# Advanced networking

> CGNAT session limits, VPN compatibility by protocol, MTU, subnets and the PoP you cannot choose.

Source: https://joinnasnet.com/en/guides/starlink/advanced-networking/
Last updated: 2026-08-18

---

## Overview

Almost everything on this page traces back to the same root cause: Residential
and Roam plans sit behind carrier-grade NAT, and CGNAT breaks specific things
in specific ways.

## CGNAT session limits

Residential and Roam plans allow **1,200 concurrent sessions**, where a session
is one TCP or UDP connection.

**When you hit 1,200, new sessions push out the oldest ones.** Connections are
terminated without warning, which is why the symptoms look random.

### Symptoms

- VoIP calls dropping or failing to connect
- One-way audio on phone or video calls
- Video meetings freezing, dropping, or failing to join
- Unreliable performance with several devices or applications at once
- Trouble with gaming, VPNs and other connection-sensitive services

Modern real-time communication tools open a lot of sessions, so a household
running several at once reaches the limit more easily than the number suggests.

### The fix

There is no way to raise the limit. A **Priority plan** removes it and includes
a public IP address. If your household leans on VoIP or video conferencing
daily, that is the answer.

## VPNs

Starlink supports VPNs over TCP or UDP. **SSL-based VPNs traverse CGNAT best**,
and NAT traversal support is required either way.

### Client-to-site

| Generally works over CGNAT | Generally does not |
| -------------------------- | ------------------ |
| SSTP (SSL/TLS/DTLS) | PPTP |
| OpenVPN | L2TP |
| WireGuard | |

### Site-to-site

| Generally works over CGNAT | Generally does not |
| -------------------------- | ------------------ |
| MPLS | GRE |
| IKEv2/IPsec | IPsec without NAT-T |
| OpenVPN | L2TP |

Enterprise site-to-site VPN and SD-WAN appliances work under the same rule: NAT
traversal over TCP or UDP is required. **Protocols 47 (GRE), 50 (ESP),
51 (AH) and 115 (L2TP) are dropped by CGNAT.**

If your VPN is incompatible, a public IP may help, though that needs a Priority
plan and still guarantees nothing, because VPN configurations vary too much.

Two practical notes: a VPN adds encryption and extra hops, so it costs you
latency and throughput; and **the Starlink app may not work properly while a
VPN is active**. Starlink does not troubleshoot VPN problems, so start with
your VPN provider.

## MTU

Standard **1500 bytes** for internet access.

## Change the router subnet

1. Open the app and go to **Network → gear icon**, top right.
2. Select the network your Starlink is connected to.
3. Under **Subnet**, choose from the dropdown.
4. Save.

## Point of Presence

**You cannot request a different PoP or satellite downlink location.** The
network is dynamic and routes traffic through whatever path is best at the
time.

If you see a **POP CHANGE** alert, a reboot of the Starlink or your third-party
equipment usually restores things, since the region's IP assignment changed.
See [App alerts](/en/guides/starlink/alerts/).

## Monitoring performance

**Starlink app → Statistics** shows speed, uptime, latency, outages and alerts
while you are connected to the Starlink router.

Business and managed business accounts get more through the dashboard.

## Related

- [Networking](/en/guides/starlink/router-config/networking/)
- [Third-party devices](/en/guides/starlink/third-party-devices/)
- [Slow speeds](/en/guides/starlink/slow-speeds/)