# Networking

> CGNAT and public IPs, why port forwarding does not work, blocked ports, LAN ports and network modes.

Source: https://joinnasnet.com/en/guides/starlink/router-config/networking/
Last updated: 2026-08-18

---

## Overview

The single most consequential fact about Starlink networking: **the default
IPv4 policy is CGNAT, and CGNAT does not accept inbound traffic.** Almost every
"I cannot host anything" question traces back to that.

## IP addressing

Starlink offers two IPv4 policies.

**Default (CGNAT).** Clients get a private address from `100.64.0.0/10` by
DHCP, and NAT translates between that and Starlink's public addresses. Inbound
traffic is not possible.

**Public.** An optional configuration for Local and Global Priority plans. The
address is reachable from anywhere on the internet and assigned by DHCP.

**IPv6 is native** on every router, kit version and service plan. Every
IPv6-capable client gets an address.

Each Starlink is allocated:

| Allocation | Delivered by |
| ---------- | ------------ |
| One public IPv4 address for the WAN | DHCP |
| One IPv6 /64 prefix for the WAN | SLAAC |
| One IPv6 /56 prefix for the LAN | DHCPv6-PD |

Truly static IPs do not exist. A reservation system keeps your public IPv4 and
IPv6 prefix across reboots and power-offs, but **moving the dish or a software
update can change them**.

Local Priority customers can see their public IP on the service line page at
starlink.com, at the top of the Devices section above the graphs.

### Switch to a public IP

Local and Global Priority plans only.

1. Sign in at [starlink.com/account](https://www.starlink.com/account).
2. Open the **Account** tab.
3. Choose **Subscriptions** on the left.
4. Select the service line.
5. Click **Edit** next to **IP Policy**.
6. Choose **Public IP** and save.
7. **Reboot your Starlink.**

On a business account the same setting is reachable from **Dashboard → Service
Line → your Starlink → IP Policy**.

Customers in Austria who cannot complete this automatically should open a
support ticket.

### Addresses that mean something is wrong

| Address | What it means |
| ------- | ------------- |
| `206.214.239.194` | Not connected to the Point of Presence, so no allocated IP yet. Expected while offline |
| DNS `34.145.127.1` | Still connecting. Switches to the real servers, usually `8.8.8.8` and `1.1.1.1`, once connectivity is confirmed |

**Six IP addresses at once** is normal for about 10 minutes. Your cell is being
rehomed to a different Point of Presence for lower latency, so you hold
allocations from both while the terminal decides when to switch.

## Port forwarding

**The Starlink router does not support port forwarding**, and it does not
support firewall rules, for IPv4 or IPv6.

To forward ports you need both:

1. A third-party router that supports it. See
   [Third-party devices](/en/guides/starlink/third-party-devices/).
2. A public IP on your service, which means a Priority plan.

## Blocked ports

| IP version | Protocol | Port | Direction | Common use |
| ---------- | -------- | ---- | --------- | ---------- |
| IPv4, IPv6 | TCP, UDP | 0 | Both | Reserved |
| IPv4, IPv6 | UDP | 17 | Inbound | QOTD |
| IPv4, IPv6 | UDP | 19 | Inbound | CHARGEN |
| IPv4, IPv6 | TCP, UDP | 25 | Outbound | SMTP |
| IPv4 | UDP | 67 | Both | DHCP |
| IPv4, IPv6 | TCP, UDP | 135 to 139 | Both | NetBIOS |
| IPv4 | TCP | 445 | Outbound | SMB |
| IPv4 | UDP | 520 | Inbound | RIP |
| IPv6 | UDP | 546 to 547 | Both | DHCPv6 |
| IPv4, IPv6 | UDP | 1900 | Inbound | SSDP |
| IPv4, IPv6 | UDP | 11211 | Inbound | Memcached |

Outbound TCP/25 and TCP/445 are blocked for everyone as a security measure.

**Indonesia** additionally blocks TCP/465 by regulation. This breaks Apple Mail
on iOS with default settings; set the mail client to port 587 instead.

## Ethernet LAN ports

**Router Mini.** One latching ethernet LAN port. Use it for wired devices, or
for wired mesh, in which case the cable goes to the **WAN** port marked with
the Starlink symbol on the node. Cat5e or better.

**Router 3.** Two LAN ports under the rubber cover on the back, marked with the
LAN icon. Use them for wired mesh or for TVs, computers and other devices. An
ethernet switch gets you more.

![Router 3 RJ45 ports](/guides/starlink/Gen_3_RJ45_Ports.png)

**Starlink Mini.** The router is inside the dish. For better coverage, add
Starlink routers as wired or wireless mesh nodes rather than looking for more
ports.

## Network modes

Every router needs at least one network in **Default** mode. Beyond that you
can run additional networks in any mode at the same time.

**Default.** Devices can see and talk to each other, which is what file
sharing, screen casting and printing need. The mode to pick if you are unsure.
The last Default network cannot be removed or switched to another mode.

**Guest.** Devices are isolated from each other and cannot reach the Starlink
app, so a visitor's laptop cannot see your devices and cannot change your
settings.

**Auto.** For vehicles, boats and RVs. WiFi does not come on until Starlink has
an internet connection, so devices that join always have working internet. If
the connection drops for more than a minute the WiFi switches off and returns
when the link does. This stops a phone from clinging to a WiFi network with no
internet while the dish boots.

## Troubleshooting

**My IP geolocation is wrong or far away.** Known and expected. Starlink
assigns an IP in the same country as your service address, but it may place you
several states, provinces or sub-regions away. Closer geolocation is being
worked on and is not guaranteed today. This is what breaks region-specific
search results and streaming catalogues.

**I need inbound traffic.** CGNAT will not do it. Move to a Priority plan with
a public IP, put a third-party router behind the Starlink, or both.

## Related

- [Third-party devices](/en/guides/starlink/third-party-devices/)
- [Advanced networking](/en/guides/starlink/advanced-networking/)
- [Bypass mode](/en/guides/starlink/app/)