How do I SSH into a server behind CGNAT when I have no public IP?
Your ISP shares one public address between many customers. Port forwarding cannot work. This does.
What you are running into
You set up port forwarding, tested it from outside, and nothing connects. Your router's WAN address starts with 100.64 or 10., or it simply is not the address the internet sees. That is carrier-grade NAT: the ISP has put another router in front of yours, and you cannot configure it.
Mobile broadband, fibre from many ISPs, Starlink, and most 5G home internet all work this way. Dynamic DNS does not help; there is no port to forward.
How SSH Guru handles it
Outbound works everywhere
CGNAT blocks inbound connections, not outbound ones. The bridge board only ever dials out, so it works behind any NAT, double NAT, or hotspot.
No public IP needed
Your server keeps its private address. The bridge reaches it locally and the relay carries encrypted bytes to your browser.
Still end to end
The SSH session is between your browser and the server. Nothing in the middle can read it or log in on its own.
What to do, step by step
- Confirm you are behind CGNAT
Compare the WAN address on your router's status page with the address a site like whatismyip shows. If they differ, or the WAN address is in 100.64.0.0/10, it is CGNAT.
- Create an account
Free plan, vault passphrase.
- Flash a bridge board
Bridges, New bridge. In Chrome or Edge, the wizard flashes an ESP32-S3 over USB and writes Wi-Fi details and the allow list to it.
- Allow the server
Its LAN address and port 22.
- Plug the board in on that network
It dials out through the CGNAT like any other device and shows online in the app.
- Add the server and connect
Route through the bridge. Works the same from your phone on mobile data.
Questions
Will this work on Starlink or 5G home internet?
Yes. Both use CGNAT, and both allow outbound connections, which is all the bridge needs.
Does it work if my router gives out a 10.x address?
Yes. The allow list is written in your LAN's addressing, whatever it is. Private ranges are fine on the bridge; only the public relay refuses them.
How fast is it?
Fine for shells and editors. It is an SSH session over a small board's Wi-Fi; it is not built for bulk file transfer.