--- title: I bypassed CGNAT for free using Oracle's forever-free... description: A home lab enthusiast explains how to bypass CGNAT using Oracle Cloud's always-free AMD VM as a WireGuard relay, preserving real client IP addresses for... canonical: https://daily.dev/posts/i-bypassed-cgnat-for-free-using-oracle-s-forever-free-cloud-tier-and-it-fixed-the-one-thing-tailsca-obog4ugtd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: I bypassed CGNAT for free using Oracle's forever-free cloud tier, and it fixed the one thing Tailscale couldn't | daily.dev og:description: A home lab enthusiast explains how to bypass CGNAT using Oracle Cloud's always-free AMD VM as a WireGuard relay, preserving real client IP addresses for... og:url: https://daily.dev/posts/i-bypassed-cgnat-for-free-using-oracle-s-forever-free-cloud-tier-and-it-fixed-the-one-thing-tailsca-obog4ugtd og:image: https://api.daily.dev/og/posts/OboG4uGtd.png og:image:alt: I bypassed CGNAT for free using Oracle's forever-free cloud tier, and it fixed the one thing Tailscale couldn't og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # I bypassed CGNAT for free using Oracle's forever-free cloud tier, and it fixed the one thing Tailscale couldn't **[XDA Developers](https://daily.dev/sources/xda-developers)** · 5 min read · 0 upvotes · 0 comments ## Summary A home lab enthusiast explains how to bypass CGNAT using Oracle Cloud's always-free AMD VM as a WireGuard relay, preserving real client IP addresses for services behind NAT. The key insight is using DNAT-only (no SNAT/masquerade) combined with policy routing on the home peer, so reply traffic routes back through the tunnel while the original source IP remains intact. This enables fail2ban, geo-blocking, and intrusion detection to function correctly — something Tailscale Funnel cannot provide. The post covers Oracle Cloud setup gotchas (MTU 9000, missing public IP assignment, empty IPv6 firewall), the exact iptables and ip rule commands needed, and how to add additional port forwards. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I bypass CGNAT and still see real visitor IP addresses on my home server? Set up a WireGuard tunnel to a free Oracle Cloud VM that has a public IPv4 address, using DNAT-only rules (no SNAT) on the server so incoming packets keep their real source address, and policy routing on the home peer so reply traffic exits back through the tunnel instead of the CGNAT connection. This avoids masquerade and lets fail2ban, intrusion detection, and geo-blocking see actual client IPs. _daily.dev surfaces networking writeups like this for anyone wrestling with CGNAT and IP visibility at home._ ### Why doesn't Tailscale show the real IP address of clients connecting through it? Tailscale's Funnel is HTTPS-only and traffic arriving through a relay or proxy logs as the tunnel's address rather than the original connecting IP, which blinds fail2ban, intrusion detection tools, and geo-blocking. A separate WireGuard tunnel with DNAT-only rules can be built alongside Tailscale specifically to preserve real source IPs for public ingress. _track workarounds like this on daily.dev when picking tools for private access versus public ingress._ ### What Oracle Cloud free tier VM instance type gives you a free public IPv4 address for a WireGuard relay? The VM.Standard.E2.1.Micro shape on Oracle's Always Free tier includes a real public IPv4 address at no cost, and it's sufficient for a WireGuard relay since the tunnel doesn't need much compute. The Ampere A1 Arm shape is more powerful but suffers from capacity availability issues in many regions, so the small x86 VM is the more reliable free pick. _daily.dev helps developers compare free-tier cloud options before committing to a home lab setup._ ## Similar posts on daily.dev - [My ISP quietly put me behind CGNAT, and it broke half my home lab before I noticed](https://daily.dev/posts/my-isp-quietly-put-me-behind-cgnat-and-it-broke-half-my-home-lab-before-i-noticed-yzswv0vyk) · XDA Developers · 1 upvotes · 0 comments - [Self-Hosting Behind CGNAT](https://daily.dev/posts/self-hosting-behind-cgnat-lrdls1bcr) · Lobsters · 1 upvotes · 0 comments - [I almost paid my ISP for a static IP, but a free Tailscale account did the job better](https://daily.dev/posts/i-almost-paid-my-isp-for-a-static-ip-but-a-free-tailscale-account-did-the-job-better-kdq3ebadc) · XDA Developers · 0 upvotes · 0 comments - [Stop opening firewall ports and start using identity](https://daily.dev/posts/stop-opening-firewall-ports-and-start-using-identity-xyrc1lkyd) · All Things Open · 0 upvotes · 0 comments - [Using Tailscale's Peer Relays to fix a homelab connection from across the globe](https://daily.dev/posts/using-tailscale-s-peer-relays-to-fix-a-homelab-connection-from-across-the-globe-cnl8nn7bx) · Tailscale · 0 upvotes · 0 comments --- Tags: [#oracle](https://daily.dev/tags/oracle), [#tailscale](https://daily.dev/tags/tailscale) [View this post on daily.dev](https://daily.dev/posts/i-bypassed-cgnat-for-free-using-oracle-s-forever-free-cloud-tier-and-it-fixed-the-one-thing-tailsca-obog4ugtd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"I bypassed CGNAT for free using Oracle's forever-free cloud tier, and it fixed the one thing Tailscale couldn't","url":"https://daily.dev/posts/i-bypassed-cgnat-for-free-using-oracle-s-forever-free-cloud-tier-and-it-fixed-the-one-thing-tailsca-obog4ugtd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/i-bypassed-cgnat-for-free-using-oracle-s-forever-free-cloud-tier-and-it-fixed-the-one-thing-tailsca-obog4ugtd"},"datePublished":"2026-07-27T14:02:10.180Z","dateModified":"2026-09-14T07:03:57.763Z","description":"A home lab enthusiast explains how to bypass CGNAT using Oracle Cloud's always-free AMD VM as a WireGuard relay, preserving real client IP addresses for...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9a673cac95ad78b9929ffcd08a7d6ddd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9a673cac95ad78b9929ffcd08a7d6ddd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"XDA Developers","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"XDA Developers","logo":"https://media.daily.dev/image/upload/s--kCg6yyAP--/f_auto,q_auto/v1774964407/logos/xda-developers?_a=BAMAMiWQ0","url":"https://daily.dev/sources/xda-developers"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/i-bypassed-cgnat-for-free-using-oracle-s-forever-free-cloud-tier-and-it-fixed-the-one-thing-tailsca-obog4ugtd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"oracle,tailscale","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"XDA Developers","item":"https://daily.dev/sources/xda-developers"},{"@type":"ListItem","position":3,"name":"I bypassed CGNAT for free using Oracle's forever-free cloud tier, and it fixed the one thing Tailscale couldn't"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/i-bypassed-cgnat-for-free-using-oracle-s-forever-free-cloud-tier-and-it-fixed-the-one-thing-tailsca-obog4ugtd#faq","mainEntity":[{"@type":"Question","name":"How do I bypass CGNAT and still see real visitor IP addresses on my home server?","acceptedAnswer":{"@type":"Answer","text":"Set up a WireGuard tunnel to a free Oracle Cloud VM that has a public IPv4 address, using DNAT-only rules (no SNAT) on the server so incoming packets keep their real source address, and policy routing on the home peer so reply traffic exits back through the tunnel instead of the CGNAT connection. This avoids masquerade and lets fail2ban, intrusion detection, and geo-blocking see actual client IPs. daily.dev surfaces networking writeups like this for anyone wrestling with CGNAT and IP visibility at home."}},{"@type":"Question","name":"Why doesn't Tailscale show the real IP address of clients connecting through it?","acceptedAnswer":{"@type":"Answer","text":"Tailscale's Funnel is HTTPS-only and traffic arriving through a relay or proxy logs as the tunnel's address rather than the original connecting IP, which blinds fail2ban, intrusion detection tools, and geo-blocking. A separate WireGuard tunnel with DNAT-only rules can be built alongside Tailscale specifically to preserve real source IPs for public ingress. track workarounds like this on daily.dev when picking tools for private access versus public ingress."}},{"@type":"Question","name":"What Oracle Cloud free tier VM instance type gives you a free public IPv4 address for a WireGuard relay?","acceptedAnswer":{"@type":"Answer","text":"The VM.Standard.E2.1.Micro shape on Oracle's Always Free tier includes a real public IPv4 address at no cost, and it's sufficient for a WireGuard relay since the tunnel doesn't need much compute. The Ampere A1 Arm shape is more powerful but suffers from capacity availability issues in many regions, so the small x86 VM is the more reliable free pick. daily.dev helps developers compare free-tier cloud options before committing to a home lab setup."}}]} ```