Double NAT - DDNS - CAM


since over a week I try to get DDNS for my cam up and running.
The special situation seems to be that I am using a double nat.
Despite setting all up (of course something seems to be missing) I do not get access over the DDNS name in my browser to my cam.

Here is my config:

  1. Router 1 (from my ISP)
  1. Router 2 (openwrt, behind ISP)
  1. cam and ddns
  1. Problem:
    when I enter the DDNS address in my browser I do not get access to my cam

Any idea what I have missed?

BR Martin

  • Test this from an independent Internet connection such as a smartphone that is using cell service (wifi turned off). Accessing your own public IP from inside the LAN may not work.
  • The WAN IP held by the ISP router (your router 1) must be the same as the one registered with DDNS, and it must be publicly routable. Many ISPs use "carrier grade NAT" meaning that customers don't receive a truly public IP. Incoming connections are not possible with CGNAT.
  • Some ISPs block incoming connections on ports 80 and 443 since customers aren't allowed to use the service to run a public web server at home. Some ISPs block all incoming connections.
  • If you do get this working, the camera will be attacked relentlessly from all corners of the Internet. It had better be really secure. It's much better to set up a private VPN for remote camera access.

Any reason for the double NAT?

The 192.168 IPs aren't public - no need to mask them, and it doesn't help us, when trying to solve your problem.

  • reason for double nat
    a, the ISP router has an integrated fiber optic modem (my routers do not)
    b, the router os seems to modified by the ISP and I expect a lot of effort to configure my own router as required (after buying a router with a suitable modem - what I do not want to do)

  • 192.168.
    ok I will update

  • test with smartphone (wifi turned off) delivers the same result, no connection/access
  • the WAN IP of router 1 is different to the DDNS; the cam has a DDNS function which I have activated and it seems that the cam could contact the DDNS provider (on the DDNS provider page I can see that the address has been updated).
  • I have also tried this with different ports, because I read another article about this as well. Without success.
  • the access to this cam is only required for the customer service, because this one has a problem I could not solve. And the customer service will help me only when I provide DDNS access to the camera. I do not want to give the VPN access to my network and based on the answers I received from them so far, they are no interest in setting up a VPN connection for my service request. After this the DDNS access will be closed.

This is a big problem. Does that WAN IP start with 10., 100., or 192.0? Those would mean you have CGNAT.

It will update to the external IP that the ISP is using, which is after NAT. That IP is shared by many customers, so there is no way to direct an incoming request back to a particular customer.

DDNS 1xx...
WAN IP 10...

Then you're behind a CGNAT.

First, thank you for your quick and excellent feedback!
Second, I am really p... about the customer service.
Third, any alternatives? What can I do?

Check if you get an IPv6 address, might be a way forward.

yes, router 1 has an ipv6 as well

I'm really bad with those, still using IPv4, check if it's public.

This might help Dynamic ipv6 /56 help with open ports and ddns

@mk24 might know better.

Camera would need to support IPv6. And I'm also a rank beginner with IPv6, only two days ago changing to an ISP that finally supports it.

As far as IPv4, you could rent a VPS server with a public IP, install OpenWrt (of course) on it, and use it to make a Wireguard VPN tunnel to your LAN (or a special LAN you set up that just has the camera). Then you can forward ports from the VPS' IP back to the camera.

@mk24's idea isn't bad, and you get free life time VPSes at oracle cloud, however with limited monthly traffic.

No openwrt support though, AFAIK.

the cam does not support ipv6...

that sounds like a solution but it also sounds time consuming... I will check with the customer support first. Perhaps they will surprise me?!

You could use a clouflare tunnel to bypass CGNAT or something similar.

that sounds very promising -thank you!