If your ISP uses CGNAT, a port-forwarding rule on your home router will not make your server reachable from the internet. For access from your own phone and laptop, use a private network such as Tailscale. If other people need a web app without installing a client, use a tunnel and put authentication in front of it. Ask the ISP for a public IP if you need ordinary inbound connections.
Check whether CGNAT is the problem
Find the WAN or internet IP address shown in your router’s status page. Then search for “what is my IP” from a device on that connection. If the two IPv4 addresses differ, another layer of NAT sits between you and the internet. A router WAN address in 100.64.0.0 to 100.127.255.255 is a strong CGNAT clue; RFC 6598 reserves that range as shared address space.
Some ISPs use other private ranges. If your router is connected behind another router, that is double NAT in your own home rather than necessarily ISP CGNAT. Check the upstream router or ask your ISP before changing your setup. A 100.x address assigned to a Tailscale device is also different from the WAN address on your router.
Choose private access or public sharing
| What you need | Good starting choice | Who can connect |
| Your own phone and laptop | Tailscale | Devices you authorise in your tailnet |
| A web app on your own domain | Cloudflare Tunnel plus Access or app sign-in | People allowed by your access policy |
| A short public demo | Tailscale Funnel | Anyone with the public URL |
| Direct inbound connections | Ask your ISP for a public IPv4 address, or use suitable IPv6 | Depends on your firewall and service |
These routes solve different problems. Do not publish a NAS dashboard or router admin page to the open internet just because a tunnel makes it possible. For a typical home server, private access is enough.
Tailscale: the simplest route to your own server
Install Tailscale from its official instructions on the server and on the phone or laptop you will use remotely. Sign both in to the same tailnet. On a Linux server, bring it online with:
sudo tailscale up
tailscale ip -4The second command shows the server’s Tailscale IPv4 address. From a connected device, open your service at that address and its normal port, for example http://100.x.y.z:3000. If the address works at home but not away, check that Tailscale is connected on both devices and that the service is listening on the server.
Tailscale normally needs no port forward because devices establish outbound connections and can use a relay when a direct path fails. Keep the server signed in and review its device access and key-expiry settings in the admin console if it runs without a screen.
Tailscale Serve can give a service an HTTPS address reachable inside your tailnet. Funnel is different: it makes that service reachable from the public internet. Do not turn on Funnel for a private admin panel. Tailscale notes that HTTPS certificates can put machine names in a public certificate transparency log, so choose device names you are comfortable exposing.
Cloudflare Tunnel: use your own domain for a web app
Cloudflare Tunnel runs cloudflared on your server and connects outbound to Cloudflare. You can map a hostname such as photos.example.com to an app listening locally. The router still needs no inbound port forward.
- Put your domain on Cloudflare DNS and create a tunnel in the Cloudflare dashboard.
- Install
cloudflaredon the home server using the command Cloudflare gives for that tunnel, then confirm it is connected. - Add a route from a hostname to the local app address, such as
http://localhost:8080. - Before sharing the hostname, protect it with Cloudflare Access or the app’s own strong sign-in. Test from a network outside your home.
A published hostname is public by default. Cloudflare’s own setup guide says anyone on the internet can connect once the route is added. For a family photo app, create an Access policy limited to the people who should enter, or use an application that already enforces proper authentication. A tunnel hides your home IP; it does not replace sign-in or software updates.
Funnel, IPv6 and a public IP
Tailscale Funnel is handy for a temporary public web demo on a ts.net address. It is not the same as the private Tailscale connection above. Anyone who knows the URL can reach the published service, so use it only for an app you intend to make public and turn it off when finished.
Native IPv6 can also let another IPv6-capable network reach your server without IPv4 port forwarding, but you still need the right firewall rules and a visitor with IPv6. If you need a regular public IPv4 address, ask your ISP whether it can move your connection off CGNAT and whether it charges for that. A public address restores the possibility of port forwarding; it does not make exposing a service safe.
If the connection still fails
- Compare the router WAN IPv4 address with the public address again. A second router at home can cause double NAT.
- For Tailscale, check that both devices appear online and that the app is listening on the address and port you expect.
- For Cloudflare Tunnel, check that
cloudflaredis connected, the hostname points to the correct local service, and your Access policy permits the visitor. - Test from mobile data, not only from inside your Wi-Fi network.
For most people, I would start with Tailscale and add a public tunnel only when there is a specific reason others need to open a web app. That keeps the home server useful without turning every service into a public target.
- SourceTailscale: Serve
- SourceTailscale: Funnel
