If your ISP puts you behind carrier-grade NAT, port forwarding stops working. The public address belongs to the carrier and your router only has a private one, so there is nothing to forward to. You can rent a public address from the ISP, or you can put a cheap VPS in the path.

The shape of it

David Álvarez Rosa runs his services on a machine in his mother’s basement in northern Spain and exposes them through a small VPS in a French datacenter. A WireGuard tunnel carries every port in both directions, and it is brought up from home, which is what makes it work without a static IP. He puts the alternative at around 20 euros a month in Spain if you would rather buy the address.

On the bridge, the firewall rules return early for the two ports that have to stay local, the tunnel itself on 51820 and SSH on 2222, then send everything else arriving on the public interface to the home address. The destination is rewritten and the source is not, so the services still see real client addresses rather than the bridge’s.

On the home side the tunnel is configured to leave the main routing table alone. Replies are pushed down the tunnel through a separate routing table and a rule matching the tunnel address, so the homelab’s own outbound traffic still leaves through the home router while inbound requests are answered through France. A persistent keepalive stops the carrier’s NAT mapping from expiring.

What it costs

39 ms of round trip, measured. On web services that is unnoticeable. For anything interactive, measure it before you commit, because that is the price of the architecture and there is no way around it.

When it breaks

Three things can fail and he says what to do about each. The homelab box: a cronjob checks whether SSH still answers and reboots it if it does not. The bridge: keep a second way in, a Cloudflare tunnel or Tailscale straight to the homelab. The tunnel itself: a short drop re-handshakes on its own, and a long one is covered by the other two.

My read

This is the cheapest honest answer to not owning a public address, and the routing split is the part people get wrong, because a tunnel that swallows your default route takes the homelab’s own traffic out through France as well. It also leaves you with a machine outside your house that something can always reach, which is the fallback most home setups do not have.

Source: Self-Hosting Behind CGNAT