You can't reach the router because nobody can reach it: with CGNAT, satellite backhaul, or a 4G/5G uplink, your MikroTik sits behind an IP address that's shared with hundreds of other subscribers and isn't routable from the internet. Port forwarding doesn't help — there's no public port to forward on your side, because your ISP owns it, not you. Calling your ISP to ask for a public IP is sometimes possible, but usually costs extra, takes days, and can change again on the next outage.
Flip the direction of the connection
Since nothing can connect in, the router has to connect out. That means you need one thing with a real public IP for it to connect to — the cheapest option is a small VPS (a $5/month instance from any provider works fine for this).
Set up WireGuard on the VPS
/interface wireguard add name=wg-cgnat listen-port=13231
/ip address add address=10.50.0.1/24 interface=wg-cgnat(If your VPS doesn't run RouterOS, any standard WireGuard install works the same way — the router side below doesn't care what's on the other end.)
Set up WireGuard on the MikroTik behind CGNAT
/interface wireguard add name=wg-cgnat listen-port=13231
/ip address add address=10.50.0.2/24 interface=wg-cgnat
/interface wireguard peers add interface=wg-cgnat public-key="<vps-public-key>" endpoint-address=your-vps-ip endpoint-port=13231 allowed-address=10.50.0.0/24 persistent-keepalive=25sThe persistent-keepalive is what matters here: it makes the router send a packet out every 25 seconds so the CGNAT/NAT mapping on your ISP's side never expires. Without it, the tunnel silently drops after a few minutes of inactivity.
Register the router as a peer on the VPS
/interface wireguard peers add interface=wg-cgnat public-key="<router-public-key>" allowed-address=10.50.0.2/32Now the VPS has a route to 10.50.0.2 — the router — through the tunnel, and you can WinBox, SSH, or ping that address from the VPS regardless of what changes on the CGNAT side.
Lower the MTU if you stack tunnels
WireGuard already adds overhead on top of the underlying connection; if that connection is itself a tunnel (common on some satellite or 4G backhauls), the default 1420 MTU can cause fragmentation and intermittent stalls. Drop it in steps — try 1380 first — until large transfers stop hanging:
/interface wireguard set wg-cgnat mtu=1380Why do it this way
An outbound tunnel is the only approach that works reliably here, because it doesn't depend on your ISP's NAT behavior staying the same. Port forwarding, DMZ, or UPnP tricks might work for a week and then silently stop the next time your ISP reassigns the shared public IP or changes the NAT pool — with no error, just a router you suddenly can't reach. A tunnel the router itself initiates keeps working through all of that, because the router is the one deciding to connect, not waiting to be found.
How MoniTik helps
This is the exact problem MoniTik exists to solve. Instead of you running your own VPS, generating keys, and remembering the keepalive setting, MoniTik gives every router an outbound tunnel to our platform the moment you point it at us — no port forwarding, no static IP, and full remote WinBox access even when the router sits behind CGNAT, satellite internet, or a changing 4G address.
Isabela writes about the everyday MikroTik tasks that never quite make it into the official docs.