Trying to get my website out to the world through a tunnel but do not want to use cloudflared as i host my email as well. reddit / selfhosted ---------------------------------------------------------------------- Prevail90 · 2023-12-18 13:40 I am behind a cgnat, tried the opensource is awesome fractal gateway and i cant get my server to build the link to the host i built in the cloud. ---------------------------------------------------------------------- madroots2 · 2023-12-18 15:02 I recommend caddy proxy. very simple to setup and it just works. then use firewall (Cloudflare WAF etc) to secure your website and block off crap countries ---------------------------------------------------------------------- Prevail90 · 2023-12-18 15:28 Sorry i forgot to say its behind a cgnat. ---------------------------------------------------------------------- ericesev · 2023-12-18 16:24 Setup a SSH connection to a Linux VPS/VM hosted on a cloud provider. Use reverse SSH tunnels for ports 25, 80, 443. The autossh utility can be used to restart the tunnel should it get disconnected. ---------------------------------------------------------------------- Lanky_Information825 · 2023-12-18 16:39 Wireguard all in one script, basically one command and your done - perfectly tuned to work with cgnat client btw ---------------------------------------------------------------------- Prevail90 · 2023-12-18 19:23 Please elaborate. I am super new to this. I used to use cloudflare but i had issues with what i needed. ---------------------------------------------------------------------- cleveradmin · 2023-12-18 19:43 I just did this to expose my Immich instance to the 'net. Tailscale on both endpoints and then use Nginx Proxy Manager on the cloud host and point to the Tailscale IP/port of your web server. Works great. If you want to go full selfhosted, you'll need to setup Headscale to replace the reliance on Tailscale infrastructure. ---------------------------------------------------------------------- Prevail90 · 2023-12-18 19:59 I use tailscale on my other server which is my private family server but this one is my business one. ---------------------------------------------------------------------- Prevail90 · 2023-12-18 20:09 Tell me more. Where do i go for this? ---------------------------------------------------------------------- adamshand · 2023-12-18 20:33 It should be fine to use Cloudflared to provide access to your website. I don't know what you mean by "i host my mail as well", but it shouldn't matter. If you want an open source option then Wireguard or Boring Proxy are two options. ---------------------------------------------------------------------- Prevail90 · 2023-12-18 20:49 I have a mail in a box server that is my email server for my business. If i add cloudflare's nameservers, wont that pull away from my mail in a box ---------------------------------------------------------------------- Lanky_Information825 · 2023-12-18 23:21 Happy to oblige! The script can be found here; [https://github.com/complexorganizations/wireguard- manager](https://github.com/complexorganizations/wireguard-manager) And is as straight forward as can be, here is an superficial rundown of the process; 1. Install the Wireguard script on your VPN Server(tunnel) 2. Install Wireguard on the VPN client And that's it, you should have a working tunnel! Now to be fair, there may or may not be intermittent steps with this, depending on your use case, and the VPN Server conditions - though that is essentially it for this particular approach(Wireguard VPN), making it very, very simple to use. NB. you can test the VPN tunnel/connectivity by taking-down and putting up the VPN connection on the client(w/sudo wg-quick up wg0), and checking external IP w/(curl [ifconfig.me](https://ifconfig.me)). \- hope this helps, and don't hesitate to ask, if you have any questions with regard to implementation - ie, CGNAT will likely require forwarding a few ports to carry-over basic web services such as an http server etc, etc. ---------------------------------------------------------------------- adamshand · 2023-12-19 05:56 If you want to use cloudflared then you must use Cloudflare for DNS for your domain. But there shouldn't be any problem using Cloudflare DNS with mail-in-a-box. ---------------------------------------------------------------------- ericesev · 2023-12-19 07:10 There is a pretty good tutorial here: https://www.jeffgeerling.com/blog/2022/ssh-and-http-raspberry-pi- behind-cg-nat ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-12-19 11:12 How about use [zrok.io](https://zrok.io)? Its open source and has a free SaaS. It will build an outbound connection from your network, punching through CGNAT, so that you can host your website. ---------------------------------------------------------------------- Prevail90 · 2023-12-19 14:48 What do you mean? ---------------------------------------------------------------------- Prevail90 · 2023-12-19 23:50 I got something working but when I go to the ip address or even the url i have linked to that ipaddress, it fails to go through the tunnel. ---------------------------------------------------------------------- Lanky_Information825 · 2023-12-20 00:19 Here's how I normally set the stage to troubleshoot a WG VPN tunnel; 1. Test/confirm ping, both ways, using WG up address - ie, ping VPN Server fr. client using WG IP address, and vice-versa 2. Test/confirm ping from VPN server to outside world - self- explanatory, though I cannot count the number of times a basic config was in the way 3. Test/confirm ping from VPN client to outside world That said, and in most cases, one of these will expose the culprit. Though beyond this and assuming all of these work as intended, I then turn my attention to port forwarding and ip table rules - for CGNAT that is \- hope this helps PS. if this doesn't help, we might do an RT chat to work through it - most WG VPN tunnels issues are relatively easy to fix ---------------------------------------------------------------------- Prevail90 · 2023-12-20 00:52 yea we might need to do that. i am running through the steps and i think i am either getting them backwards or i am doing them correctly but no luck ---------------------------------------------------------------------- Lanky_Information825 · 2023-12-20 01:35 invite sent ---------------------------------------------------------------------- Prevail90 · 2023-12-20 02:44 can you elaborate? ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-12-20 10:12 You want to host your website but are behind CGNAT. So you need a solution that allows you to build an outbound connection and have a publicly routable DNS. [zrok.io](https://zrok.io) can provide this, protected by zrok frontdoor - [https://docs.zrok.io/docs/guides/frontd oor/](https://docs.zrok.io/docs/guides/frontdoor/). If you want to bring your own DNS, you will have to self-host. If you are fine with a zrok URL (most of it you can custom name), then use free zrok SaaS. ---------------------------------------------------------------------- Prevail90 · 2023-12-21 00:55 I like the idea of this, but i need to use my url. and does it play nice with nginx proxy manager if I have that on my server in the house? ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-12-21 09:08 I actually dont know the answer to that... but zrok has Caddy embedded inside it so I am not sure if nginx is required too - [https://www.red dit.com/r/selfhosted/comments/16bn6ob/weve\_embedded\_caddy\_in\_zrok\ _office\_hours\_video/](https://www.reddit.com/r/selfhosted/comments/1 6bn6ob/weve_embedded_caddy_in_zrok_office_hours_video/) ​ If you self-host zrok you can use your own URL.