How to self-host behind CGNAT
If your ISP puts you behind carrier-grade NAT, you have no public IP of your own and port forwarding cannot work — the port you would forward belongs to your ISP, not to you. Every approach that works does the same thing: it has your server open an outbound connection that inbound traffic then rides back through.
Why does port forwarding fail behind CGNAT?
With ordinary NAT your router holds a public IP, so forwarding a port on it makes a service reachable. Under carrier-grade NAT your router holds a private address too, and the public IP is shared across many subscribers at the ISP. There is no port on that shared IP you are entitled to forward.
You can usually tell by comparing the WAN address shown in your router with what a what-is-my-IP service reports. If they differ and the router's WAN address is in 100.64.0.0/10, 10.0.0.0/8 or 192.168.0.0/16, you are behind CGNAT.
What actually works behind CGNAT?
Four approaches, all built on the same idea — the server dials out, and traffic returns through that tunnel. They differ in who operates the far end, whether you get a public hostname, and how much they do beyond connectivity.
| Approach | Public hostname | You operate the far end | Beyond connectivity |
|---|---|---|---|
| VPS + WireGuard, self-built | Yes | Yes — a VPS you rent and maintain | Nothing |
| Reverse tunnel service | Yes | No | Nothing |
| Mesh VPN (Tailscale, ZeroTier) | No, private addressing | No | Nothing |
| Gritiva | Yes | No | Isolation, terminal, monitoring |
If all you need is to reach your own machines from your own devices, a mesh VPN is the least effort and there is no reason to add anything else. If you need a public hostname other people can visit, you need something that terminates traffic on a public address.
How do I choose between them?
- Only you need access, from your own devices? A mesh VPN. Simplest thing that works.
- You need a public URL for a website or API? A tunnel service or your own VPS with a reverse proxy.
- You are comfortable operating a VPS and want no third party in the path? Build it yourself with WireGuard and a reverse proxy. Most control, most maintenance.
- You are managing several machines, not one? At that point connectivity is a subset of the problem, and a control plane that includes it is less work than assembling one.
How does Gritiva handle CGNAT?
The agent opens an outbound WireGuard connection to the control plane, so nothing inbound needs to reach your network. From there you can attach a public domain to a service, open a browser terminal, and run workloads in isolated scopes — all without touching your router.
curl -fsSL https://gritiva.com/install-gritiva.sh | sudo bashThis is worth it when you have more than one machine or want more than connectivity. For a single box that only you need to reach, a mesh VPN is genuinely less work and you should use one.
Frequently asked questions
- How do I know if I am behind CGNAT?
- Compare the WAN address in your router's admin page with the address a what-is-my-IP service reports. If they differ, and the router shows an address in 100.64.0.0/10, you are behind carrier-grade NAT.
- Can I ask my ISP for a public IP instead?
- Often yes. Many ISPs will assign a static or at least non-CGNAT address, sometimes for a small fee or on a business plan. If that is available and affordable, it is the simplest fix and removes the problem entirely.
- Is IPv6 a solution?
- Sometimes. If your ISP provides real IPv6 addresses, your server is directly reachable over IPv6 without any tunnel. The limitation is that visitors on IPv4-only networks still cannot reach it, so most setups need a fallback.
- Does this work behind a corporate firewall too?
- Generally yes. The same outbound-connection principle applies wherever inbound traffic is blocked but outbound is allowed, which covers most corporate networks and mobile connections.
Last updated