I need to setup a following configuration:

A router Mikrotik is connected to the internal Network1. The router has a USB 3G modem that is connected to it and enables internet access from the internal network (NAT). That works pretty well.

I want to be able to connect to the internal Network1 from the Internet for remote access to some services in Network1, but I am not able to set up any port forwarding since all of the incoming traffic from the outside is blocked by ISP.

I thought about two other solutions to enable such remote access:

  1. Setup a VPN server on Mikrotik router, so that clients could connect to the VPN and have access to Network1. The problem here is that the vpn server would be unreachable from the Internet since all the incoming traffic is blocked by the ISP.

  2. Connect to an external VPN server on Mikrotik router, and connect any clients that want to have access to Network1 to the same external VPN.

So my question is: is option 2 actually doable? Is there any other option to allow remote access to the Network if ISP is blocking all the incoming traffic and disallow any port forwarding?

Please assume that Mikrotik router has a public IP and don't mind the firewall policies.


  • Unfortunately, questions about home networking and consumer-grade devices are explicitly off-topic here. You could try to ask this question on Super User.
    – Ron Maupin
    May 11 '19 at 13:22

all of the incoming traffic from the outside is blocked by ISP

That is a major problem. An "Internet connection" commonly implies that it's possible to accept incoming connections as well.

You will need an additional relay. Your option 2 is exactly that: create a VPN connection to the relay and let your clients connect to that.

We generally use this approach for client VPN: clients connect to the headquarter and are routed via VPN to their branch location's servers. That reduces administrative overhead and exposure of branch routers, yet increases latency.

Not the answer you're looking for? Browse other questions tagged or ask your own question.