Carrier grade NAT (Score 1)

CGN or as I like to call it Internet-Cancer, SUCKS! There is no way to "call-in". The only way to access your hardware is through 3rd party services such as Teamviewer(which I highly recommend) or LogMeIn. This however isn't you logging in to your stuff, you meet by a proxy that is a Teamviewer server, and then establish a direct connection. Teamviewer also has some plugins which let you establish a VPN to the network that the Teamviewer server is connected to. Another solution is to have a Cisco router connected to the CGN'd internet connection, and have the router automatically VPN (I personally use Cisco's DMVPN technology ) to another internet connection that you DO have access to. An example would be an employee's router that VPNs to HQ. If they VPN'd properly establishes the connection to HQ the IT guys can then SSH,FTP or whatever into the employee's house. They are not connecting directly, but through the VPN from HQ. With some sneaky NATting and routing you can achieve an effect that is very similar to having direct access from the internet to the inside a CGN'd network.