Guide: Starlink Port Forwarding and Workarounds

Port forwarding is a router setting that allows internet traffic to be sent directly to a device on your local network. For example, if you want to set up your own Minecraft server, you would need to open up port 25565, then forward traffic from that port to your Minecraft server IP address.

There are two main challenges to port forwarding with Starlink satellite internet. First, Starlink routers don’t support port forwarding configurations, so you will need to purchase a 3rd party router. Second, Starlink uses CGNAT to hand out IP addresses on most service plans, which aren’t publicly accessible and change often.

To access devices on your Starlink network you will need to use one of the workarounds in this guide.

How to Get a Public IPv4 from Starlink

Before I jump too into all the port forwarding workarounds, there is one way to get true IPv4 port forwarding using Starlink internet. You will need a 3rd party router (see my recommendations) because the Starlink provided router doesn’t have port forwarding settings. You will also need to change your service plan to the more expensive Priority plan.

Starlink’s Priority service plan is meant for business customers, but you can switch to it from Residential using your existing equipment. It starts at $140/month and includes 50GB of Priority data, then unlimited Residential data after that. Essentially you are paying an extra $20/month just to get one Priority feature, a public IPv4 address.

After switching to Priority, go into your Starlink business dashboard. You need to turn on the public IP setting to get assigned an IPv4 address. Once you have it, you can set up port forwarding on your 3rd party router.

One big downside to the public IPv4 address from Starlink Priority is that it isn’t truly static. It can change from time to time, which means you would have to reconfigure your port forwarding settings. Based on reports I see online, the Priority public IPv4 address doesn’t change that often, with some people using the same address for more than a year.

Tailscale Workaround

Tailscale is a free service that lets you create your own private network across different networks. It’s a mesh VPN using the open source WireGuard protocol. Tailscale is a bit different from a normal VPN because traffic is routed peer-to-peer instead of through a central VPN server.

You install Tailscale on all the devices you want to be included in your private network. Once Tailscale is up and running, it’s basically like all the authenticated devices are on the same home network, even if one of the devices is in another country using a different internet connection.

That means you can securely connect with all of your devices, even away from home through another internet connection. Tailscale is a great option for accessing security cameras, a Plex server, NAS, etc. Since everything is routed through Tailscale, you don’t need a 3rd party router or public IP address from Starlink.

There are other services out there similar to what Tailscale offers. For example, you can use a Cloudflare Tunnel to create a secure connection between two different networks.

IPv6 Workaround

Since Starlink uses CGNAT to assign you an IPv4 address, it is dynamic, and can change from time to time. This makes port forwarding a challenge. You can’t set up port forwarding when your IP address changes often.

Thankfully, Starlink also supports IPv6 addresses. Unlike IPv4, there are plenty of IPv6 addresses to go around. Starlink is able to assign each device on your network a public IPv6 address, completely eliminating the need for port forwarding. But IPv6 only solves one problem.

Even if you are assigned a public IPv6 address from Starlink, the default router blocks all outside traffic with a firewall. The Starlink router doesn’t allow for custom firewall rules to open up access to specific devices. Luckily, you can simply bypass the Starlink router and use a 3rd party router that has more firewall options.

Once you have a 3rd party router that supports IPv6 and custom firewall rules, all you need to do is create a rule for the device you want to allow outside access to. You will provide the global IPv6 address of your local device, and specify what kinds of connections to allow from the outside.

The downside to IPv6 is that some ISP’s and devices don’t support it yet, so not all outside devices will be able to connect to your local network using the IPv6 address.

VPN Workaround

Depending on what you are trying to accomplish by port forwarding, another workaround is to use a VPN service. The idea here is to install a VPN client on your devices, and then set up the forwarding in the VPN settings. Your VPN provider will issue you a static IP address that you can use for outside connections.

Using a VPN has some downsides. First, some additional latency is involved. Traffic has to be routed from the device to the VPN server, and then back to your local Starlink network. This isn’t ideal for all situations, such as hosting a game server. Second, some VPN providers limit bandwidth, limit open ports, or randomly assign ports.

The VPN service that I use is Private Internet Access (PIA), which supports forwarding one random port for all subscription tiers, on VPN servers around the world. With PIA you can forward traffic going to the VPN server IP address directly to your local network device using the assigned port number, even with the Starlink’s default router and CGNAT IP addresses.

I recommend reading through PIA’s port forwarding tutorial to learn more about this option.

Summary

Starlink uses CGNAT, which makes port forwarding difficult. The best option is to upgrade to the Priority service plan to gain access to a public IP address. Using a 3rd party router, you can then forward incoming traffic from that IP address to a local network device through an open port.

Depending on what you are trying to do, there are several workarounds to port forwarding with Starlink. Using a traditional VPN service or Tailscale allows you to build your own private network across different networks, which is suitable for remote access to various services.