Developer publishes guide to self-hosting behind CGNAT using WireGuard tunnel
David Alvarez Rosa documents a workaround for carrier-grade NAT by bridging a home server through a cheap VPS.
What to know
- CGNAT (carrier-grade NAT) blocks traditional port forwarding for self-hosted services; IPv4 address shortage means ISPs now share IPs across neighborhoods.
- Alvarez Rosa's solution tunnels traffic through a cheap VPS bridge using WireGuard, eliminating the need for a static IP at home while keeping expensive compute local.
- Developers debate whether VPS-bridging justifies its cost and complexity versus running services directly on a VPS, with security and storage needs as key factors.
The dispute Whether the hybrid approach of using a VPS bridge to avoid CGNAT limitations is economically or operationally justified compared to running services directly on a VPS. · positions read across 43 posts and comments
Home hosting with a VPS bridge can be worthwhile for workloads requiring significant compute or storage that cost more on a VPS.
-
“I asked myself that question years ago...and then i went to self-host Nextcloud on a VPS and realized that my storage needs outgrew what was reasonably cost-effective VPS storage…so then i moved my nextcloud instance to my homelab”
mxuribe · Lobsters ↗
Running services directly on a VPS makes more sense than paying for both a bridge VPS and home hardware.
-
“If I have to pay for a VPS anyway, why not run my services on it?”
singpolyma · Lobsters ↗
The security implications of bridging home networks require careful defense-in-depth measures to mitigate risks.
-
“But I don't really feel comfortable with a full connection between a bridge and home network. I suppose this isn't that different from exposing a server in your physical network to the internet. But it still does give people potential…”
creesch · Lobsters ↗
David Alvarez Rosa Author, software engineer
How it unfolded 2 developments, newest first · click a bar or a number to jump postscomments
-
2
Lobsters community discussion surfaces implementation concerns
The post reached Lobsters where developers engaged with the technical approach, raising questions about security, cost trade-offs, and alternative solutions. Commenters discussed whether using a VPS for the bridge made sense versus running services directly on the VPS, and surfaced security concerns about full network connections between bridge and home.
“If I have to pay for a VPS anyway, why not run my services on it?”
— singpolyma, Lobsters commenter · source -
You can pay for a very cheap VPS as a proxy and then run more expensive compute and storage locally.
2 more of the top 3 · 43 posts in this stretch
-
If I have to pay for a VPS anyway, why not run my services on it?
-
> But I don't really feel comfortable with a full connection between a bridge and home network. I suppose this isn't that different from exposing a server in your physical network to the internet. But it still does give people potential access to your entire network when something on the bridge is configured wrongly. You can practice defense in…
-
-
1
Alvarez Rosa publishes CGNAT self-hosting guide
David Alvarez Rosa published a technical article detailing how to run self-hosted services from behind carrier-grade NAT using a WireGuard tunnel to a VPS bridge. The setup uses a mid-range machine in his mother's basement in northern Spain, exposed through a cheap VPS in a French data center, with a 39 ms latency penalty.
“There is nothing more satisfying than owning, end to end, the software and the hardware you use without relying on abusive cloud corporations.”
— David Alvarez Rosa
What people are saying 21 voices from 1 site · best of 43 · verbatim
- Yesterday
-
With VMs arp doesn't really matter. Your provider on the remote side sends traffic to the VM explicitly and there's no L2 discovery happening at all. On your side you add a dummy interface for the IP so it doesn't send any announcements on real media either. The tunnel like wg gets the traffic because of its configuration and also doesn't care…
- Sep 22
-
I appreciate the response, but unfortunately you're writing the same thing that many other people have said, without a specific example. Nobody has yet explained how to "route", if that's even the correct term here, that second IP if the upstream router doesn't know to send that traffic anywhere but to the same segment as the VPS. I've used…
-
You can set the [CAA record](https://letsencrypt.org/docs/caa/) to restrict accepted challenge types to the dns challenge, which should mitigate this.
-
As an individual, you really can’t. The web is built on a lot of institutional trust and you can only get so far without it. I say this not as some kind of “gotcha” - it’s honestly really hard to homestead services on the open internet without leaning on others you’d probably rather not. So for self-hosting it’s worth asking whether some decision…
-
Even if it's not the practical thing to do and you might be forced to proxy through a VPS, it's _nice_ (for some) to self-host, and get experience with running services on bare metal. After all, self-hosting in general is rarely done for purely practical purposes.
-
Thanks! I picked from the LaTeX catalogue for drop caps
-
If you are planning to selfhost for next 10+ years, buying the hardware will always be cheaper than cloud
-
Those are good actions to take, but also increase the sysadministrative overhead I have to manage. I personally don't find it fun to do sysadmin work for what I consider my personal "production" environment as I just want it to work. Which is why for my use case I went with the simpler autossh portforwarding solution where I can build in a lot of…
-
Good that I have IPv6 both on my phone and home Internet connection, I don't have to do all those hacks anymore
-
If you have two public IPs on the VPS, you could route one to your without a NAT. With a single IP... you could probably do something like that, but the management traffic would get slightly tricky - you'd need to ensure the SSH / tunnel traffic doesn't loop into the tunnel too.
-
I like to put this as: Calculate your expected annual spend on the VPS capable of hosting what you want comfortably, then check what you can get in eBay for that one-off price. Usually it will be a massive upgrade. Factor in the electricity cost though, and ensure at least two mirrored drives.
-
If your goal is "not relying on abusive cloud corporations" it's worth keeping in mind that (for many deployments/purposes) the VPS is in a crucial trusted position. Even if you push the TLS down to your home server, anyone who gets access to your VPS, such as a hacker or employee of the provider, has the ability to request a new LE cert and start…
-
Many people talk about using Wireguard® to connect a public IP on a VPS to machines elsewhere (usually at home). I've always wondered how you do this without NAT, but nobody has given any real world examples. This article finally has a real world example, showing how it's done with NAT (which we all have to assume is necessary, unless IPs are…
-
It's true, though I learnt recently that [at least one well-known provider] is offering "older" dedicated servers with lots of disk at a heavy discount. For me it's a sweet spot vs dealing with a server in the house.
-
I wrote about something similar [earlier](https://yashgarg.dev/posts/reverse-proxy-cgnat/), for which I use Tailscale. I use it pretty extensively across [my setup](
- Sep 21
-
I asked myself that question years ago...and then i went to self-host Nextcloud on a VPS and realized that my storage needs outgrew what was reasonably cost-effective VPS storage...so then i moved my nextcloud instance to my homelab, etc. So, while i agree you with you that sometimes keeping stuff up on a VPS makes sense, and other times/use-cases…
-
Unrelated but I love the [initial](https://en.wikipedia.org/wiki/Initial) at the start of the article
-
I've got a similar thing going with an Oracle free forever VPS. Too scared to wean myself off of Tailscale right now though :(
-
I run the same setup at home currently with a VPS at the local hackerspace. A similar post was written by mjg about the same thing.
-
Usually you also need to adjust MTU lower for this to work
-
Interestingly this is something I have been thinking about as well. But I don't really feel comfortable with a full connection between a bridge and home network. I suppose this isn't that different from exposing a server in your physical network to the internet. But it still does give people potential access to your entire network when something…