You set up Dynamic DNS exactly as the tutorial said. The hostname updates, the router says everything's fine — and yet you still cannot reach your router, camera or NAS from outside. You've checked port forwarding five times. Nothing is broken in your config.

Here's the truth most guides skip: DDNS cannot work on standard UK 4G and 5G SIMs, and no amount of router settings will change that. This post explains exactly why — carrier-grade NAT — how to confirm it's what's blocking you, and the one fix that reliably works: a fixed IP SIM card with a static public IPv4 address. If you want to skip straight to the solution, GleeSIM ships fixed IP SIMs same day on weekday orders before 2pm, with a 24-hour turnaround and contracts from just 30 days.

👉 Skip the workarounds — see Fixed IP SIM plans → gleesim.co.uk/collections/fixed-ip-sim

Why DDNS Fails on 4G and 5G: Carrier-Grade NAT (CGNAT)

Dynamic DNS works by pointing a hostname at your connection's public IP address and updating it whenever that address changes. On a home fibre line, your router owns a public IP, so DDNS works.

Mobile networks are different. Public IPv4 addresses are scarce, so UK operators place standard data SIMs behind carrier-grade NAT (CGNAT) — one public IP shared across thousands of connections. Your 4G router receives a private IP (typically in the 10.x.x.x or 100.64.x.x ranges). The consequences:

• Your DDNS service records the wrong address. The router reports its private IP, or the update client detects the carrier's shared public IP — which belongs to thousands of users and forwards nothing to you.
• Inbound connections are impossible. CGNAT only permits traffic out. Remote access requests from the internet are discarded at the carrier's NAT layer before they ever reach your router.
• Port forwarding does nothing. Your router faithfully forwards ports — but no inbound traffic ever arrives for it to forward. This is why "port forwarding not working on 4G" and "DDNS not working on 4G" are the same problem wearing two hats.

Legacy 3G services occasionally handed out public IPs; those days are gone, and any that remain can be withdrawn without notice. On modern UK mobile networks, CGNAT is the default and DDNS is structurally impossible on a standard SIM.

How to Check if You're Behind CGNAT (60-Second Test)

1. Log into your 4G router and note the WAN IP address it reports.
2. Visit any "what is my IP" service from a device on that connection and note the public IP it shows.
3. Compare. If the two addresses differ — especially if the WAN IP starts with 10., 100.64–100.127, or 192.168. — you are behind CGNAT. DDNS and inbound port forwarding will not work, no matter how they're configured.

If the addresses match, congratulations — you're one of the rare exceptions, and it can still be revoked at the carrier's discretion. For anything business-critical, that's not a foundation.

The Workarounds — and Why They Fall Short

Manufacturer P2P/cloud relays (Hik-Connect, etc.). Traffic detours through third-party servers: added latency, throttled streams, vendor lock-in, and outages you can't control. Fine for a doorbell; unacceptable for professional CCTV, POS or industrial kit.

VPN tunnels via a cloud server. Renting a VPS, running WireGuard/OpenVPN, and tunnelling out works — if you enjoy maintaining a server, patching it, and debugging tunnels at 11pm. You've replaced one point of failure with three.

Tailscale/ZeroTier overlays. Genuinely clever for personal use, but they require client software on every accessing device, corporate IT approval, and still depend on third-party coordination servers. Monitoring stations and payment processors can't whitelist them.

Asking your carrier for a public IP. Consumer and standard business SIMs don't offer it; where a bolt-on exists it's typically dynamic, undocumented, or enterprise-contract-only with a 12–24 month term attached.

Every workaround shares the same flaw: it engineers around the missing public IP instead of simply having one.