VoIP behind carrier-grade NAT and Starlink and cellular links

See also

Sources

1. 1
   Phones on a cellular or fixed-wireless network that reaches IPv4 through 464XLAT cannot receive unsolicited inbound IPv4 SIP, so they depend on client-initiated flows or relays just as behind CGNAT.inferred

   RFC 6877: 464XLAT: Combination of Stateful and Stateless Translation · Abstract; Section 1; Section 2 · Checked 2026-10-14
2. 2
   For an Asterisk server behind NAT, the documentation sets external_media_address and external_signaling_address to the external IP and local_net to the internal ranges so SDP and SIP headers are rewritten only toward non-local destinations.

   Configuring res_pjsip to work through NAT · section 'pjsip.conf Configuration' · Checked 2026-10-14
3. 3
   Asterisk documentation configures PJSIP endpoints for remote phones behind NAT with rtp_symmetric, force_rport and rewrite_contact so media and SIP are sent back to the observed source address and port.

   Configuring res_pjsip to work through NAT · section 'For Remote Phones Behind NAT' · Checked 2026-10-14
4. 4
   Enabling Starlink bypass mode removes the customer-side double NAT but does not remove carrier-grade NAT, so inbound SIP still fails on a default CGNAT plan.inferred

   What is bypass mode? - Starlink Help Center · article body; read with starlink-help-blocked-ports article body · Checked 2026-10-14
5. 5
   Community posts report that 3CX phones on Starlink or LTE behind CGNAT fail with STUN plus port forwarding and that partners instead use the 3CX SBC tunnel, which needs no inbound NAT rules.field report

   3CX StartUP on Starlink (uses CGNAT) · thread replies · Checked 2026-10-14
6. 6
   Community reports describe Starlink CGNAT links where SIP calls connect but carry no audio until the PBX is set for symmetric RTP with local networks defined and no fixed external address.field report

   CGNAT Starlink & FlowRoute RTP Issues · thread, original post and resolution post · Checked 2026-10-14
7. 7
   A VoIP provider reports that SIP over TLS performs better than UDP on Starlink connections in many of its tests, and lists one-way audio, dropped calls and registration timeouts as Starlink double-NAT symptoms.field report

   Kiwi VoIP - Using VoIP Phones with Mesh Networks & Starlink · article body, problem context and TLS step · Checked 2026-10-14
8. 8
   Behind CGNAT an inbound call can reach a registered phone only over a binding the phone itself opened and kept alive, so the keep-alive or re-registration interval must be shorter than the CGN's idle timeout.inferred

   RFC 5626: Managing Client-Initiated Connections in the Session Initiation Protocol (SIP) · Sections 3.5 and 4.4; read with RFC 4787 Section 4.3 REQ-6 and RFC 7857 Section 7 · Checked 2026-10-14
9. 9
   Kiwi VoIP advises customers using VoIP phones on Starlink to enable Starlink bypass mode, disable SIP ALG and switch SIP transport from UDP 5060 to TLS 5061.

   Kiwi VoIP - Using VoIP Phones with Mesh Networks & Starlink · article body, numbered steps · Checked 2026-10-14
10. 10
    RFC 3581 defines the Via rport parameter so a SIP server sends UDP responses to the source IP address and port the request actually came from, which matches the NAT binding.

    RFC 3581: An Extension to the Session Initiation Protocol (SIP) for Symmetric Response Routing · Sections 3 and 4 · Checked 2026-10-14
11. 11
    RFC 4787 REQ-10 says ALGs for UDP-based protocols SHOULD be turned off and each ALG should be separately enable-able by the administrator.

    RFC 4787: Network Address Translation (NAT) Behavioral Requirements for Unicast UDP (BCP 127) · Section 7, REQ-10 and REQ-10a · Checked 2026-10-14
12. 12
    RFC 4787 REQ-1 requires a NAT to use endpoint-independent mapping for UDP.

    RFC 4787: Network Address Translation (NAT) Behavioral Requirements for Unicast UDP (BCP 127) · Section 4.1, REQ-1 · Checked 2026-10-14
13. 13
    RFC 4787 REQ-9 requires a NAT to support hairpinning using the external source IP address and port.

    RFC 4787: Network Address Translation (NAT) Behavioral Requirements for Unicast UDP (BCP 127) · Section 6, REQ-9 and REQ-9a · Checked 2026-10-14
14. 14
    RFC 4787 REQ-6 requires that outbound packets refresh a NAT UDP mapping, while inbound refresh is optional.

    RFC 4787: Network Address Translation (NAT) Behavioral Requirements for Unicast UDP (BCP 127) · Section 4.3, REQ-6 and REQ-6a · Checked 2026-10-14
15. 15
    RFC 4787 REQ-5 says a NAT UDP mapping timer MUST NOT expire in less than two minutes and recommends a default of five minutes or more, with shorter timers allowed only for well-known destination ports 0-1023.

    RFC 4787: Network Address Translation (NAT) Behavioral Requirements for Unicast UDP (BCP 127) · Section 4.3, REQ-5, REQ-5a, REQ-5c · Checked 2026-10-14
16. 16
    RFC 4961 recommends that symmetric RTP and RTCP, sending from the same IP address and UDP port used to receive, always be used for bidirectional media, and requires it for traversal of NATs without ALGs.

    Symmetric RTP / RTP Control Protocol (RTCP) · Sections 3 and 4 · Checked 2026-10-14
17. 17
    RFC 5626 (SIP Outbound) lets a SIP proxy deliver inbound requests to a user agent over connections or flows the user agent itself established, instead of opening a new connection toward it.

    RFC 5626: Managing Client-Initiated Connections in the Session Initiation Protocol (SIP) · Abstract; Section 1; Sections 3.1-3.4 · Checked 2026-10-14
18. 18
    RFC 5626 has a UA on a connection-oriented transport such as TCP or TLS send double-CRLF keep-alives at a random 95 to 120 seconds by default, or 672 to 840 seconds where battery is a concern, and treat the flow as failed if no pong arrives within 10 seconds.

    RFC 5626: Managing Client-Initiated Connections in the Session Initiation Protocol (SIP) · Section 4.4.1 · Checked 2026-10-14
19. 19
    Under RFC 5626, when a registrar returns a Flow-Timer value the UA must send keep-alives at least that often, at a random point between 80 and 100 percent of the value.

    RFC 5626: Managing Client-Initiated Connections in the Session Initiation Protocol (SIP) · Sections 4.4, 5.4 and 6 · Checked 2026-10-14
20. 20
    RFC 5626 treats a UDP flow as failed if the XOR-MAPPED-ADDRESS returned in a STUN keep-alive response changes, which signals that the NAT binding was replaced.

    RFC 5626: Managing Client-Initiated Connections in the Session Initiation Protocol (SIP) · Section 4.4.2 · Checked 2026-10-14
21. 21
    RFC 5626 has a UA re-register after flow failure with a random wait between 50 and 100 percent of min(max-time, base-time x 2^failures), using a 30 second base if all flows failed, 90 seconds otherwise, and an 1800 second maximum.

    RFC 5626: Managing Client-Initiated Connections in the Session Initiation Protocol (SIP) · Section 4.5 · Checked 2026-10-14
22. 22
    RFC 5626 has a UA on a connectionless transport such as UDP send STUN keep-alives on the flow at a random interval of 24 to 29 seconds when the registrar supplies no Flow-Timer.

    RFC 5626: Managing Client-Initiated Connections in the Session Initiation Protocol (SIP) · Section 4.4.2 · Checked 2026-10-14
23. 23
    RFC 6269 notes that under IP address sharing, inbound connections to well-known ports generally fail and applications that are not port-agile cannot be expected to work.

    RFC 6269: Issues with IP Address Sharing · Section 5.2.2 · Checked 2026-10-14
24. 24
    RFC 6269 notes that keep-alive messages must be sent frequently to maintain NAT state behind address sharing, which significantly reduces battery life on battery-powered devices.

    RFC 6269: Issues with IP Address Sharing · Section 19 · Checked 2026-10-14
25. 25
    RFC 6269 says port forwarding behind a CGN requires cooperation between the CPE and the CGN, making the subscriber dependent on the provider.

    RFC 6269: Issues with IP Address Sharing · Section 5.2.1 · Checked 2026-10-14
26. 26
    RFC 6269 notes that blocklisting a shared IPv4 address for abuse restricts every subscriber sharing it.

    RFC 6269: Issues with IP Address Sharing · Sections 13.1 and 13.3 · Checked 2026-10-14
27. 27
    RFC 6269 says NAT traversal techniques such as UPnP IGD NAT-PMP and manual configuration assume the NAT's WAN address is publicly routable and fail when it is not.

    RFC 6269: Issues with IP Address Sharing · Section 6 · Checked 2026-10-14
28. 28
    RFC 6598 states Shared Address Space is not globally routable and packets with 100.64.0.0/10 source or destination addresses must not cross service provider boundaries.

    RFC 6598: IANA-Reserved IPv4 Prefix for Shared Address Space · Section 1; Section 4; Section 6 · Checked 2026-10-14
29. 29
    RFC 6598 warns that the assumption that a non-special-use address is reachable from the Internet does not hold when the address sits behind a CGN.

    RFC 6598: IANA-Reserved IPv4 Prefix for Shared Address Space · Section 5.1 · Checked 2026-10-14
30. 30
    RFC 6598 reserves 100.64.0.0/10 as Shared Address Space for service providers to number the links between Carrier-Grade NAT devices and customer premises equipment.

    RFC 6598: IANA-Reserved IPv4 Prefix for Shared Address Space · Abstract; Section 1; Section 7 (IANA Considerations) · Checked 2026-10-14
31. 31
    RFC 6877 says 464XLAT provides IPv4 connectivity only in a client-server model toward servers with global IPv4 addresses and is not suited to IPv4 peer-to-peer or inbound connections.

    RFC 6877: 464XLAT: Combination of Stateful and Stateless Translation · Abstract; Section 1 · Checked 2026-10-14
32. 32
    In RFC 6877 the provider-side translator (PLAT) performs stateful RFC 6146 NAT64 translation from many IPv6 addresses to shared global IPv4 addresses, while the customer-side CLAT is stateless.

    RFC 6877: 464XLAT: Combination of Stateful and Stateless Translation · Section 2; Sections 6.2 and 7.2 · Checked 2026-10-14
33. 33
    RFC 6887 Port Control Protocol lets a host request inbound mappings from an upstream NAT including a Carrier-Grade NAT using the MAP opcode, with finite lifetimes the client must renew.

    RFC 6887: Port Control Protocol (PCP) · Sections 1, 2.1, 3 and 10.1 · Checked 2026-10-14
34. 34
    RFC 6888 REQ-7 recommends endpoint-independent filtering on a CGN and allows address-dependent filtering only where it is known not to break the application.

    RFC 6888: Common Requirements for Carrier-Grade NATs (CGNs) · Section 3, REQ-7 · Checked 2026-10-14
35. 35
    RFC 6888 REQ-2 requires a CGN to use Paired IP address pooling by default so that all of a subscriber's sessions share the same external IP address.

    RFC 6888: Common Requirements for Carrier-Grade NATs (CGNs) · Section 3, REQ-2 · Checked 2026-10-14
36. 36
    RFC 6888 REQ-4 requires that a CGN allow per-subscriber port limits to be configured and permits them to differ per transport protocol.

    RFC 6888: Common Requirements for Carrier-Grade NATs (CGNs) · Section 3, REQ-4 · Checked 2026-10-14
37. 37
    RFC 6888 REQ-9 says a CGN MUST let subscribers control their NAT mappings and SHOULD support the Port Control Protocol for this.

    RFC 6888: Common Requirements for Carrier-Grade NATs (CGNs) · Section 3, REQ-9 · Checked 2026-10-14
38. 38
    RFC 6888 is BCP 127, was published in April 2013 and updates RFC 4787, so CGNs are expected to meet the RFC 4787 UDP behavioural requirements in addition to CGN-specific ones.

    RFC 6888: Common Requirements for Carrier-Grade NATs (CGNs) · Document header; Section 3, REQ-1 · Checked 2026-10-14
39. 39
    RFC 7857 says inbound packets blocked by a NAT's security policy SHOULD NOT refresh the mapping, so unsolicited inbound traffic cannot keep a binding alive.

    RFC 7857: Updates to Network Address Translation (NAT) Behavioral Requirements · Section 7 · Checked 2026-10-14
40. 40
    RFC 7857 recommends a default of 4 minutes for NAT TCP transitory-state timeouts, with open and closing transitory timeouts separately configurable.

    RFC 7857: Updates to Network Address Translation (NAT) Behavioral Requirements · Section 2.1 · Checked 2026-10-14
41. 41
    RFC 8085 says applications that need UDP keep-alives SHOULD NOT send them more often than once every 15 seconds and should use longer intervals when possible.

    RFC 8085: UDP Usage Guidelines · Section 3.5 · Checked 2026-10-14
42. 42
    RFC 8085 says keep-alives are not a recovery mechanism and applications still need a way to recover from broken sessions.

    RFC 8085: UDP Usage Guidelines · Section 3.5 · Checked 2026-10-14
43. 43
    RFC 8085 states that empirical evidence suggests many deployed middleboxes use UDP state timeouts shorter than the two minutes RFC 4787 requires.

    RFC 8085: UDP Usage Guidelines · Section 3.5 · Checked 2026-10-14
44. 44
    Starlink bypass mode turns off the Starlink router's WiFi so a third-party router connects directly to Starlink, and exiting bypass mode requires a factory reset.

    What is bypass mode? - Starlink Help Center · article body · Checked 2026-10-14
45. 45
    Starlink's default CGNAT IP policy blocks all inbound ports.

    What ports does Starlink block? - Starlink Help Center · article body, opening statement on default IP policy · Checked 2026-10-14
46. 46
    Starlink's default IPv4 configuration is CGNAT with addresses assigned to clients by DHCP from 100.64.0.0/10.

    What IP address does Starlink provide? - Starlink Help Center · article body, default IPv4 policy paragraph · Checked 2026-10-14
47. 47
    Each Starlink connection is allocated one IPv4 address via DHCPv4 and a delegated /56 IPv6 prefix via DHCPv6-PD.

    IP Address - Starlink Help Center · article body, IPv6 paragraph · Checked 2026-10-14
48. 48
    When a Starlink CGNAT plan reaches its concurrent session limit, new sessions cause the oldest sessions to be dropped.

    What are CGNAT session limits and how do they affect my connection? - Starlink Help Center · article body, limit behaviour paragraph · Checked 2026-10-14
49. 49
    Starlink lists VoIP calls dropping or failing to connect and one-way audio among the common symptoms of hitting the CGNAT session limit.

    What are CGNAT session limits and how do they affect my connection? - Starlink Help Center · article body, symptoms list · Checked 2026-10-14
50. 50
    Starlink does not provide static IP addresses; a public IP is dynamic and is held for the device for 24 hours across reboots or disconnects but may change after relocation or software updates.

    IP Address - Starlink Help Center · article body, static IP and reservation paragraphs · Checked 2026-10-14
51. 51
    Starlink blocks outbound TCP port 25 and TCP port 445 for all customers.

    What ports does Starlink block? - Starlink Help Center · article body, outbound blocked ports list · Checked 2026-10-14
52. 52
    Starlink advises customers who regularly use VoIP, video conferencing or other session-intensive applications to consider a Priority plan, which it says includes a public IP and lacks the CGNAT session limitation.

    What are CGNAT session limits and how do they affect my connection? - Starlink Help Center · article body, recommendation paragraph · Checked 2026-10-14
53. 53
    One Starlink Help Center article says public IPv4 addresses are available to the Local Priority and Global Priority service plans.disputed

    IP Address - Starlink Help Center · article body, public IPv4 paragraph · Checked 2026-10-14
54. 54
    One Starlink Help Center article says the optional public IPv4 policy is available to Priority, Mobile Priority and Maritime customers.disputed

    What IP address does Starlink provide? - Starlink Help Center · article body, public IP policy paragraph · Checked 2026-10-14
55. 55
    Starlink WiFi routers do not support port forwarding or firewall rules for IPv4 or IPv6.

    IP Address - Starlink Help Center · article body, router capabilities statement · Checked 2026-10-14
56. 56
    Starlink Residential and Roam plans use CGNAT and are limited to 1,200 concurrent UDP or TCP sessions.

    What are CGNAT session limits and how do they affect my connection? - Starlink Help Center · article body, opening paragraph · Checked 2026-10-14

Documents

Cite this page

WarmTransfer. (2026, October 14). VoIP behind carrier-grade NAT and Starlink and cellular links. WarmTransfer. https://warmtransfer.net/knowledge/cgnat-starlink-voip

@misc{warmtransfer-cgnat-starlink-voip,
  title  = {VoIP behind carrier-grade NAT and Starlink and cellular links},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/cgnat-starlink-voip},
  note   = {Verified 2026-10-14}
}