Self-Hosting Behind Cgnat
11 hours ago
- CGNAT (carrier-grade NAT) prevents traditional port forwarding for self-hosting as multiple users share a single public IP.
- A solution uses a cheap VPS as a bridge, forming a WireGuard tunnel initiated from the homelab to bypass CGNAT.
- The bridge forwards all incoming traffic to the homelab via the tunnel, while the homelab uses policy routing to send replies back through the tunnel.
- Configuration involves iptables NAT rules on the bridge and specific WireGuard interface settings on the homelab.
- Resilience measures include a cronjob to reboot the homelab on SSH failure, a backup entry point (e.g., Cloudflare tunnel), and automatic tunnel re-handshake.