feature that will send me an email os SMS message in near-real-time(probably within 60 seconds of a video file being uploaded successfully) I would set my security cameras to record on a motion trigger event. I would use Starlink to upload the video file through my NVR that would be connected to Starlink. The reason this is tolerable is that I have an alarm system that I self monitor(in my location the local Sheriff Dept. would not be able to respond on-site for 15 to 30 minutes no matter what. IF I can tolerate something like a 5 to 7 minute delay from file upload to cloud to my receipt of an email or SMS text do you see any other downsides related to Starlink or do you have any other possible suggestions?
I don’t see any issues if you aren’t trying to connect directly back to devices on your Starlink network.
You can set up “Tailscale” (www.tailscale.com) for free. Then your Starlink network will VPN into their servers and you can do the same from anywhere… Once both are connected to Tailscale then you can access the remote network like it is your own network… It is the easiest and most secure option that I know of…
One more workaround – Tor. You can easily keep onoin sites and/or remote login to your network. Tor communication uses reverse protocol like ngrok.
Hello,
Very interesting article.
I work at home and moved in remote area. Thus, no internet except via StarLink. My big problem is my server became not accessible from outdoor. I need daily to transfer data from or to my server and the ‘outdoor’ can initiate the transfer when required. I looked for a solution when I found your site about Starlink hardware.
I bought a Starlink Ethernet Adapter and use my old D-Link Dir 825 router with by-pass mode for StarLink device. I get an IPV6 address but port forwarding fails. Thus I have a couple of questions.
My router gets an IPV4 and IPV6 addresses. I can see it on the status page. My first question is my router must be strictly IPV6 to avoid conflict between both protocols ? Then, my second question is there are several options to enable IPV6 (Static IPV6, IPV6 to IPV4 tunnel, …). I selected the ‘auto-detection’ option. But I’m lost a few. Did I do the good config ? I’m fear having to buy a new router. But I’m not sure and I’d prefer to ask advice from you.
Thank you!
You can have both protocols running and be fine. Is there an option for dynamic or DHCP IPV6?
There is well an option “Autoconfiguration (SLAAC/DHCPv6)”. By selecting it my web server is accessible from outdoor now. And I can log by ssh from an other IPV6 capable machine of my network.
I suppose the client machine doesn’t need to be IPV6 capable to access at my web site. But I guess it’s not the case for ssh connection.
Could you please tell me how you managed to connect to your machine via ssh through IPV6? What configurations did you make on your router and on your computer to make this possible? My router is the Huawei Ax3 Pro 6 Plus Wifi. I have been trying for several weeks and I don’t understand how to configure IPv6 on the router.
Could you please tell me how you managed to connect to your machine via SSH using IPv6? What configurations did you make on your router and on your computer to enable this? My router is the Huawei Ax3 Pro 6 Plus WiFi. I’ve been trying for several weeks, and I don’t understand how to configure IPv6 on the router.