Short answer. Most 4G and 5G SIM connections sit behind carrier-grade NAT (CGNAT), so the router has no public IP address and inbound connections never reach it. Port forwarding and dynamic DNS cannot fix that. You need a method where the site connects outward: the camera vendor's cloud service, a VPN, or an outbound relay gateway such as OwlAnywhere. A SIM with a fixed public IP is the remaining option.
Why port forwarding does not work on 4G
On fixed broadband, your router usually gets a public IP address. You forward a port to the recorder, type the address into an app from outside and the connection arrives.
Mobile networks work differently. There are not enough IPv4 addresses for every SIM, so the network places many subscribers behind one shared public address. This is carrier-grade NAT. Your 4G router receives a private address inside the mobile network, and the public address you appear to use belongs to the carrier and is shared with other customers.
An inbound connection to that shared address has nowhere to go: the carrier's equipment does not know it is meant for your router, and you cannot configure it. That is why:
- Port forwarding on your own router has no effect. The connection is dropped before it reaches the router.
- Dynamic DNS (DDNS) does not help. It only maps a name to your public IP address, and you do not have one.
- UPnP does not help for the same reason.
How to check whether your SIM is behind CGNAT
- Open the 4G router's status page and note the WAN or internet IP address.
- From a device connected to that router, search for "what is my IP" and note the address shown.
- If the two addresses are different, you are behind NAT on the mobile network.
You can also tell from the WAN address alone. If it starts with 10., 192.168., 172.16. to 172.31., or falls between 100.64. and 100.127., it is a private or shared address and cannot be reached from the internet.
Four ways to view CCTV without a public IP
| Method | How it works | Good for | Watch out for |
|---|---|---|---|
| 1. Vendor cloud or P2P app | The camera or recorder connects out to the manufacturer's cloud service and you view through the manufacturer's app. | Small, single-brand sites that only need the vendor's app. | Tied to one brand's app and cloud. Usually does not give you a standard RTSP stream for a VMS or another recorder. |
| 2. Fixed public IP SIM | The mobile provider assigns the SIM its own public IP address, so conventional port forwarding works. | Cases where inbound access is unavoidable. | Extra cost and not offered on every plan. Forwarded camera ports are exposed to the whole internet and must be firewalled. |
| 3. VPN from the site router | The site router dials out to a VPN server or service, and you reach the cameras through the tunnel. | IT teams with VPN-capable routers and a server to connect to. | Needs a reachable VPN endpoint, router support, and configuration and upkeep at each site. |
| 4. Outbound relay gateway | A small gateway on the site network dials out to a relay and holds an encrypted tunnel open. You connect to the relay to reach chosen camera or device ports. | RTSP into VLC, an NVR app or a VMS; device web consoles; sites where the router is not yours to configure. | Streams must use RTSP over TCP. Each tunnel carries one device port. |
Methods 1, 3 and 4 all work for the same reason: the connection starts from inside the site and goes out, which CGNAT allows. OwlAnywhere is Owl's implementation of method 4.
How much 4G data does remote CCTV viewing use?
The tunnel itself uses very little. Video uses whatever the stream sends. A simple rule:
GB per hour ≈ stream bitrate in Mbps × 0.45
| Stream bitrate | Typical use | Per hour | Per day if viewed continuously |
|---|---|---|---|
| 0.5 Mbps | Low-resolution sub-stream | about 0.23 GB | about 5.4 GB |
| 1 Mbps | Sub-stream or 720p | about 0.45 GB | about 10.8 GB |
| 2 Mbps | 1080p, efficient settings | about 0.9 GB | about 21.6 GB |
| 4 Mbps | 1080p, higher quality | about 1.8 GB | about 43.2 GB |
| 8 Mbps | 4 MP and above | about 3.6 GB | about 86.4 GB |
Three things keep the bill down:
- Record on site, view on demand. If footage is recorded to the NVR or the camera's own storage, mobile data is only used while someone is actually watching.
- Use the sub-stream for live monitoring. Keep the main stream for retrieving evidence.
- Check the upload speed. The site's mobile upload speed sets how many streams can be watched at once. Four 2 Mbps streams need about 8 Mbps of steady upload.
Setting it up with OwlAnywhere
- Plug the gateway into the site network, alongside the cameras or NVR. Nothing changes on the 4G router and no inbound ports are opened.
- The gateway pairs itself with the relay and pins the relay's identity. It makes one outbound encrypted connection and reconnects by itself after a power or signal drop.
- Add the camera or device you want to reach, for example a camera's RTSP port (usually 554) or the NVR's web console, then Save & Apply.
Open the stream in VLC, your NVR app or a VMS such as OwlGuard, using RTSP over TCP, which most cameras and players support. For cameras that have to move with the work, Owl Portable CCTV combines the camera, mobile connectivity and local recording in one unit. Plans and pricing are on the OwlAnywhere page.
Security checklist for remote CCTV
- Change default passwords on every camera, recorder and router.
- Keep camera and recorder firmware up to date.
- Do not expose camera or recorder ports directly to the internet.
- Make sure the remote connection is encrypted end to end.
- Limit who can connect, and remove access when people leave.
Frequently asked questions
Does dynamic DNS (DDNS) work on a 4G router?
Not when the SIM is behind carrier-grade NAT. DDNS only maps a hostname to your public IP address, and behind CGNAT the router does not have one.
Is it the same on 5G?
Usually, yes. Most mobile data plans, whether 4G or 5G, place the SIM behind carrier-grade NAT, so the same methods apply.
Can I get a public IP address on a mobile plan?
Consumer mobile data plans generally do not include one. Some business plans offer a fixed public IP as an add-on, so ask your mobile provider. Remember that a public IP exposes any forwarded ports to the internet.
How much data does one camera use over 4G?
Roughly the bitrate in Mbps multiplied by 0.45 gives GB per hour. A 1080p stream at 2 to 4 Mbps uses about 0.9 to 1.8 GB per hour while it is being watched, and a sub-stream uses far less.
Can I bring 4G cameras into a video management system?
Yes. With an outbound relay gateway such as OwlAnywhere, each camera's RTSP stream is reachable through the encrypted tunnel and can be added to a VMS such as OwlGuard using RTSP over TCP.