How do I access my homelab behind CGNAT?

Use a private mesh connection when access is only for your devices. For public users, create a reachable endpoint with a port-forwarding VPN or a VPS, then send traffic back through an outbound tunnel to the homelab.

How do I make homelab services public behind CGNAT?

For a public website, game server, or changing multi-service stack, use a VPS with a public IPv4 as the front door. The home node starts an outbound WireGuard or reverse tunnel, and the VPS maps public TCP or UDP traffic through it.

How do I know if my homelab is behind CGNAT?

Compare the router WAN IPv4 with the public IPv4 seen online. A WAN address in 100.64.0.0/10 is a strong CGNAT signal. Different addresses also show upstream NAT, but first rule out a second router and an active VPN.

Do reverse proxies work with CGNAT?

A reverse proxy inside the homelab organizes HTTP services but does not create a public route through CGNAT by itself. Put the proxy behind a public VPS or a supported tunnel, then forward the public hostname to the internal service.

Does a NAS work if I have CGNAT?

A NAS continues to work on the local network. For your own remote access, keep it private through a mesh connection. If a specific NAS service must be public, expose only that service through a VPN port or VPS gateway rather than the administration interface.

How do I port forward with a CGNAT Wi-Fi router?

The router can forward only the address it controls; it cannot open the ISP’s shared CGNAT layer. Request a public IPv4, use a VPN that assigns an incoming port, or move the public entry to a VPS and tunnel the traffic home.

Does a VPN work over CGNAT for a home server?

Yes, because the VPN tunnel starts outbound. Private mesh VPNs work for invited devices. Public access requires a provider that explicitly assigns incoming ports: Proton VPN for one port or PureVPN for 2–15 selected ports.

How do I run a home server with CGNAT?

Keep the home server on its private LAN address, establish an outbound encrypted tunnel to a public endpoint, map only the required service ports, and test from another network. Use a VPS when you need a stable hostname, several services, or complete firewall control.

Guide

18 min readAug 11, 2026

Homelab Behind CGNAT: Remote Access & Public Services

Reach a homelab behind CGNAT, choose private access or a public entry point, map the ports you need, and verify the complete connection path.

Quick Answer

A homelab still works behind CGNAT, but your ISP’s shared IPv4 blocks unsolicited inbound traffic before it reaches your router. Use a private mesh connection for your own devices. For public websites, game servers, or several services, create an outbound tunnel to a VPS with a public IP. If one or 2–15 incoming ports are enough, use a VPN that explicitly supports port forwarding.

Choose my connection path Compare public servers Compare port-forwarding VPNs

Homelab behind CGNAT: what actually breaks

CGNAT changes the public edge of your network, not the homelab itself. Separate what already works from the single path that needs replacing.

Local services keep working

Proxmox, Home Assistant, NAS shares, dashboards, containers, and backups remain reachable on your LAN. CGNAT does not change local addressing.

Outbound traffic keeps working

Updates, DNS, cloud backups, and an outbound WireGuard or reverse tunnel can cross CGNAT because the connection starts inside your network.

New inbound sessions stop upstream

A router port-forward rule cannot control the ISP’s shared NAT. Public users need a new reachable entry point that sends traffic back through your outbound tunnel.

Three checks, one answer

How to check whether your homelab is behind CGNAT

Confirm the upstream path before changing firewall rules or buying a service. A mismatch tells you where normal router port forwarding stops being enough.

Read the router WAN IPv4

Open the router status page and copy its WAN, Internet, or upstream IPv4 address. Ignore the homelab device’s private LAN address.

Read the public IPv4

Use NAT Checker from the same connection and note the IPv4 seen by the internet. Disconnect any privacy VPN first.

Compare and classify the path

Matching public addresses usually mean direct router NAT. A 100.64.0.0/10 WAN address strongly signals CGNAT. Different addresses mean upstream NAT; rule out a second router.

Follow the complete CGNAT check

Choose private remote access or a public homelab

The right solution depends on who must connect and how many protocols your stack exposes. Start with the smallest public surface that delivers the result.

Your goal	Best entry point	Port model	Best for
Private homelab remote access	Private mesh connection	No public ports	Admin panels, NAS, SSH, RDP, Home Assistant
One public service	Proton VPN port forwarding	One assigned incoming port	A single configurable TCP or UDP listener
A few public services	PureVPN port forwarding	2–15 selected ports	Several known application and game ports
Public homelab or changing stack	VPS plus outbound tunnel	Full TCP/UDP firewall control	Websites, reverse proxy, many services, stable endpoint

Private homelab remote access

If only your own devices need access, a private mesh connection is the fastest route because nothing has to be published to the open internet.

See private remote access methods

Best main solution: a VPS gateway for homelab CGNAT

A small public server gives the homelab a stable front door. Your home node starts an encrypted tunnel outward, the VPS accepts internet traffic, and firewall or reverse-proxy rules send each service through that tunnel.

Remote user

VPS public IP

Outbound tunnel

Homelab service

Best all-round gateway

New users get $300

Vultr

Public IPv4 enabled by default for a directly reachable gateway
Root access and firewall groups for custom TCP/UDP mappings
32 global cloud locations documented by Vultr

Build the gateway on Vultr

Vultr supplies a public IPv4, root access, and an inbound firewall, so one small instance can terminate WireGuard and route a reverse proxy, game server, or any custom TCP/UDP service. The benefit is one stable public entry for a stack that can grow without changing products. Vultr’s provisioning documentation confirms public IPv4 is enabled by default and firewall groups can filter incoming traffic.

Best APAC route option

DMIT

Full root access for WireGuard, proxy, or relay deployments
Los Angeles, Hong Kong, and Tokyo locations for Pacific routes
Three-day new-VM refund when the published usage terms are met

Build the gateway on DMIT

DMIT combines full root access with routes built around Los Angeles, Hong Kong, and Tokyo, which makes the same VPS gateway pattern attractive when homelab users or services sit around Asia-Pacific. DMIT lists VPN, proxy, and relay nodes as supported workloads and publishes a full-refund window for qualifying new VMs used for no more than three days and 30 GB.

VPN port forwarding for a small homelab

A port-forwarding VPN is a compact alternative when an application can listen on the port assigned by the provider. Match the product to the number of incoming ports rather than buying a generic VPN plan.

Verify the incoming-port feature before paying

Not every VPN supports incoming port forwarding. The VPNs below are the ones we researched and verified as explicitly supporting it, and both publish generous refund windows. Choosing the wrong VPN, discovering it cannot open a port, and then finding it cannot be refunded would be a painful waste.

Best for exactly one port

Proton VPN

One assigned incoming port on supported paid P2P servers
Official apps support the feature on Windows, macOS, and Linux
Publicly documented, independently audited no-logs policy
30-day money-back window for eligible paid plans

Get one incoming port with Proton VPN

Proton VPN assigns one incoming port and carries it through the encrypted tunnel, so a configurable app can become reachable without changing the ISP connection. That is the cleanest value when one listener is the whole job. Proton documents the supported P2P servers, platforms, assigned-port workflow, and 30-day refund window.

Only pick for 2–15 ports

PureVPN

Open 2–15 selected incoming ports for a multi-service lab
Port-forwarding locations across 15 published countries
More than three million customers reported by PureVPN
31-day money-back guarantee under the published policy

Open 2–15 ports with PureVPN

PureVPN lets you choose several incoming mappings instead of redesigning a homelab around one port. That advantage keeps a small game server, media service, and management endpoint on separate ports while crossing CGNAT through one subscription. Its official add-on guide documents up to 15 selected ports and its refund page publishes a 31-day guarantee.

How to set up a home server with CGNAT

The configuration changes by tunnel software, but the connection logic stays the same. Build it in this order so every failure has one obvious boundary.

1
Confirm CGNAT and record the target service
Compare WAN and public IPv4 addresses. On the homelab, record the service’s private IP, listening port, and TCP or UDP protocol.
2
Classify the audience and port count
Keep admin-only services private. For public access, choose one VPN port, 2–15 VPN ports, or a VPS gateway with full firewall control.
3
Create an outbound encrypted tunnel
Connect the home node to the VPN exit or VPS using the provider app, WireGuard, or a maintained reverse-tunnel service. Enable automatic restart.
4
Map the public listener to the homelab service
Match protocol and port at the public gateway, tunnel rule, host firewall, container boundary, and application listener. Use a reverse proxy for multiple HTTP services.
5
Test from outside and save the result
Connect from mobile data or another network, confirm the service response, then record the public hostname, port, protocol, and renewal or reconnect behavior.

Verify every hop before opening more ports

A public port is useful only when every hop behind it is alive. Test from the service outward, then make one external connection.

App listening locally

Host firewall allows it

Tunnel mapping is active

Public port is allowed

External client connects

Troubleshoot a port that still looks closed

Homelab CGNAT troubleshooting by symptom

Symptom	Check first	Most useful next move
Service fails on the LAN	Local IP, listener, container bind, application log	Fix the service before testing any public path.
Public test times out	VPS/VPN listener, public firewall, tunnel status	Confirm the gateway receives packets, then follow the mapping inward.
Connection is refused	Protocol, exact port, and active application listener	Start the service or correct the destination port.
It breaks after reconnect	Changed VPN port, tunnel service, dynamic DNS, startup order	Automate tunnel restart and update mappings when the assigned port changes.
Remote access is slow	Direct vs relayed path, VPS region, home upload, MTU	Move the gateway closer, tune MTU, and measure the home uplink separately.

Publish the service, not the whole homelab

Allow only required TCP or UDP ports at the public gateway and host firewall.
Keep hypervisors, router panels, databases, and storage administration on private remote access.
Put public web apps behind TLS and strong authentication; add MFA where the application supports it.
Patch the gateway and home service, protect SSH with keys, and review logs for repeated probes.

Need the full CGNAT method comparison?

Compare public IPv4, IPv6, mesh access, VPN port forwarding, and VPS routes in one guide.

Read the CGNAT port-forwarding guide

Homelab CGNAT questions

Official sources

Feature and network claims on this page were checked against standards and provider documentation.

Share this article