--- title: Getting a public IP undid a year of CGNAT workarounds... description: A homelabber documents how switching from a CGNAT connection to a real public IP address from their ISP forced a rework of the elaborate workaround stack they... canonical: https://daily.dev/posts/getting-a-public-ip-undid-a-year-of-cgnat-workarounds-i-d-built-to-survive-it-kzu133hia twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Getting a public IP undid a year of CGNAT workarounds I'd built to survive it | daily.dev og:description: A homelabber documents how switching from a CGNAT connection to a real public IP address from their ISP forced a rework of the elaborate workaround stack they... og:url: https://daily.dev/posts/getting-a-public-ip-undid-a-year-of-cgnat-workarounds-i-d-built-to-survive-it-kzu133hia og:image: https://api.daily.dev/og/posts/Kzu133Hia.png og:image:alt: Getting a public IP undid a year of CGNAT workarounds I'd built to survive it og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Getting a public IP undid a year of CGNAT workarounds I'd built to survive it **[XDA Developers](https://daily.dev/sources/xda-developers)** · 5 min read · 0 upvotes · 0 comments ## Summary A homelabber documents how switching from a CGNAT connection to a real public IP address from their ISP forced a rework of the elaborate workaround stack they had built over a year, including Pangolin, NetBird, Headscale, and a rented VPS. Getting the public IP didn't simply make things easier: port forwarding initially failed because the ISP terminated the IP on its own ONT rather than the router, requiring a DMZ-based workaround through an ER605 gateway and Nginx Proxy Manager. The author ultimately decided to drop the VPS for public ingress (replacing Pangolin/CrowdSec with NPM) while keeping NetBird on an older VPS for private access, accepting a new single-point-of-failure risk tied to their primary ISP. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why would port forwarding not work after getting a public IP address from an ISP? Port forwarding can fail if the public IP terminates on the ISP-provided ONT rather than the router, with the router's connection type left as Dynamic. In one case, switching to bridge mode and even cloning the ONT's MAC address didn't establish a connection, likely due to an ISP-side restriction, so the fix was configuring DMZ and virtual servers on the ONT itself and mirroring them on the router. _Homelabbers hitting ISP-side NAT quirks compare real-world fixes like this on daily.dev._ ### What is Pangolin used for in a self-hosted homelab setup? Pangolin is a self-hostable Secure Access Service Edge built on WireGuard, used as an alternative to Cloudflare Tunnel for exposing self-hosted services to the internet. It can be paired with CrowdSec for protection and deployed on a VPS to handle public ingress, giving more control and less third-party dependency than tunnel services. _Anyone weighing self-hosted ingress tools can track real setups like this on daily.dev._ ### What are the trade-offs of removing a VPS from a self-hosted remote access setup after getting a public IP? Dropping the VPS saves on recurring costs but shifts public service availability onto the primary ISP connection instead of a VPS with independent uptime, reintroducing a single point of failure that a second ISP was meant to avoid. One homelab operator kept private access resilient by relocating NetBird to an existing VPS while moving public-facing services behind Nginx Proxy Manager on the home router. _Developers balancing self-hosting costs against uptime risk can follow setups like this on daily.dev._ ## Similar posts on daily.dev - [My ISP quietly put me behind CGNAT, and it broke half my home lab before I noticed](https://daily.dev/posts/my-isp-quietly-put-me-behind-cgnat-and-it-broke-half-my-home-lab-before-i-noticed-yzswv0vyk) · XDA Developers · 1 upvotes · 0 comments - [Self-Hosting Behind CGNAT](https://daily.dev/posts/self-hosting-behind-cgnat-lrdls1bcr) · Lobsters · 1 upvotes · 0 comments - [My ISP stuck me behind CGNAT, and a free Cloudflare tunnel made my home server reachable again](https://daily.dev/posts/my-isp-stuck-me-behind-cgnat-and-a-free-cloudflare-tunnel-made-my-home-server-reachable-again-k8tt9qe2s) · XDA Developers · 0 upvotes · 0 comments - [I replaced a VPN with my own VPS, and it works perfectly with some added benefits](https://daily.dev/posts/i-replaced-a-vpn-with-my-own-vps-and-it-works-perfectly-with-some-added-benefits-sm1kxpptf) · XDA Developers · 0 upvotes · 0 comments - [Improving NAT traversal, part 2: challenges in cloud environments](https://daily.dev/posts/improving-nat-traversal-part-2-challenges-in-cloud-environments-fjgvspxtm) · Tailscale · 0 upvotes · 0 comments --- Tags: [#self-hosting](https://daily.dev/tags/self-hosting), [#homelab](https://daily.dev/tags/homelab) [View this post on daily.dev](https://daily.dev/posts/getting-a-public-ip-undid-a-year-of-cgnat-workarounds-i-d-built-to-survive-it-kzu133hia) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Getting a public IP undid a year of CGNAT workarounds I'd built to survive it","url":"https://daily.dev/posts/getting-a-public-ip-undid-a-year-of-cgnat-workarounds-i-d-built-to-survive-it-kzu133hia","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/getting-a-public-ip-undid-a-year-of-cgnat-workarounds-i-d-built-to-survive-it-kzu133hia"},"datePublished":"2026-10-01T18:32:51.159Z","dateModified":"2026-10-01T18:55:22.441Z","description":"A homelabber documents how switching from a CGNAT connection to a real public IP address from their ISP forced a rework of the elaborate workaround stack they...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b99250a7f3bc175bae5adafb29318475?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b99250a7f3bc175bae5adafb29318475?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"XDA Developers","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"XDA Developers","logo":"https://media.daily.dev/image/upload/s--kCg6yyAP--/f_auto,q_auto/v1774964407/logos/xda-developers?_a=BAMAMiWQ0","url":"https://daily.dev/sources/xda-developers"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/getting-a-public-ip-undid-a-year-of-cgnat-workarounds-i-d-built-to-survive-it-kzu133hia","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"self-hosting,homelab","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"XDA Developers","item":"https://daily.dev/sources/xda-developers"},{"@type":"ListItem","position":3,"name":"Getting a public IP undid a year of CGNAT workarounds I'd built to survive it"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/getting-a-public-ip-undid-a-year-of-cgnat-workarounds-i-d-built-to-survive-it-kzu133hia#faq","mainEntity":[{"@type":"Question","name":"Why would port forwarding not work after getting a public IP address from an ISP?","acceptedAnswer":{"@type":"Answer","text":"Port forwarding can fail if the public IP terminates on the ISP-provided ONT rather than the router, with the router's connection type left as Dynamic. In one case, switching to bridge mode and even cloning the ONT's MAC address didn't establish a connection, likely due to an ISP-side restriction, so the fix was configuring DMZ and virtual servers on the ONT itself and mirroring them on the router. Homelabbers hitting ISP-side NAT quirks compare real-world fixes like this on daily.dev."}},{"@type":"Question","name":"What is Pangolin used for in a self-hosted homelab setup?","acceptedAnswer":{"@type":"Answer","text":"Pangolin is a self-hostable Secure Access Service Edge built on WireGuard, used as an alternative to Cloudflare Tunnel for exposing self-hosted services to the internet. It can be paired with CrowdSec for protection and deployed on a VPS to handle public ingress, giving more control and less third-party dependency than tunnel services. Anyone weighing self-hosted ingress tools can track real setups like this on daily.dev."}},{"@type":"Question","name":"What are the trade-offs of removing a VPS from a self-hosted remote access setup after getting a public IP?","acceptedAnswer":{"@type":"Answer","text":"Dropping the VPS saves on recurring costs but shifts public service availability onto the primary ISP connection instead of a VPS with independent uptime, reintroducing a single point of failure that a second ISP was meant to avoid. One homelab operator kept private access resilient by relocating NetBird to an existing VPS while moving public-facing services behind Nginx Proxy Manager on the home router. Developers balancing self-hosting costs against uptime risk can follow setups like this on daily.dev."}}]} ```