Self-Hosting Behind CGNAT

In the era of limited IPv4 addresses, self-hosting has become more complex. Routers now share the same IP within a neighborhood through carrier-grade NAT (CGNAT), where private addresses are translated by the carrier's network. This prevents traditional port forwarding from working. The author in the story runs their services on a mid-range machine at their mother's basement in northern Spain, using a cheap VPS bridge in a French data center to expose their services to the internet.

To achieve this, the author set up a bidirectional WireGuard tunnel. WireGuard, a fast, modern, and secure VPN tunnel, lives inside the Linux kernel. The tunnel forwards all packets in all ports from the bridge to the homelab box and vice versa. The tunnel is initiated by the homelab, so a static dedicated IP is not required at home. However, using a bridge adds 39 ms of RTT (Round Trip Time) latency.

The author provides instructions on setting up the bridge and configuring NAT and forwarding rules at the kernel level. Excluded ports include 2222 for SSH and 51820 for the VPN tunnel itself. All traffic is forwarded to the homelab, with the destination rewritten but not the source, allowing the homelab to see the real client IPs. Replies from the homelab are sent back down the tunnel.

The homelab's configuration is stored in the author's homelab repository. Replies from the homelab travel back through the bridge, while the homelab's own traffic remains on the home router. SSH connections to ssh.alvarezrosa.com on port 22 now land on the homelab, while port 2222 on the bridge serves a specific purpose. The author's mailing list remains free, occasional, and covers various topics, with a promise not to sell or share subscriber email addresses. Feedback can be sent to david@alvarezrosa.com.