NATCloud FAQ — Remote Access Behind CGNAT

Yes. Built for CGNAT, double or even triple NAT. No public IP or open ports required.

No technical limit: start small and scale to thousands by adjusting your plan.

End-to-end encrypted tunnel with authentication and per-user control—no direct exposure.

No. It complements TR-069: it ensures access when the ACS can’t reach the device due to NAT/blocks.

Yes, as long as they have a web interface (HTTP/HTTPS).

Yes. NATCloud provides granular access control per device and per site. To set this up, see the Site User Management guide.

The tunnel closes and auto-reconnects when the connection returns.

No. The connection starts from inside to outside, avoiding port forwarding and reducing risk.

In many cases, yes—it eliminates complex VPNs for remote support, but can coexist with them.

Any device with a web interface (HTTP or HTTPS) on the same LAN as an adopted MikroTik router — IP cameras, NAS drives, OLT controllers, managed switches, DVR systems, internal web servers, and other routers. If the device has a browser-accessible UI, NATCloud can reach it.

Connection speed depends on the upload bandwidth of the MikroTik's WAN connection, MKController's cloud infrastructure routing, and your own internet speed. For configuration tasks and monitoring dashboards, the connection is responsive even on slower links. High-bandwidth use cases (such as streaming IP camera video at high resolution) perform best on connections with at least 5 Mbps upload.

NATCloud operates over IPv4 tunnels. However, the devices you reach through NATCloud can use IPv6 internally — NATCloud accesses them by their LAN IPv4 address regardless of the upstream connectivity type.

Access to NATCloud is controlled through MKController's user and permission system. You can create a Collaborator account for a client or third party and grant them access to specific sites and devices, with full activity logging. Direct link sharing without authentication is not supported — all access requires a valid MKController login.

Multiple users can connect to the same NATCloud device simultaneously. Each connection is a separate tunnel session through MKController's infrastructure. The device itself (camera, switch, NAS) handles concurrent connections according to its own capabilities.

Yes. NATCloud is part of MKController's standard trial. Start a free trial — no credit card required — and explore NATCloud alongside all other MKController features.

Yes, as long as the MikroTik router adopted in MKController has routing or bridging access to the target VLAN. NATCloud accesses devices by their local IP address — if the MikroTik can reach that IP internally, NATCloud can forward the connection. Devices isolated in VLANs with no inter-VLAN route to the MikroTik’s management interface are not reachable through NATCloud. Adding a static route on the MikroTik that covers the target VLAN subnet is usually all that is needed to make those devices accessible.

To remove a device from NATCloud, open the site in MKController, find the device entry under NATCloud, and delete it. This removes the mapping from the platform. The underlying MikroTik device and its tunnel remain unaffected — only the NATCloud forwarding entry is removed. The MikroTik itself is only removed from MKController through the standard device removal process.