If your Hikvision NVR sits behind CGNAT, as it usually does on Starlink, a 4G or 5G router, or some fibre services, port forwarding cannot work: your router never gets a public IPv4 address for anyone to connect to. Four routes do work: Hik-Connect, a Tailscale subnet router, IPv6, or a public IP bought from your provider. HikGrid (our app), a native Mac app for viewing Hikvision and HiLook cameras, can sign in through Hik-Connect, which needs no port forwarding.
Updated November 2026.
Short answer: Use Hik-Connect for the easiest setup. Use Tailscale if you want long, direct sessions without Hikvision's cloud. Treat IPv6 and a paid public IP as fallbacks.
The four routes at a glance
| Route | Works behind CGNAT | Opens ports | Extra kit | Main limit |
|---|---|---|---|---|
| Hik-Connect (cloud P2P) | Yes | No | None | Cloud live view stops after 5 minutes; traffic goes via Hikvision's service |
| Tailscale subnet router | Yes | No | An always-on device at the camera site (a small computer, a Mac or an Apple TV) | A little setup; Tailscale on every device you view from |
| IPv6 | Sometimes | Yes, an IPv6 firewall rule | A router that lets you set IPv6 rules | Both ends need working IPv6; recorder support varies |
| Public IPv4 from your provider | Removes CGNAT | Yes | Often your own router | Extra cost, and the usual port-forwarding risks |
HikGrid is independent and not affiliated with Hikvision, HiLook, Starlink, Tailscale or the other products mentioned here.
What CGNAT is, and how to tell if you have it
Carrier-grade NAT lets an internet provider share one public IPv4 address between many customers. Your router gets a private address on the provider's side, often in the 100.64.0.0/10 range set aside for this in RFC 6598. A port forward tells your router where to send traffic arriving at your public address. Under CGNAT there is no public address of your own, so nothing from outside ever arrives (ModemGuides).
To check:
- Find the WAN or internet IP address on your router's status page.
- Compare it with the address a "what is my IP" site shows.
- If they differ, or the router's address starts with 100.64 to 100.127, you are behind CGNAT.
Starlink
Starlink's own help centre says its router does not support port forwarding, and that forwarding needs a third-party router and a public IP on your Starlink service (Starlink support). On standard plans your IPv4 address is behind CGNAT.
4G and 5G routers
Mobile networks commonly use CGNAT. Installers report it on UK networks such as EE, Vodafone and O2 (Teltonika community). A recorder on a 4G router at a farm, a building site or a holiday home is the classic case.
Route 1: Hik-Connect
With Hik-Connect, the recorder makes an outbound connection to Hikvision's cloud, and your app reaches it through that link. Because the connection starts from inside your network, no port forward is needed, and CGNAT doesn't get in the way (IPVM discussion). UK distributor Netview describes it as peer-to-peer with a relay fallback (Netview).
To turn it on, enable Hik-Connect on the recorder. On many models it is under Configuration > Network > Advanced > Platform Access in the web page. Then add the device to your Hik-Connect account.
The limits: Hikvision stops cloud live view after 5 minutes by design (Hikvision support). Your video also travels via Hikvision's infrastructure. If the device shows offline, see Hik-Connect device offline: 10 fixes, and for the time limit, the 5-minute limit.
On a Mac, HikGrid can sign in with the same Hik-Connect account, so you get playback, recording search and footage download through this route without opening a port.
Route 2: Tailscale as a subnet router
Tailscale builds a private network between your own devices. The recorder can't run Tailscale itself, but a subnet router can stand in for it: one always-on device at the camera site advertises the local network, and every Tailscale device you own can then reach it (Tailscale docs). Because both ends connect outwards, it works behind CGNAT.
- Pick an always-on device on the same network as the recorder: a small Linux computer, a Mac, a Windows PC, or an Apple TV. The Apple TV needs tvOS 17 or later and must be set up as a home hub (Tailscale for Apple TV).
- Install Tailscale on it, sign in, and advertise the local subnet, for example 192.168.1.0/24. On an Apple TV this is the Subnet Router option in the Tailscale app.
- Approve the route in the Tailscale admin console.
- Install Tailscale on your Mac and sign in to the same account. On macOS, approved routes are accepted automatically (Tailscale docs).
- Connect to the recorder by its local IP address, as you would at home.
This keeps the session direct, with no cloud time limit and no open ports. In HikGrid you would add the recorder by its local IP. Test it on your own setup with the free trial before relying on it.
Route 3: IPv6
Many CGNAT providers also hand out public IPv6 addresses, which don't need NAT at all. In practice it is fiddly. Your router has to let you allow inbound IPv6 to the recorder, the recorder has to support IPv6, and the network you view from needs IPv6 as well. One user on the use-IP forum, with an NVR behind a CGNAT 4G router, could not reach its IPv6 address at all (use-IP forum). Hik-Connect worked for them.
Route 4: buy a public IP
Some providers sell a public or static IPv4 address as an add-on, and Starlink offers a public IP on certain plans. With one, normal port forwarding works again, along with its risks. Read Hikvision ports explained before you open anything.
Saving data on 4G
Remote viewing over 4G or 5G uses mobile data at the camera site. View the sub-stream rather than the main stream when you can: channel 102 rather than 101 in Hikvision's numbering (see the Hikvision RTSP URL format). Check the router's data allowance before leaving live view running.
Where HikGrid fits
HikGrid (our app) gives you live view, playback, recording search and footage download for Hikvision and HiLook recorders, in one native Mac window. Behind CGNAT, sign in with Hik-Connect, or connect by local IP over a VPN or Tailscale. It runs natively on Apple silicon and Intel Macs with macOS 13 or later, and it can show several sites, such as home and a remote 4G site, in one window. Check your recorder on HikGrid's compatibility page.
Remote cameras on Starlink or 4G? View them from your Mac. HikGrid (our app) gives you live view, playback, recording search and footage download in one native macOS window. Sign in with Hik-Connect, with no port forwarding. It runs natively on Apple silicon and Intel Macs (macOS 13 Ventura or later) and costs £39.95 one-time per Mac, with new features included and no subscription.
HikGrid is an independent app. It is not made by, affiliated with or endorsed by Hikvision.
FAQ
Can I port forward a Hikvision NVR on Starlink?
Not on a standard plan. Starlink says its router does not support port forwarding, and that you need a third-party router and a public IP on your Starlink service. Without those, use Hik-Connect or a Tailscale subnet router instead.
Does Hik-Connect work behind CGNAT?
Yes. The recorder connects out to Hikvision's cloud, so no port forward is needed and CGNAT doesn't block it. Hikvision limits cloud live view to 5 minutes at a time.
How do I know if my connection uses CGNAT?
Compare the WAN address on your router's status page with the address a what-is-my-IP website shows. If they differ, or the router's address is in the 100.64 to 100.127 range, you are behind CGNAT.
Can I view a Hikvision NVR on a 4G router from my Mac?
Yes. Sign in with Hik-Connect, or put a Tailscale subnet router on the same network as the recorder and connect to its local IP. HikGrid is a native Mac app for viewing Hikvision and HiLook cameras and supports both Hik-Connect and IP connections.
Is Tailscale safer than port forwarding?
Tailscale does not open any ports on your router. Only devices signed in to your own Tailscale account can reach the recorder, which avoids exposing its web server to the internet.
Sources
- Starlink support: Can I port forward with the Starlink router?
- IETF RFC 6598: shared address space for CGNAT (100.64.0.0/10)
- ModemGuides: Double NAT vs CGNAT
- Teltonika community: port forwarding with carriers using CGNAT
- IPVM: video security over 4G
- Netview: Hik-Connect setup and troubleshooting (2026)
- Hikvision: Hik-Connect P2P and DDNS service datasheet
- Hikvision USA support: 5-minute Hik-Connect timeout
- Tailscale: subnet routers
- Tailscale: install on an Apple TV
- Tailscale: remotely access devices that can't run Tailscale
- use-IP forum: Hik-Connect works, IPv6 does not, on a CGNAT 4G router
- HikGrid: compatibility page