NAT Traversal: IPv4 vs IPv6 Guide

Have you ever wanted to turn an old computer at home into a personal server, only to find you can’t reach it once you leave your house? This “offline when away” problem is one of the most common headaches for beginners.

The root cause: most home broadband connections give you a private IP address. To access your home devices from the outside, you need NAT traversal (also known as “hole punching” or “port forwarding”). Many people think this requires complex third‑party tools, but in fact the Internet infrastructure itself offers two “official”, zero‑cost solutions – IPv4 port forwarding and public IPv6.

This article breaks down the core logic and practical steps for both.

1. Basic Concept: Public IP vs. Private IP

• Public IP – like a unique street address for a house. Anyone in the world can send a package directly to that address.

• Private IP – like a dormitory building. All residents share the same building address. The courier can find the building, but not your specific room.

About 80% of home networks are in “dormitory mode”. Because the global pool of IPv4 addresses was exhausted in 2019, major ISPs (China Telecom, China Unicom, China Mobile) use NAT (Network Address Translation) so dozens of households share one public IP. Technically, your broadband gets an address in 100.64.0.0/10 (Carrier‑Grade NAT) – these are routable inside the ISP’s network but not on the public Internet. External devices cannot initiate connections to you.

2. Solution 1: IPv4 Port Forwarding

If you’re lucky enough to get a public IPv4 address, this is the most stable and compatible approach.

Step 1: Request a public IPv4 address

First, check if you already have one. Log into your ONT/optical modem’s admin interface (usually 192.168.1.1) and look at the WAN IP address. Then search “My IP” on Baidu or Google. If the two addresses match, you already have a public IPv4.

If they don’t match, you can request one. Call your ISP’s customer service (China Telecom 10000, China Unicom 10010, China Mobile 10086). Say: “I need to install remote surveillance cameras at home, please enable a public IP address for me.” Most agents will help. In some cases you may need to sign a letter of commitment, but generally all three major ISPs allow residential users to request a dynamic public IPv4 address.

Step 2: Set the ONT to bridge mode

By default, the optical modem also acts as a router. If the public IP lands on the modem, and you then connect your own router, you’ll have double NAT – making port forwarding extremely complicated. Ask the ISP to change the ONT to bridge mode, so your own router does the PPPoE dial‑up directly. Then the public IP will be assigned to your router, and configuration becomes straightforward.

General procedure: log into the ONT’s super‑admin account, navigate to Network → Broadband Settings, find the INTERNET connection entry, and change its “Connection Mode” from “Route” to “Bridge”.

Step 3: Set up port forwarding

Once your router holds the public IP, external packets reach the router, but the router doesn’t know which internal device should receive a request on, say, port 22. That’s what port forwarding solves.

Log into your router’s admin panel, look for “Port Forwarding” or “Virtual Server”. Add a rule: for example, forward external port 2222 to internal server 192.168.31.207 port 22. After saving, when you access your‑public‑ip:2222 from anywhere on the Internet, traffic will reach your server.

If your router doesn’t support port forwarding, or you don’t want to mess with the modem‑router chain, the next solution is much simpler.

3. Solution 2: Public IPv6 (No Application Needed – Just Enable)

If you cannot obtain a public IPv4 address, or find bridging too cumbersome, IPv6 is the easiest alternative.

Most ISPs now provide full IPv6 coverage. Every device on your home network automatically gets a public IPv6 address starting with 240. The core problem of NAT traversal – lack of a public address – is bypassed entirely. Since the second half of 2025, the number of active IPv6 connections in China has exceeded those over IPv4. Mobile 4G/5G networks also widely support IPv6. IPv6 is no longer a niche solution.

Configuration steps

1. Enable IPv6
Log into your ONT and router admin panels. In IP protocol settings, choose “IPv4/IPv6” dual‑stack mode. Enable IPv6 on your router.

Note: Some older ONTs or low‑end routers may have incomplete firmware – toggling the switch doesn’t actually allocate IPv6 addresses. In that case, the easiest fix is to bypass the ONT by using router‑only PPPoE (the bridge mode mentioned earlier works here too).

2. Verify the device has a public IPv6 address

• On the server (Linux): run ifconfig or ip addr. Look for an address starting with 240 on your network interface.

• On the client (Windows): ensure “Internet Protocol Version 6 (TCP/IPv6)” is checked in the network adapter properties.

3. Remote connection
Once you have the target device’s IPv6 address, connect directly. For example, from a computer that also has IPv6, open a terminal and type:
ssh -6 [240e:xxx:xxx::xxx] – no extra tools required.

⚠️ IPv6 Security Warning
IPv6 has a significant security trade‑off – your device ports are directly exposed to the Internet. Under IPv4 NAT, external scans cannot reach your internal devices – that’s “security by default”. With IPv6, every device has a globally unique address, and anyone can probe your ports.
Recommended measures:

• Use strong passwords for all accounts (12+ characters, mix of uppercase, lowercase, numbers, symbols).

• Enable IPv6 firewall on your router; manually create allowlist rules to permit access only from specific source IPs to specific ports.

• Regularly check system logs for unusual login attempts.

4. Advanced: DDNS (Dynamic DNS)

Both solutions above rely on one assumption: your home broadband’s public IP address does not change. Unfortunately, that’s not true – whether it’s a dynamic public IPv4 address or an IPv6 prefix assigned by the ISP, the address will change whenever the router reboots, loses power, or after a lease period expires.

Remembering a long numeric IP is hard enough; when it changes periodically, it’s impossible.

The solution is DDNS (Dynamic DNS). In short, when your home’s public IP changes, a DDNS tool automatically updates the DNS record with the new IP.

You need three things:

• A domain name (free subdomain or one you purchase).

• A DDNS client deployed on your router or a server (e.g., open‑source ddns-go).

• The client configured with your domain information and your DNS provider’s API token.

Once set up, you only need to remember a fixed address like myhome.example.com. You can reach your home machine anytime, anywhere – no more worrying about IP changes.

5. Summary

Which solution should you choose? It depends on your situation and requirements.

Overall, IPv6 + DDNS is the most future‑proof path for home users. When all conditions are met, and you open your laptop at a coffee shop, type a domain name, and see your home server’s login screen – that feeling makes all the earlier tinkering worthwhile. Give it a try!