EMZETT.
Login

Emzett Wiki

DynDNS and reaching a home server from outside: port forwarding, CGNAT and tunnels

Properties1
tagsglossar, netzwerk, homelab

3 min read

DynDNS and reaching a home server from outside: port forwarding, CGNAT and tunnels

In short: To use home services on the road you need a reachable name (DynDNS), a forwarding or better a VPN/tunnel access; with CGNAT or DS-Lite classic port forwarding does not work.

In more detail: Home networks usually have dynamic public IPv4 addresses that change and are hidden behind NAT/firewall. Whoever runs a NAS, Home Assistant, game server or website at home must become reachable securely from outside.

In Depth

The hurdles

  • Changing IP: the provider assigns a new address (usually every 24 h or at restart).
  • NAT: the router lets incoming connections through only if a port forwarding exists.
  • CGNAT / DS-Lite (common with cable/fibre/mobile): the provider shares one IPv4 address among many customers (no own public port). Recognisable: the router’s WAN IP is in 100.64.0.0/10 or 10.x/192.168.x, not equal to the “what is my IP” site. Solution: IPv6 (often available), tunnel/reverse proxy, exception from DS-Lite at the provider (request a public IPv4, possibly for a fee).

DynDNS and port forwarding

DynDNS/DDNS: the router or a client reports the current IP to a service (DuckDNS, No-IP, Dynu, Cloudflare with API, FritzBox MyFRITZ!, Strato/ddclient) that points a fixed name (myhome.duckdns.org) to it. Port forwarding: the router forwards e.g. port 443 to 192.168.1.30:443. Open only deliberately: every open port is scanned and attacked within minutes. Beforehand: software current, strong authentication/MFA, HTTPS, Fail2ban/rate limiting, reverse proxy (Caddy/Nginx/Traefik) with certificate (Let’s Encrypt), only necessary services, avoiding standard ports is not security.

Better: VPN and tunnels

  • WireGuard/Tailscale/ZeroTier: private connection to the home network without open service ports (only one UDP port or NAT traversal); often works behind CGNAT too (Tailscale/ZeroTier with relay).
  • Cloudflare Tunnel / ngrok / frp: outbound connection to the provider, web services public without port forwarding; mind the provider’s trust/privacy.
  • VPS as relay (small server with fixed IP + WireGuard/reverse proxy).
  • IPv6: addresses are global, but open the router firewall selectively (not everything).
  • Access only for you: VPN; for third parties (website): reverse proxy + hardened, or hosting instead of a home network.

Practice, security, law

  • Check the router: remote access/UPnP off, check UPnP forwards, firmware current.
  • Segmentation: home server in its own VLAN/DMZ.
  • Test from outside (mobile data, nmap only your own IP).
  • Backups, automate updates, check logs.
  • Privacy/law: if you run a public service with third-party data, GDPR, imprint obligation, provider terms apply (private connections partly restrict servers).
  • Availability: power outage/router restart, home server ≠ high availability.
  • Related: NAT, VPN, WireGuard, reverse proxy, Let’s Encrypt, homelab, DMZ.

See also: WireGuard, Nginx and reverse proxy, Homelab and self-hosting

Backlinks