T-Mobile Home Internet Double-NAT

Server Version#: 1.21.1.3830
Player Version#:

I had Plex accessible from outside my home network previously on Spectrum internet. I switched to T-Mobile Home Internet, and I have not yet been able to reach the server from remote.

I turned on UPnP from the gateway dashboard. I set up a virtual network to forward anything on port 32400 to the static IP I have set for my Plex server machine, which is hard wired into the T-Mobile modem/router box.

T-Mobile Home Internet does not allow traditional port forwarding as it is effectively a mobile hotspot, but I assumed the NAT forwarding through a virtual server to the appropriate port would accomplish the same thing.

I keep getting a notice in Plex that a double-NAT scenario has been detected, but I can’t determine anything else I could do. The Plex troubleshooting remote access page says to try bridge mode, which I can’t tell if T-Mobile supports, but I did disable both 2.4 and 5 GHz WiFi networks, and it did not fix the issue.

Is there anything else I could do? Has anyone else experienced this issue?

1 Like

The WAN has a different IP from the LAN, but I can’t specify a virtual server to route any external traffic to the WAN IP. I can only route traffic to the LAN IP range.

Most cellular systems (even ones designed for home) use a system called CGNAT where your public IP is not actually public but NAT’ed through their own system. This is causing the double NAT you see. There is no way around this.

1 Like

So by “no way around this” do you mean that there is no way to configure Plex for remote access with T-Mobile’s home internet service then?

Isn’t there something that Plex can do to make it work with the limitations of CGNAT?

Yes, you can use Plex’s built in relay connection. But there is no way to create a direct connection between your clients and your server.

2 Likes

Does Plex have any plans to make an option to allow this type of traffic without using the relay connection? (Reduced quality)

Not sure what you mean. Using the relay connection is the only way to make this work when you have a double NAT that can’t be resolved,

Please see the question from cpalenshus and my question. Does Plex have any plans to over-come the limitations of CGNAT so users with cellular home internet service (Verizon, AT&T, T-Mobile, etc) can allow for remote access? The relay service is a great idea, but the reduced quality is less than appealing. Are there any other known services (non-Plex provided) that can over-come this CGNAT issue? I have tried a VPN service, no dice; I have tried “Custom Server Access URL’s”, flop; I have tried DDNS, nope. none of those options are currently working for me.

Any suggestions on what I can try next?

It is not possible to overcome CGNAT. It’s a network limitation.

1 Like

For those that are interested, I was successful in making my Plex server externally available whilst on a T-Mobile Home Internet connection. This process should also work in any CGNAT situation (Double NAT).

I downloaded on my Ubuntu box hosting my Plex server the app call NGROK (ngrok.com)

I created a free account, downloaded the “app”, started a TCP tunnel to NGROK over port 32400, identified the IP my custom URL was resolving to, and put that in my Custom Server URL Access field on the Network tab. The below two links have some great instructions and also identify the limitations of the free service. I am not an authority on this service, but was able to make it work in my own situation.

I hope this helps anyone looking to overcome the CGNAT configuration.

I’m not positive but that looks like it’s doing the same thing as Plex’s relay service, but through a 3rd party. Be careful using that, it looks to me like you have to provide your authentication token to access your server, which could give away access to your server.

CG-NAT is not something you can overcome. The only thing they can do is relay through their servers, and that’s exactly what Plex Relay is.

However, if you have IPv6 on your T-Mobile connection, that has no NAT and you can have remote access. For some reason you have to set this up manually. Bear in mind though, the clients also have to be on IPv6 in that case.

Not true. It can be overcome using your own relay but you’ll need a Linux vm in the cloud to do it. Most don’t want the additional expenses because they’re trying to save money. However if you’re like me and hate the cable company it works quite well. Just create a forwarded SSH tunnel and set up a vip with your favorite dns service to find your cloudbox. SSL secure it for extra credit.

That’s indeed badly worded of me, you can indeed pay someone else and relay your internet connection through them with VPN/SSH tunnels, but that’s not something that Plex can do to overcome CG-NAT.

This blog post describes some of the complexities really well.

How NAT traversal works · Tailscale

Many of the described techniques aren’t really feasible for Plex. TVs and set-top boxes don’t allow raw network access.


If it’s an option for you, I think you’d be better off running a Plex server on a VPS (or similar) instead of using a complicated 3rd-party relay.

CG-NAT is fortunately a temporary problem, most residential connections already have IPv6 and over the next couple of years it will be near universal. That’s no consolation for people wrestling with it now of course, but at least the end is in sight.

2 Likes

@myst, are these the steps that you followed to create a Virtual Server?

Tutorials | T-Mobile Support

It’s a little bit weird for T-Mobile to offer that setting, if they are using CGNAT.

Is the T-Mobile LTE Wi-Fi Gateway the only networking equipment that you are using?

I did try that, but I’ve read in some other forums that the setting doesn’t actually do anything. Perhaps it was intended to be implemented later.

I do have a NETGEAR Nighthawk AC1900 with most devices in my home signed onto that, but I have the PMS machine hard wired to the T-Mobile modem.

Yes, agreed. I see some of those comments when I search.

And it makes sense that they’re using CGNAT. I would expect them to be using CGNAT.

It’s just … lame … that their equipment and documentation offers functionality that the service doesn’t really support.

Oh, I agree. I thought for sure that if they offered a setting for it, that it would be functional.

Maybe they didn’t expect people to go digging into the more advanced functionality? It seems like they would’ve taken the setting out if it doesn’t actually do anything.