Port forwarding on a 4G router

Port forwarding is the usual way to reach something behind a router, such as a camera, a recorder or a controller, from outside. On a 4G router it often appears to be set up correctly and still does nothing. That is not a fault in the router; it is the mobile connection.

Why it does not work by default

Port forwarding tells your router: when a connection arrives on this port, pass it to that device. It only helps if connections can arrive at the router in the first place. On mobile data, every ThingSIM SIM has a private IP address, and private addresses cannot receive connections from the internet. The router never sees the incoming connection, so its forwarding rule never fires.

What it needs

To use port forwarding, the router needs an address the internet can reach. With ThingSIM that is a static public IP: a fixed public address for the SIM, £8 a month, added from the portal. It is directly reachable from the internet, and once the SIM has it, port forwarding on the router works as it would on a fixed line.

If you only want to view a camera, check first whether its manufacturer app already works without any of this; many relay through the camera's outbound connection. See reaching a 4G camera remotely.

Setting it up, step by step

1. Add the static public IP to the SIM in the portal and note the address.
2. Give the device a fixed local address on the router's network, either set on the device or reserved in the router's DHCP settings, so the forwarding rule always points at the same thing.
3. Create the forwarding rule in the router: the external port, the device's local address and the device's port. Use an uncommon external port rather than the device's default where you can.
4. Restrict who can connect. If the router can limit a rule to particular source addresses, such as your office's address, do it.
5. Test from outside, from a phone on a different network, connecting to the static address and external port.
6. Secure the device before you leave it exposed: see the checklist below.

Forward as little as possible

Every forwarded port is a door into your network from anywhere on the internet. Forward only the ports you need, never the router's own admin page, and remove rules you no longer use. Change default passwords, and keep the device's and router's firmware up to date. The guide to securing a device on a public IP goes through this in full.

When a VPN is better

If you are managing several devices, or would rather nothing was exposed at all, a VPN is the better shape: your systems reach the devices privately and no ports face the internet. See static public IP, private APN or VPN. For routers used as broadband backup, the router failover page covers the wider set-up.

Common questions

Why does port forwarding not work on my 4G router?

Because mobile SIMs have private IP addresses that cannot receive connections from the internet, so incoming traffic never reaches the router. A static public IP on the SIM fixes that.

Is it safe to forward ports on a 4G router?

It is as safe as the device you expose. Forward only what you need, restrict source addresses where the router allows it, change default passwords and keep firmware current.

How much does a static public IP cost?

£8 a month per SIM, added from the portal.