Advanced networking

CGNAT session limits, VPN compatibility by protocol, MTU, subnets and the PoP you cannot choose.

Last updated Aug 18, 2026View as Markdown

Overview

Almost everything on this page traces back to the same root cause: Residential and Roam plans sit behind carrier-grade NAT, and CGNAT breaks specific things in specific ways.

CGNAT session limits

Residential and Roam plans allow 1,200 concurrent sessions, where a session is one TCP or UDP connection.

When you hit 1,200, new sessions push out the oldest ones. Connections are terminated without warning, which is why the symptoms look random.

Symptoms

  • VoIP calls dropping or failing to connect
  • One-way audio on phone or video calls
  • Video meetings freezing, dropping, or failing to join
  • Unreliable performance with several devices or applications at once
  • Trouble with gaming, VPNs and other connection-sensitive services

Modern real-time communication tools open a lot of sessions, so a household running several at once reaches the limit more easily than the number suggests.

The fix

There is no way to raise the limit. A Priority plan removes it and includes a public IP address. If your household leans on VoIP or video conferencing daily, that is the answer.

VPNs

Starlink supports VPNs over TCP or UDP. SSL-based VPNs traverse CGNAT best, and NAT traversal support is required either way.

Client-to-site

Generally works over CGNAT Generally does not
SSTP (SSL/TLS/DTLS) PPTP
OpenVPN L2TP
WireGuard

Site-to-site

Generally works over CGNAT Generally does not
MPLS GRE
IKEv2/IPsec IPsec without NAT-T
OpenVPN L2TP

Enterprise site-to-site VPN and SD-WAN appliances work under the same rule: NAT traversal over TCP or UDP is required. Protocols 47 (GRE), 50 (ESP), 51 (AH) and 115 (L2TP) are dropped by CGNAT.

If your VPN is incompatible, a public IP may help, though that needs a Priority plan and still guarantees nothing, because VPN configurations vary too much.

Two practical notes: a VPN adds encryption and extra hops, so it costs you latency and throughput; and the Starlink app may not work properly while a VPN is active. Starlink does not troubleshoot VPN problems, so start with your VPN provider.

MTU

Standard 1500 bytes for internet access.

Change the router subnet

  1. Open the app and go to Network → gear icon, top right.
  2. Select the network your Starlink is connected to.
  3. Under Subnet, choose from the dropdown.
  4. Save.

Point of Presence

You cannot request a different PoP or satellite downlink location. The network is dynamic and routes traffic through whatever path is best at the time.

If you see a POP CHANGE alert, a reboot of the Starlink or your third-party equipment usually restores things, since the region’s IP assignment changed. See App alerts.

Monitoring performance

Starlink app → Statistics shows speed, uptime, latency, outages and alerts while you are connected to the Starlink router.

Business and managed business accounts get more through the dashboard.