← Back to Blog

Best VPN for Starlink, 5G Home Internet & CGNAT (2026)

E

Short answer: yes, you can use a VPN on Starlink, T-Mobile Home Internet, Verizon 5G Home, and other CGNAT connections, and normal VPN use works fine because the VPN makes an outbound connection. CGNAT mainly breaks inbound connections: port forwarding, remote camera access, hosting game servers, and "Open" NAT on consoles. The best setup is a WireGuard-based VPN connected to a nearby server; if you need inbound access, pick a provider that offers port forwarding on its own servers, such as Proton VPN on paid plans.

If your internet comes from a dish on the roof or a modem talking to a cell tower, you may have noticed things that worked on cable or fiber now don't: security cameras you can't reach remotely, game invites that fail, a Plex server nobody can connect to, or a VPN that occasionally stalls. These aren't random glitches. They follow from how these networks share IP addresses and, on satellite, from how the link behaves.

What is CGNAT and how do I know if I'm behind it?

Carrier-Grade NAT (CGNAT) exists because there aren't enough public IPv4 addresses for every customer. Instead of giving your router its own public IP, the provider gives it a private address and shares one public IP among many subscribers, translating traffic at the provider's edge.

To check: open your router's admin page and note its WAN (internet) IP, then compare it with the IP shown on any "what is my IP" site. If they differ, or the WAN IP starts with 100.64 to 100.127 (the 100.64.0.0/10 range reserved for CGNAT), you're behind CGNAT. Residential Starlink plans and most 5G home internet services use CGNAT for IPv4; some offer a public IPv4 address only on business or priority tiers.

Does CGNAT affect VPN performance?

For everyday use, not much. A VPN app initiates the connection from your side, and CGNAT handles outbound connections normally. You can browse, stream, and work over a VPN on CGNAT without special settings.

Where CGNAT causes trouble:

  • Port forwarding doesn't work, because there's no public IP mapped to your router.
  • Hosting anything at home (game servers, NAS, Plex, remote desktop, camera NVRs) can't accept incoming connections.
  • Console NAT type is often "Moderate" or "Strict", which can limit matchmaking and voice chat.
  • Running your own VPN server at home (for example WireGuard on a Raspberry Pi) won't be reachable from outside.
  • Shared reputation: if someone else behind the same public IP gets it flagged, you may see more CAPTCHAs or streaming blocks.

Why does my VPN feel slower on Starlink?

Satellite internet has more variable latency than fiber or cable. Traffic travels from your dish to a satellite, possibly between satellites, and down to a ground station before it reaches the internet, and the dish regularly switches between satellites as they move overhead. That shows up as jitter (variation in latency) and brief interruptions, especially with obstructions or bad weather.

A VPN adds one more hop on top. If that hop goes to a distant server, you stack two variable-latency links, which is when video calls stutter and connections time out. The fix is simple: connect to the closest server that meets your needs, not a far-away one.

💡 Pick the nearest server, not the farthest

On fiber, a distant VPN server barely matters for browsing. On satellite or 5G home internet, you're already paying a latency cost on the first hop, so a nearby, lightly loaded server makes a noticeable difference.

Which VPN protocol is best for Starlink and 5G home internet?

WireGuard, or a provider's WireGuard-based protocol (NordLynx at NordVPN, for example). WireGuard has a lightweight handshake and lean packet format, and it handles network changes gracefully: a brief interruption doesn't usually tear down the tunnel, so it recovers quickly. OpenVPN over TCP is the most likely to struggle on lossy links, because TCP-inside-TCP retransmissions compound delays.

Set the protocol manually in your app rather than leaving it on automatic, and only fall back to OpenVPN or an obfuscated mode if your network blocks WireGuard.

How do I get port forwarding on CGNAT?

You have three realistic options:

  1. Use a VPN with port forwarding. The VPN server gives you a public entry point, so inbound connections reach you through the tunnel. Proton VPN supports port forwarding on all paid plans when you connect to a P2P server (Windows, Linux, and macOS, plus manual configurations). NordVPN and Surfshark don't offer port forwarding. Several providers have dropped the feature; Mullvad, for example, removed it in 2023, citing abuse. Check current feature lists before you buy.
  2. Ask your provider for a public IP. Some ISPs sell a public or static IPv4 address, often only on business or priority plans.
  3. Use IPv6 or a tunneling service. If both ends support IPv6, inbound connections can work without CGNAT getting in the way (you'll still need to allow them in your router's firewall). Mesh tools and reverse tunnels are another route for remote access to your own devices.

How do I set up a VPN on Starlink or 5G home internet? Step by step

  1. Check whether you're behind CGNAT using the WAN-IP comparison above.
  2. Install the VPN app on your devices, or on a separate router if you want to cover the whole house. The stock Starlink router and most 5G gateways can't run VPN clients themselves.
  3. Select WireGuard (or the provider's WireGuard-based protocol) in the settings.
  4. Connect to the nearest server and run a speed test at the times you normally use the connection.
  5. Turn on the kill switch so a brief drop doesn't expose traffic.
  6. Test for leaks with our DNS and IP leak test guide, paying attention to IPv6, which Starlink and many 5G providers assign.
  7. Enable port forwarding only if you need inbound access, and only on a provider that supports it.

Which VPN is best for Starlink and CGNAT connections?

  • Proton VPN: the pick if you need inbound access, thanks to port forwarding on paid plans, plus open-source apps and an audited no-logs policy. Its Secure Core multi-hop routing adds latency, so leave it off for everyday use on satellite.
  • NordVPN: a strong all-rounder if you don't need port forwarding, with NordLynx, a large network for finding a nearby server, and obfuscated servers for restrictive networks.
  • Surfshark: good value for households, since it allows unlimited simultaneous devices, and it includes obfuscation (Camouflage Mode) for networks that interfere with VPN traffic.

Our ranked list of the best VPNs for Starlink, 5G and CGNAT goes deeper, and the NordVPN vs Proton VPN comparison helps if you're deciding between speed and port forwarding. Gamers should also read our gaming and low-ping picks.

Frequently Asked Questions (FAQ)

Does a VPN fix CGNAT?

A VPN can't remove CGNAT from your ISP's network. For normal browsing it doesn't need to. For inbound connections, a VPN with port forwarding gives you a reachable public entry point on the VPN server, which works around CGNAT for that traffic.

Why does my VPN keep disconnecting on Starlink?

Brief interruptions from satellite switching or obstructions can make some protocols drop the tunnel. Switch to WireGuard, connect to a nearby server, and use the Starlink app's obstruction check to improve dish placement.

Can I get an Open NAT type on Starlink with a VPN?

Only with a VPN that supports port forwarding, set up on a router or a PC sharing its connection, since consoles can't run VPN apps. Results vary by game, so test during the provider's money-back period.

Is WireGuard always better than OpenVPN on 5G home internet?

In most cases, yes, because it's lighter and recovers faster from short drops. If your network blocks WireGuard, use the provider's obfuscated mode rather than plain OpenVPN.

Check out the Best VPNs of 2026