For a project I'm working on, I'll have a Raspberry Pi sitting behind a 4G LTE modem:
This modem is on AT&T's network, but regardless of the provider, unless you're willing to pay hundreds or thousands of dollars a month for a SIM with a public IP address, the Internet connection will be running behind CG-NAT.
What this means is there's no publicly routable address for the Pi—you can't access it from the public Internet, since it's only visible inside the cell network's private network.
There are a few different ways people have traditionally dealt with accessing devices running through CG-NAT connections:
- Using a VPN
- Using a one-off tool like ngrok
- Using reverse tunnels, often via SSH
And after weighing the pros and cons, I decided to go with option 3, since—for my needs—I want to have two ports open back to the Raspberry Pi: