--- title: Remote Access That Works Behind NAT, CGNAT, and... description: Field-deployed devices behind NAT, CGNAT, or customer-controlled firewalls break traditional inbound SSH and VPN remote access because IPs are unstable, ports... canonical: https://daily.dev/posts/remote-access-that-works-behind-nat-cgnat-and-uncontrolled-firewalls-xmqe95yfp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Remote Access That Works Behind NAT, CGNAT, and Uncontrolled Firewalls | daily.dev og:description: Field-deployed devices behind NAT, CGNAT, or customer-controlled firewalls break traditional inbound SSH and VPN remote access because IPs are unstable, ports... og:url: https://daily.dev/posts/remote-access-that-works-behind-nat-cgnat-and-uncontrolled-firewalls-xmqe95yfp og:image: https://api.daily.dev/og/posts/XmQe95yFp.png og:image:alt: Remote Access That Works Behind NAT, CGNAT, and Uncontrolled Firewalls og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Remote Access That Works Behind NAT, CGNAT, and Uncontrolled Firewalls **[Teleport](https://daily.dev/sources/teleport)** · 20 min read · 0 upvotes · 0 comments ## Summary Field-deployed devices behind NAT, CGNAT, or customer-controlled firewalls break traditional inbound SSH and VPN remote access because IPs are unstable, ports can't be forwarded, and VPN tunnels drop during transport switches (e.g., cellular to satellite). The recommended fix is a reverse tunnel where the device initiates an outbound connection over port 443 to a proxy, multiplexing SSH, Kubernetes, and database traffic through that single tunnel, and replacing IP-based access control with cryptographic device identity and metadata labels so policy survives network and location changes. Teleport is presented as an implementation of this identity-based, outbound-only access model, using its Agent, Proxy Service, label-based RBAC, and short-lived certificates. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why can't I SSH into a device that's behind carrier-grade NAT (CGNAT)? Inbound SSH fails because CGNAT shares a single public IPv4 address across thousands of subscribers, so the carrier assigns the device a private address and performs translation upstream, which prevents any outside system from initiating a TCP connection to it. Port forwarding is not possible because the fleet operator doesn't control the carrier's NAT device. _Teams debugging unreachable fleet devices can find similar networking breakdowns explained on daily.dev._ ### Why does my VPN tunnel drop when a device switches from cellular to satellite or Wi-Fi to cellular? A VPN tunnel binds to a specific network interface, so when the underlying transport changes, such as a sensor switching from a cellular tower to a satellite terminal, that handoff kills the tunnel and any systems relying on it. Cellular can typically reach public endpoints, but satellite connectivity is often restricted to private addresses, requiring a new tunnel and cluster endpoint entirely. _Engineers troubleshooting flaky remote connectivity can track patterns like this via daily.dev._ ### How does a reverse tunnel let you SSH into a device without opening any inbound ports? A reverse tunnel has the device itself open a persistent outbound TCP connection to a proxy server on port 443, then multiplexes engineer sessions back to the device over that same connection, so the customer's firewall never needs to allow inbound traffic. Because the device never listens on a port, its attack surface is limited to the outbound agent process, and the connection survives network handoffs since the agent simply reconnects on a new interface. _Anyone designing remote access for fleets behind firewalls can dig deeper into these patterns on daily.dev._ ## Similar posts on daily.dev - [My ISP stuck me behind CGNAT, and a free Cloudflare tunnel made my home server reachable again](https://daily.dev/posts/my-isp-stuck-me-behind-cgnat-and-a-free-cloudflare-tunnel-made-my-home-server-reachable-again-k8tt9qe2s) · XDA Developers · 0 upvotes · 0 comments - [Stop opening firewall ports and start using identity](https://daily.dev/posts/stop-opening-firewall-ports-and-start-using-identity-xyrc1lkyd) · All Things Open · 0 upvotes · 0 comments - [Self-Hosting Behind CGNAT](https://daily.dev/posts/self-hosting-behind-cgnat-lrdls1bcr) · Lobsters · 1 upvotes · 0 comments - [I reach every service on my home server from anywhere without opening a single port](https://daily.dev/posts/i-reach-every-service-on-my-home-server-from-anywhere-without-opening-a-single-port-qgiwzdz5k) · XDA Developers · 0 upvotes · 0 comments - [My ISP quietly put me behind CGNAT, and it broke half my home lab before I noticed](https://daily.dev/posts/my-isp-quietly-put-me-behind-cgnat-and-it-broke-half-my-home-lab-before-i-noticed-yzswv0vyk) · XDA Developers · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#vpn](https://daily.dev/tags/vpn), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/remote-access-that-works-behind-nat-cgnat-and-uncontrolled-firewalls-xmqe95yfp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Remote Access That Works Behind NAT, CGNAT, and Uncontrolled Firewalls","url":"https://daily.dev/posts/remote-access-that-works-behind-nat-cgnat-and-uncontrolled-firewalls-xmqe95yfp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/remote-access-that-works-behind-nat-cgnat-and-uncontrolled-firewalls-xmqe95yfp"},"datePublished":"2026-08-23T12:21:53.879Z","dateModified":"2026-08-23T12:42:41.615Z","description":"Field-deployed devices behind NAT, CGNAT, or customer-controlled firewalls break traditional inbound SSH and VPN remote access because IPs are unstable, ports...","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/remote-access-that-works-behind-nat-cgnat-and-uncontrolled-firewalls-xmqe95yfp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,vpn,ssh","timeRequired":"PT20M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Remote Access That Works Behind NAT, CGNAT, and Uncontrolled Firewalls"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/remote-access-that-works-behind-nat-cgnat-and-uncontrolled-firewalls-xmqe95yfp#faq","mainEntity":[{"@type":"Question","name":"Why can't I SSH into a device that's behind carrier-grade NAT (CGNAT)?","acceptedAnswer":{"@type":"Answer","text":"Inbound SSH fails because CGNAT shares a single public IPv4 address across thousands of subscribers, so the carrier assigns the device a private address and performs translation upstream, which prevents any outside system from initiating a TCP connection to it. Port forwarding is not possible because the fleet operator doesn't control the carrier's NAT device. Teams debugging unreachable fleet devices can find similar networking breakdowns explained on daily.dev."}},{"@type":"Question","name":"Why does my VPN tunnel drop when a device switches from cellular to satellite or Wi-Fi to cellular?","acceptedAnswer":{"@type":"Answer","text":"A VPN tunnel binds to a specific network interface, so when the underlying transport changes, such as a sensor switching from a cellular tower to a satellite terminal, that handoff kills the tunnel and any systems relying on it. Cellular can typically reach public endpoints, but satellite connectivity is often restricted to private addresses, requiring a new tunnel and cluster endpoint entirely. Engineers troubleshooting flaky remote connectivity can track patterns like this via daily.dev."}},{"@type":"Question","name":"How does a reverse tunnel let you SSH into a device without opening any inbound ports?","acceptedAnswer":{"@type":"Answer","text":"A reverse tunnel has the device itself open a persistent outbound TCP connection to a proxy server on port 443, then multiplexes engineer sessions back to the device over that same connection, so the customer's firewall never needs to allow inbound traffic. Because the device never listens on a port, its attack surface is limited to the outbound agent process, and the connection survives network handoffs since the agent simply reconnects on a new interface. Anyone designing remote access for fleets behind firewalls can dig deeper into these patterns on daily.dev."}}]} ```