Has anyone been able to successfully self host behind a CGNAT without using third party services? reddit / selfhosted ---------------------------------------------------------------------- mpcabete · 2023-10-05 15:26 I have been looking for solutions to access some services hosted on my network remotely for a while, but have not found a good solution yet other than host a vpn server or a reverse proxy in the cloud, which I am not a fan of. I have had partial success using IPV6, but a lot of ISPs does not support IPV6 yet, so when accessing my services from one of these ISP's it doesn't work. ---------------------------------------------------------------------- JeremyMcFake · 2023-10-05 15:53 Are you completely saying no to third party services? I'm not sure of another way without using one when it comes to CGNAT, and potentially a dynamic IP? ---------------------------------------------------------------------- thekrautboy · 2023-10-05 16:13 Nope. ---------------------------------------------------------------------- Bent01 · 2023-10-05 16:35 Probably not possible. Cloudflare Tunnel solves that though. ---------------------------------------------------------------------- RushTfe · 2023-10-05 16:40 I guess you already did, but just in case, you can ask your isp to take you out of the cgnat. Depending on the isp it will alow you or not. But doing a call and finding out is worth the 55 minutes of waiting listening the same song. ---------------------------------------------------------------------- magic-pangolin · 2023-10-05 16:47 I'm having the same issue, and the only way I found to expose some services on the internet is with a cloudflare tunnel But if you find something better let me know, I'm very interested! ---------------------------------------------------------------------- certuna · 2023-10-05 16:58 UDP hole punching (which you'll need to traverse NAT) always requires a 3rd party server to do the matchmaking, so Zerotier/Tailscale/etc will always require a third root server - but if that server is yours, you can use those apps without any 3rd party involvement. In the end the solution is IPv6 but as you say, not all ISPs have that yet. What you can do, is route only your IPv4 over a 3rd party (Cloudflare, or a rented VPS for example) and have everything with IPv6 go direct. ---------------------------------------------------------------------- AmateursPls · 2023-10-05 17:42 Cloudflare Tunnel is the only solution that allows you to host in the traditional sense without requiring your users to have some sort of VPN/wireshark client installed to their device. And it works well. Really well. ---------------------------------------------------------------------- ismaelgokufox · 2023-10-05 18:15 Hey, you could always use a Raspberry Pi or NUC in a friend’s house that is outside of your CGNAT. Use that as a VPS. That way you keep complete control of the connection in a “first- party” way. ---------------------------------------------------------------------- tillybowman · 2023-10-05 18:31 one thing you can do: get a free oracle and host a rathole docker there. ---------------------------------------------------------------------- hdddanbrown · 2023-10-05 18:39 And Oracle isnt a third party? ---------------------------------------------------------------------- simpleFr4nk · 2023-10-05 18:49 I personally used tailscale, simple reverse proxy with rathole and chose to go with headscale (open source control server for tailscale). With every iteration I was having authelia and crowdsec to block every malevolent access and have some level‘security’ with 2FA. Now this is indeed using third party services as you need to have a vps and being able to control and spin up this services without problems. It’s indeed more intimidating than just Cloudflare Tunnel that can help you with all of this, but you don’t learn much and they simply have control over your traffic. I’ll look into them in the future :) ---------------------------------------------------------------------- wallacebrf · 2023-10-05 19:12 i believe you can do one better. if you use cloud flare, you can have everything proxy to the IPV6 address your device has, so even IPv4 will work, they will first connect to cloudfaire servers and be proxied to the IPv6 invisibly. ---------------------------------------------------------------------- certuna · 2023-10-05 19:14 Yes you can also proxy IPv6 via Cloudflare as well, but I suppose OP wants to run as little traffic through 3rd parties as possible. ---------------------------------------------------------------------- GolemancerVekk · 2023-10-05 19:18 Also see if they offer a paid service that accomplishes that, sometimes they don't refer to it as "disabling CGNAT". It could be presented as a service to rent a public IP, or some form of Dynamic DNS. ---------------------------------------------------------------------- querylab · 2023-10-05 19:26 If you can do it I use Wireguard and a VPS on Amazon you can use other DigitalOcean, Linode, Oracle It works for everyone I use this https://github.com/mochman/Bypass\_CGNAT ---------------------------------------------------------------------- readit-on-reddit · 2023-10-05 19:28 Nope, you can rent a VPS and route everything through it. The VPS is the WG server and OP's LAN servers need to be WG clients. The actual WAN clients (everyone else) just sees the VPS public IP and everything will work as normal. The benefit of this is that it's portable and doesn't depend on a single company (you can use any VPS provider). ---------------------------------------------------------------------- tillybowman · 2023-10-05 19:28 sure it isn’t. but it’s vendor independent and the vendor is not able to see what you are doing. that is the maximum you can do here. if the service fails, it’s easy to move on. ---------------------------------------------------------------------- talent_deprived · 2023-10-05 19:55 If AT&T Fiber uses CGNAT, then yes. ---------------------------------------------------------------------- PaulEngineer-89 · 2023-10-05 20:01 One thing to consider…does it matter? Any traffic to/from anywhere is crossing any number of third party internets. That’s really the whole point of the internet. All traffic is going to pass through your ISP. I mean what is the point whether it gets routed to a third party or not? The question is whether doing so leaks any information and if so, does it matter. Take Tailscale for instance. It implements end to end encryption. SSL packets pass through while still encrypted. The packets route directly to your ISP’s IP (with CGNAT) or to your IP if you didn’t have to traverse CGNAT. Worst case they may hit a DERPS tcp but again, just passing through. At your host they can optionally be decrypted by Tailscale before passing to your service, or not. So really it doesn’t matter even if Tailscale is involved. You don’t have to trust them. This is very different from Cloudflare where there is the client- Cloudflare and Cloudflare-server connection. The advantage for you is anonymity. The downside is clear text within Cloudflare. So even if a third party isn’t involved it doesn’t get you anything. ---------------------------------------------------------------------- jeffxt · 2023-10-05 20:05 How is that? ---------------------------------------------------------------------- talent_deprived · 2023-10-05 20:15 I was answering the OP's question providing ATT Fiber uses CGNAT, I don't know if they do, but I use a public VPS (at Oracle Cloud, Always Free) running Wierguard, acting as a "server". I have my old laptop which runs my QEMU VM which hosts my personal sites and email and it has Wireguard so it's the "client". On the "server" I have iptables commands in my Wierguard configuration which routes my desired ports over the tunnel to the VM inside the laptop. IOW, the same configuration I've used with AWS Lightsail and I'm sure would work with any cloud ISP. ---------------------------------------------------------------------- Vogete · 2023-10-05 20:17 Provided you have a friend that's not behind CGNAT ---------------------------------------------------------------------- thekrautboy · 2023-10-05 20:17 Youre right, *some* third party is always involved. But the point is to have as few involved as possible and keeping as much control in the users hands as possible. Selfhosting. ---------------------------------------------------------------------- thekrautboy · 2023-10-05 20:20 Provided you have any friend at all. ---------------------------------------------------------------------- ismaelgokufox · 2023-10-05 20:20 Edited the response to reflect it explicitly. Thanks. ---------------------------------------------------------------------- jeffxt · 2023-10-05 20:21 Ahh got it, that makes sense, thanks for the context! ---------------------------------------------------------------------- Vogete · 2023-10-05 20:21 \*Sad alone noises\* ---------------------------------------------------------------------- thekrautboy · 2023-10-05 20:22 I would consider that friend a third party just as much as a rented VPS at some provider. Sure you might trust that friend more, but its still a third party that is involved. ---------------------------------------------------------------------- talent_deprived · 2023-10-05 20:39 I mis-read the question originally. I don't know why someone would open their home to the world. Are you saying you want to open your home to the public Internet? And if so, on top of that, you actually want to use the anti-privacy IPv6 to do it? Why on Earth would you want to do either of those things? ---------------------------------------------------------------------- ithakaa · 2023-10-05 20:54 Without a third party you have a very secure LAN that's inaccessible from outside, enjoy it ---------------------------------------------------------------------- PaulEngineer-89 · 2023-10-05 21:20 I did not say self hosting itself is a bad idea, far from it. That’s an entirely different issue. Just that specific services are not inherently bad, even without dealing with CGNAT. I mean if you don’t want public access at all overlay networks are a very simple solution. At the basic software level you have your own IPs, possibly ACLs, DNS. It’s just a logical extension of a LAN to a WAN. It can be entirely peered but if you have to deal with CGNAT, STUN is necessary, and overlay networks hide the ugly details. And if you do want public access and CGNAT is an issue you need to use some public server (VPS or public service). ---------------------------------------------------------------------- mpcabete · 2023-10-05 21:26 Can this be set up on the domain level? So the ipv6 domain point to my computer and the ipv4 to the cloudflare tunnel? ---------------------------------------------------------------------- thekrautboy · 2023-10-05 21:29 I was mostly responding to your question > One thing to consider…does it matter? Yes, it does matter. Atleast to most people around here. ---------------------------------------------------------------------- mpcabete · 2023-10-05 21:29 I have already checked, they offer a static IP as a service, for the triple the price of a CGNAT plan 🙃 ---------------------------------------------------------------------- thekrautboy · 2023-10-05 21:31 `A` record points to IPv4 address. `AAAA` record points to IPv6 address. ---------------------------------------------------------------------- mpcabete · 2023-10-05 21:31 Yeah, learning in the process of setting things up is the main reason I do this stuff, thanks for the tips 😉 very intrigued about rathole, no idea how it works, I will do some research into it ---------------------------------------------------------------------- mpcabete · 2023-10-05 21:33 Can you point me towards some resources about the ipv6 privacy issue? ---------------------------------------------------------------------- revereddesecration · 2023-10-05 22:27 If you run a tiny server on the cloud and point your domain at it then tunnel your traffic through VPN that you host to your own server at home, you get the best of all worlds for minimal cost. That’s what I do. ---------------------------------------------------------------------- PaulEngineer-89 · 2023-10-05 22:31 And that’s my point. Remember I was self hosting things in the mix 1990s. Back when you ran it on a software system called ka9q on MS-DOS or on the few public BSD servers. We had open telnet on port 23. SSH was years away. Yes I agree that the way Cloudflare does it is a bit of an issue in that there’s a trust factor because your data is unboxed at their edge servers. It’s one thing if you run a public web server with 100% public data, but quite another to transfer security data. It’s even more of a concern (or reality) with their CDN, and they are one of the largest CDNs. So somewhere in here as a network service provider that sort of thing would destroy them if it ever became an issue. But still the risk, however infinitesimal, is there. Tailscale and similar ngrok-like systems have full end to end encryption (no unboxing halfway) so no trust is placed on the server network except for coordination. While I like the idea of getting back to old school where I had one or more public IPs and sat more or less directly on the internet, with CGNAT that’s just not possible. And after enjoying it with my last ISP and wishing my current one wasn’t so IPV6-stupid (not supported), as are many others, after resisting it I’m finding that private networking dies what I want and is simpler and secure, ---------------------------------------------------------------------- GenuineSelfLoathing · 2023-10-06 00:52 Use cloudflare zero trust tunnels. ---------------------------------------------------------------------- AmateursPls · 2023-10-06 01:12 Ahhh yes, very nice. I did mean (and forgot to explicitly specify) only free option, but yes that is a good solution too, and you could technically even use the AWS or Google free tier for the task although it would get burned quite quickly for any task requiring any actual bandwidth use at all. ---------------------------------------------------------------------- trigrhappy · 2023-10-06 01:14 Either a VPN with port forwarding to VPN into your network with...... or tailscale. Either way requires a 3rd party service, sorry. If you had a really really good friend who wasn't being a cgnat, you could do a site to site VPN with him as the host and you as the client. He'd just need a ddns. It's possible that way, but no matter what you're going to need 3rd party help. ---------------------------------------------------------------------- FierceDeity_ · 2023-10-06 02:31 Even if you use another service to tunnel through, that service still ain't gonna be a liability to you, they still don't see anything. And with how many governmrnts your connection passes through potentially record your data as it passes through, the only thing you can do really is... encrypt, encrypt, encrypt. look into post quantum crypto, etc. i think a dependency that can be easily replaced is okay to have ---------------------------------------------------------------------- FierceDeity_ · 2023-10-06 02:36 tbf ssh is technically made in 1995, and we used such stuff as rlogin before... also, in the 90s governments didn't try to blanket record all our conversations or what everyone sends through the internet, heh. but i agree, with end to end encryption, you dont trust an additional party that much, you just use them as a bridge, one that is always replacable. but they do get some Metadata like who wants to connect to your server in the end, so it's not competency safe when it comes to data ---------------------------------------------------------------------- certuna · 2023-10-06 05:17 Yes exactly, that’s how it works. You set the A record to point to Cloudflare’s reverse proxy, AAAA record points to your server directly. ---------------------------------------------------------------------- TheCaptain53 · 2023-10-06 06:15 >The VPS is the WG server and OP's LAN servers need to be WG clients. Alternatively, the home router could use wireguard to send all traffic (or select traffic) through a single wireguard tunnel. ---------------------------------------------------------------------- GolemancerVekk · 2023-10-06 08:15 Yeah unfortunately the static part makes it expensive and tends to be seen as a business offer. That's the solution if you don't want to resort to third party services, only alternative would be to see if you can find a competing ISP. ---------------------------------------------------------------------- Dagger0 · 2023-10-06 08:29 v6 isn't anti-privacy. If you use SLAAC and don't use privacy extensions or RFC7217, then your MAC address gets used as the host part of your v6 address. But most OSs have one or the other, or both, of those two things turned on by default today. ---------------------------------------------------------------------- Dagger0 · 2023-10-06 10:36 Or you could just use no tunnel at all. Run a reverse proxy on the VPS and have it connect back to the server over the Internet as normal. The CGNAT is only an issue if you insist on doing the backend connection over v4. ---------------------------------------------------------------------- readit-on-reddit · 2023-10-06 11:36 What? So an IPv4 connection to the VPS reverse proxy gets converted to IPv6 to the actual LAN server? ---------------------------------------------------------------------- Dagger0 · 2023-10-06 14:35 For a reverse proxy it's two separate connections, but roughly yes. There's no need for the frontend and backend connections to be the same IP family. ---------------------------------------------------------------------- joecool42069 · 2023-10-06 14:56 You have to use a 3rd party to get past the nat, if you want to expose services to the internet. This can be as simple as a low powered VPS in a cloud, with a wirguard tunnel back to your home. Your home initiates the witegiard tunnel to punch through the CGN, then use iptables to port forward on that VPS over the witeguard tunnel. You just gotta understand how routing works in your particular setup. ---------------------------------------------------------------------- xdocx · 2023-10-06 15:29 Sure cloudflare tunnel saves the day ---------------------------------------------------------------------- mpcabete · 2023-10-06 15:31 Will the client connecting to the service prioritize ipv6 by default? ---------------------------------------------------------------------- certuna · 2023-10-06 16:23 Yep. ---------------------------------------------------------------------- haaiiychii · 2023-10-06 19:23 Have you contacted your ISP to ask about buying a Static IP? I asked and they charge £5 a month, totally worth it for my use case. ---------------------------------------------------------------------- desqviewX · 2023-10-07 19:05 Yes, but it heavily depends on how your provider has CGNAT configured and whether or not they allow you to any sort of control over the gateway device. Mine did and I could put a single IP into a "DMZ" - which was my firewall. However, then everything was behind "Double NAT" which my kids gam consoles screamed bloody murder about. Luckily, our primary fiber provider offers the ability to pay for a static IP, which also conveniently removes you from behind CGNAT. So we do that now. If they didn't, I'd have a dual-VPS gateway setup that uses keepalived for an HA IP to bypass it. ---------------------------------------------------------------------- desqviewX · 2023-10-07 19:06 > One thing to consider…does it matter? CGNAT can be bad because you can't forward ports to host internal services in most cases and it breaks a lot of multiplayer games. Your device doesn't get a dedicated public IP, you share a dedicated public IP with a huge group of users, and your gateway gets a private IP.