Frequently Asked Question
Why can I open UniFi remotely, but my NAS VPN or port-forwarded service fails behind CGNAT?
ACE SUPPORT · UBIQUITI
UniFi management access does not prove that your WAN accepts direct inbound connections. Check the WAN addressing and choose a supported authenticated access method.
Applies to
UniFi Cloud Gateways such as UCG-Fiber, behind an ISP router, mobile service or CGNAT connection. The exact access method matters: Site Manager, Teleport, a traditional VPN server and a forwarded application are different services.
Before you begin
Do not expose NAS administration, camera management or remote desktop ports as a test. Keep existing firewall policy and authentication protections.
Changing an ISP router to bridge mode can interrupt internet, voice or other supplied services. Confirm requirements with the ISP and prepare a recovery route first.
Work through these checks
- Identify exactly what fails: opening UniFi management, connecting a VPN, or reaching an application. Test from mobile data so that you are genuinely outside the site. A successful management login should not be used as evidence that an inbound application port is reachable.
- In Site Manager, select the site and compare its dashboard WAN address with the internet address seen from that site's connection. Ask the ISP whether the service supplies public IPv4 or uses CGNAT. Retain redacted observations rather than posting addresses publicly.
- If another router performs NAT upstream, ask the network administrator and ISP about an approved bridge or access design. If the ISP uses CGNAT, a local forwarding rule cannot control the ISP's translation. Dynamic DNS also does not create a public IP.
- For private access, review a supported VPN option. Ubiquiti documents Teleport for supported Cloud Gateways behind NAT, through Network Settings > VPN. It may need WAN IPv6 in some circumstances, so confirm the gateway and provider configuration rather than assuming it always works.
- Create a Teleport invitation only for the intended authorised user and device, then use WiFiman to test. Invitations expire after 24 hours and are limited to one device at a time. Revoke any unused or temporary access when testing finishes.
Confirm the result
From an external network, confirm the VPN connects and the authorised internal service works. Check that access is limited as intended. A VPN 'connected' indicator alone does not prove application reachability.
When to contact us
Provide our Support Specialist with the gateway/version, ISP addressing confirmation, upstream-router arrangement and exact failed method. Keep passwords, invitation links and support exports private.
Related ACE guides
Updated 261105