Remote access without a static IP or port forwarding

If you have ever tried to reach the computer at home or at the office, you have probably run into the same three requirements: you need a static IP, you need to set up port forwarding on the router, or you need to stand up a VPN. All three are real — but they are the requirements of one particular way of connecting, not of remote access in general.

It is worth understanding why they show up, because once you do, it becomes obvious why none of them is necessary.

What a static IP actually solves

Your public IP address is the number you can be found at on the internet. The catch is that on an ordinary home connection your provider hands it out dynamically: it can change when the router restarts, or after some interval you do not control. If someone has to connect to you, yesterday's address may not work today.

A static IP fixes that — usually for a fee, and usually only on business plans.

There is one situation, though, where even a static IP does not help. Many connections, mobile ones especially but plenty of fixed lines too, sit behind CGNAT (Carrier-Grade NAT). There you share a single public address with other subscribers, so there is simply no address of your own for anyone to call. That is not a misconfiguration — it is how the network is built.

Why older tools ask for port forwarding

Even with a public address, that address reaches your router, not your computer. The router has several devices behind it and no way to guess which one an incoming connection is meant for.

Port forwarding is the rule you write by hand to settle that question: "whatever arrives on port X, send it to computer Y". It works, but it carries three real costs:

• you need access to the router, and enough confidence to change settings there;
• the target machine needs a stable local address, or the rule will eventually point at a different device;
• you have opened a port to the internet, and from that moment its security is your problem.

The last point matters most. An open port is scanned automatically, constantly, by the entire internet.

The remote desktop feature built into Windows has exactly this requirement — what it can and cannot do is covered in Remote Desktop in Windows 11.

What changed: nobody calls in, both sides call out

Modern approaches invert the problem, and the trick is simpler than it sounds.

A router blocks connections arriving from outside, but lets through — with no configuration at all — the ones you start from inside. It has to, otherwise you could not load a web page. When you reach outward, the router briefly remembers the path and knows where to send the reply.

So instead of one computer calling the other, both reach out to an intermediary that introduces them. That server does not carry your screen; it only tells each side where the other can be found. Once they have recognised each other, the two computers open a channel directly between themselves and the server steps out of the way.

In technical terms this negotiation is called NAT traversal, and the standard mechanism for it (ICE, helped along by STUN servers) is the same one browser video calls use. If you have ever been on a video call without configuring anything on your router, you have already relied on exactly this.

The practical result: no static IP, no port forwarding, no new firewall rule.

What if a direct connection is not possible?

It happens — tightly locked-down corporate networks, some CGNAT configurations, aggressively filtering firewalls. In those cases a relay steps in: a server that simply carries the already-encrypted traffic between the two sides, without being able to read it.

Worth knowing that a relay is a fallback, not the norm. It adds latency and costs bandwidth, so any serious implementation uses it only when there is genuinely no other path.

What about the VPN?

A VPN solves a related but much broader problem: it places your computer inside the remote network, as though you were physically there. That is the right tool when you need several internal resources — file servers, printers, network applications.

For "I want to see and control one particular screen" it is far more than you need: someone still has to install, configure and maintain it, and the person at the other end gets access to an entire network when all you wanted was a single computer.

If that is precisely your situation — the work computer, reached from home — the options are laid side by side in how to connect to your office computer from home.

What still deserves a check

To be fair, "no configuration" does not mean "under any conditions":

• Local antivirus or firewall software may ask for a confirmation the first time the application runs. That is an approval, not a network configuration.
• Corporate networks sometimes block even outbound traffic to unfamiliar services. There the decision belongs to the network administrator, not to you.
• A genuinely poor connection stays a poor connection. No connection method compensates for an unstable link.

In short

A static IP, port forwarding and a VPN are answers to a question from twenty years ago: "how do I call that computer?" Today's question is a different one — "how do both sides step out to meet?" — and its answer asks nothing of your router.

If you would like to see how that looks in practice, DaniLink works exactly on the principle above: both ends reach out to the signalling server, the screen travels directly and encrypted between the computers, and the relay only comes into play when a direct connection genuinely is not possible. There is no router setting for you to touch.