Starlink users report IPsec VPN traffic routing failures caused by Carrier-Grade NAT (CGNAT) breaking ESP data transmission unless NAT-T or public IP addressing is configured.

{
  "signal_id": "b3237237-cc3f-5654-aad5-03115884dc77",
  "signal_type": "reddit-company",
  "signal_subtype": "customerFeedback",
  "detected_at": "2026-10-07T17:27:26+00:00",
  "company": {
    "name": "Starlink",
    "domain": "starlink.com"
  },
  "data": {
    "nsfw": false,
    "stage": "none",
    "awards": 0,
    "timing": "ongoing_state",
    "topics": [
      "vpn",
      "cgnat",
      "satellite",
      "networking"
    ],
    "post_id": "1x02ndi",
    "summary": "Starlink users report IPsec VPN traffic routing failures caused by Carrier-Grade NAT (CGNAT) breaking ESP data transmission unless NAT-T or public IP addressing is configured.",
    "category": "integration",
    "comments": [
      {
        "url": "https://www.reddit.com/r/networking/comments/1x02ndi/comment/peh0k2y/",
        "depth": 0,
        "score": 25,
        "author": "Riddler83843",
        "excerpt": "On a business Starlink change your IP type from default to Public IP to avoid Starlink’s internal CGNat.",
        "posted_at": "2026-10-07T17:35:18.000Z",
        "author_url": "https://www.reddit.com/user/Riddler83843/"
      },
      {
        "url": "https://www.reddit.com/r/networking/comments/1x02ndi/comment/peieun3/",
        "depth": 0,
        "score": 7,
        "author": "AlmsLord5000",
        "excerpt": "They use CGNAT, you need NAT-T.",
        "posted_at": "2026-10-07T21:08:46.000Z",
        "author_url": "https://www.reddit.com/user/AlmsLord5000/"
      },
      {
        "url": "https://www.reddit.com/r/networking/comments/1x02ndi/comment/pelu7jg/",
        "depth": 0,
        "score": 4,
        "author": "voyoit",
        "excerpt": "The \"up but nothing passes\" symptom fits CGNAT well, and it's worth confirming with a capture before changing the plan.\n\n IKE on UDP 500 can get through CGNAT fine, so the tunnel shows as up. The ESP data plane is what breaks. Raw ESP (IP protocol 50) has no ports, so a CGNAT box can't map it. Unless both sides detect the NAT and switch to UDP 4500, the traffic silently dies. The NAT-T is disabled",
        "posted_at": "2026-10-08T09:48:00.000Z",
        "author_url": "https://www.reddit.com/user/voyoit/"
      },
      {
        "url": "https://www.reddit.com/r/networking/comments/1x02ndi/comment/pehrnpa/",
        "depth": 0,
        "score": 2,
        "author": "codetrap",
        "excerpt": "We are running several IPSEC tunnels over starlink, both in fixed and mobile installations. The only issue we had with the CGNAT was that we couldn't reach back to the WAN interfaces. Otherwise it was fine as a dialup connection. (Fortinet). Flipping to public IPs was a nice to have, not a need to have.",
        "posted_at": "2026-10-07T19:26:51.000Z",
        "author_url": "https://www.reddit.com/user/codetrap/"
      },
      {
        "url": "https://www.reddit.com/r/networking/comments/1x02ndi/comment/pes3z7h/",
        "depth": 0,
        "score": 2,
        "author": "lizardhistorian",
        "excerpt": "Suggest using IPv6 and you have to set \"Pubic IP\" in the settings for each Starlink radio.\nYou can make a reusable config and apply it to multiple radios (they call them antennas on their website).\n(Punching thru CGNAT is challenging.)\n\n Then check the MTU.",
        "posted_at": "2026-10-09T03:55:05.000Z",
        "author_url": "https://www.reddit.com/user/lizardhistorian/"
      },
      {
        "url": "https://www.reddit.com/r/networking/comments/1x02ndi/comment/pehzicr/",
        "depth": 0,
        "score": 1,
        "author": "w0lrah",
        "excerpt": "If you are able to send traffic over the VPN, even just to the far side device, the problem has nothing to do with your internet connection.\n\n Also if you control the devices at both ends you should be able to get packet captures from them. Do that and see if the packets are being received the way they were sent.",
        "posted_at": "2026-10-07T20:02:20.000Z",
        "author_url": "https://www.reddit.com/user/w0lrah/"
      },
      {
        "url": "https://www.reddit.com/r/networking/comments/1x02ndi/comment/pehzvh1/",
        "depth": 0,
        "score": 1,
        "author": "Agromahdi123",
        "excerpt": "If you cant do the recommended below of avoiding cgnat you can try using a “hole punch” method using a different type of tunnel. If the firewall can be a “client” to a vpn by reaching out it will work with nat/pat and cgnat since it should just appear as an outbound udp connection and thus replies should be allowed back in",
        "posted_at": "2026-10-07T20:03:59.000Z",
        "author_url": "https://www.reddit.com/user/Agromahdi123/"
      },
      {
        "url": "https://www.reddit.com/r/networking/comments/1x02ndi/comment/pejto00/",
        "depth": 0,
        "score": 1,
        "author": "KindPresentation5686",
        "excerpt": "Enable NAT-T",
        "posted_at": "2026-10-08T01:23:07.000Z",
        "author_url": "https://www.reddit.com/user/KindPresentation5686/"
      }
    ],
    "evidence": [
      "[post] Tunnels report as up on both the Cradlepoint and the FTD side, but no traffic passes at all.",
      "[post] Would this be an issue with CGNAT? For some reason, the FTD does not think that the connection needs NAT-T enabled.",
      "[comment u/voyoit] The \"up but nothing passes\" symptom fits CGNAT well, and it's worth confirming with a capture before changing the plan."
    ],
    "virality": "somewhat_high",
    "post_date": "2026-10-07T17:27:26.000Z",
    "post_kind": "text",
    "post_text": "I'm having an issue with getting an IPSEC VPN working over Starlink and could use a little bit of help pointing me in the right direction.\n\nThe head end device is a Cisco Firepower FTD1140 and the client is a Cradlepoint R1900 mobile router. I have set up a route-based VTI VPN between the FTD and the Cradlepoint and the VPN is established.\n\nHere's where I am having the issue - everything works exactly as it should when using the internal cellular modem. VPN comes up, routes build correctly, and everything is fine. I have the Starlink set up so the users can flip a switch to power it on as a backup internet source. The Cradlepoint sees the WAN link come up and switches to use that instead of the cell modem.\n\nFrom everything I can see, the VPN link comes up and establishes correctly. Tunnels report as up on both the Cradlepoint and the FTD side, but no traffic passes at all. From a client computer, I can ping the IP address of the outside interface on the FTD, but that is the only thing that responds.\n\nI have tried setting the VPN adapter MTU on the Cradlepoint to 1300 and it still does not pass data. Turning the Starlink off restores all communications.\n\nWould this be an issue with CGNAT? For some reason, the FTD does not think that the connection needs NAT-T enabled. The IP address reported by the Cradlepoint does not match the address that the FTD reports. The Cradlepoint is...",
    "sentiment": "negative",
    "subreddit": "networking",
    "event_date": "2026-10",
    "post_flair": [
      "Troubleshooting"
    ],
    "post_title": "VPN Over Starlink Issues",
    "prominence": "core",
    "source_url": "https://www.reddit.com/r/networking/comments/1x02ndi/vpn_over_starlink_issues/",
    "entity_role": "vendor",
    "post_author": "cecil29000",
    "upvote_ratio": 0.7307692307692307,
    "mention_count": 1,
    "mention_surge": false,
    "subreddit_url": "https://www.reddit.com/r/networking/",
    "total_upvotes": 12,
    "comments_total": 35,
    "total_comments": 35,
    "other_companies": [
      {
        "name": "Cisco",
        "role": "partner",
        "domain": "cisco.com"
      },
      {
        "name": "Cradlepoint",
        "role": "partner",
        "domain": "cradlepoint.com"
      }
    ],
    "post_author_url": "https://www.reddit.com/user/cecil29000/",
    "signal_category": "feedback",
    "comments_included": 15,
    "products_mentioned": [
      "Starlink"
    ]
  }
}

curl https://signals.autobound.ai/v1/signals/b3237237-cc3f-5654-aad5-03115884dc77 \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"starlink.com","limit":20}'