@Edge_Sangral 

Is your X50 connected to an ISP router for internet connection?    If so you have what is known as a double NAT scenario

You would therefore need to log into the ISP router and forward the same ports from the ISP router (say 192.168.1.1) to the Deco Main router (192.168.68.1)

Once forwarded to the main deco router, it will then forward again to your device.

  @Philbert 

No I'm using Internet directly from the X50 5G, nothing in between, this works as our router currently.

So in theory it should simply work then?

  @David-TP 

It seems that my carrier, Vodafone, is using that for mobile cards, yes.

So what are my options here now?

  @Edge_Sangral 

Unfortunately as its with your carrier, namely vodafone its likely out of your hands.   You could approach them asking for help with this, but its really not something you can change yourself. 

I would contact them as your first point of call

Edge_Sangral wrote

  @David-TP 

 

It seems that my carrier, Vodafone, is using that for mobile cards, yes.

 

So what are my options here now?

You might try using a VPN client, perhaps use the new firmware available with this.

You would need to subscribe to a VPN service provider, one that allows port forwarding, PureVPN, Ivacy ...

I'm trying to do the same for uTorrent myself as my ISP also uses CG-NAT but I keep seeing VPN drops, don't know why.

raven-au wrote

Edge_Sangral wrote

  @David-TP 

 

It seems that my carrier, Vodafone, is using that for mobile cards, yes.

 

So what are my options here now?

 

You might try using a VPN client, perhaps use the new firmware available with this.

You would need to subscribe to a VPN service provider, one that allows port forwarding, PureVPN, Ivacy ...

 

I'm trying to do the same for uTorrent myself as my ISP also uses CG-NAT but I keep seeing VPN drops, don't know why.

Actually  I have had difficulty when trying to port forward using a router based client VPN, I don't know if there are any VPN client apps, you might be stuck, ;(

 @Edge_Sangral another possibility you might consider is to check if you can pay a fee for a static IP or whatever they may call it.

My ISP changed to using CG-NAT and after investigation I found I could pay $5 a month for an IP (I think it's called a static IP) that isn't subject to the CG-NAT.

Then you could just leave it to UPNP to forward the ports needed.

I thought using a VPN would be better because it adds some privacy benefits but it's not the only way to resolve this.

@Edge_Sangral we are probably quite many in the same situation.

My ISP also uses CGNAT for IPv4 addressing but also provide proper (public) IPv6 addresses, maybe your ISP does that too?

Thought IPv6 would save the situation until I noticed that TP-Link doesn't (yet) support IPv6 port forwarding on the X50-5G in "4G/5G Router" mode. (apparently it is supported in regular AP mode but that really doesn't help much for someone buying a mobile broadband router and using it for that specific purpose...)
Anyway, I have added a feature request for this here
https://community.tp-link.com/en/home/forum/topic/616750

and it would be good if more people in the same situation could bring attention to the problem and provide their vote so that TP-Link firmware team adds this to their roadmap.