--- title: My ISP stuck me behind CGNAT, and a free Cloudflare... description: After moving and discovering his ISP placed him behind carrier-grade NAT (CGNAT), the author lost external access to his self-hosted dashboard. CGNAT assigns a... canonical: https://daily.dev/posts/my-isp-stuck-me-behind-cgnat-and-a-free-cloudflare-tunnel-made-my-home-server-reachable-again-k8tt9qe2s twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: My ISP stuck me behind CGNAT, and a free Cloudflare tunnel made my home server reachable again | daily.dev og:description: After moving and discovering his ISP placed him behind carrier-grade NAT (CGNAT), the author lost external access to his self-hosted dashboard. CGNAT assigns a... og:url: https://daily.dev/posts/my-isp-stuck-me-behind-cgnat-and-a-free-cloudflare-tunnel-made-my-home-server-reachable-again-k8tt9qe2s og:image: https://api.daily.dev/og/posts/k8TT9QE2S.png og:image:alt: My ISP stuck me behind CGNAT, and a free Cloudflare tunnel made my home server reachable again og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # My ISP stuck me behind CGNAT, and a free Cloudflare tunnel made my home server reachable again **[XDA Developers](https://daily.dev/sources/xda-developers)** · 4 min read · 0 upvotes · 0 comments ## Summary After moving and discovering his ISP placed him behind carrier-grade NAT (CGNAT), the author lost external access to his self-hosted dashboard. CGNAT assigns a shared public IPv4 to multiple customers, making inbound port forwarding impossible. The solution was a free Cloudflare Tunnel, set up via two Docker Compose services — the app and cloudflared — with no exposed ports on the host. The cloudflared container reaches the app over the internal Docker network, and Cloudflare routes public traffic to it. Trade-offs include Cloudflare sitting in the TLS termination path and the service being limited to HTTP-based workloads. For private services, a mesh VPN like NetBird is recommended instead. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I make my home server reachable from the internet if my ISP put me behind CGNAT? Use a free Cloudflare Tunnel instead of port forwarding, since CGNAT removes your router's public IPv4 address so incoming connections can't reach it. Run cloudflared alongside your service in a Docker Compose stack, create a tunnel in the Cloudflare Zero Trust dashboard, and point a public hostname at the container's internal address, such as http://glance:8080, with no ports exposed on the host. _Anyone stuck behind CGNAT can browse home-lab networking guides like this on daily.dev._ ### How can I tell if my ISP has put me behind carrier-grade NAT (CGNAT)? Compare the WAN address your router reports against what a 'what's my IP' website shows; if they don't match, something upstream is translating your traffic. A WAN address in the 100.64.0.0/10 range is a strong giveaway that your ISP is using CGNAT rather than assigning you a dedicated public IPv4 address. _Diagnosing tricky networking issues like this gets easier by following home-lab troubleshooting content on daily.dev._ ### What is the downside of using a Cloudflare Tunnel to expose a self-hosted service? Cloudflare terminates TLS at its edge, meaning it can technically inspect traffic between visitors and the server, and it inserts a third party into the critical path so an outage on Cloudflare's side makes the service unreachable. It's also limited to HTTP-based services, so non-HTTP traffic needs a separate solution like a mesh VPN. _Weighing trade-offs like this helps when choosing self-hosting tools to track on daily.dev._ ## Similar posts on daily.dev - [My ISP quietly put me behind CGNAT, and it broke half my home lab before I noticed](https://daily.dev/posts/my-isp-quietly-put-me-behind-cgnat-and-it-broke-half-my-home-lab-before-i-noticed-yzswv0vyk) · XDA Developers · 1 upvotes · 0 comments - [Self-Hosting Behind CGNAT](https://daily.dev/posts/self-hosting-behind-cgnat-lrdls1bcr) · Lobsters · 1 upvotes · 0 comments - [I self-host anything I want behind CGNAT, and here's how you can too](https://daily.dev/posts/i-self-host-anything-i-want-behind-cgnat-and-here-s-how-you-can-too-vyjujrni5) · XDA Developers · 0 upvotes · 0 comments - [Getting a public IP undid a year of CGNAT workarounds I'd built to survive it](https://daily.dev/posts/getting-a-public-ip-undid-a-year-of-cgnat-workarounds-i-d-built-to-survive-it-kzu133hia) · XDA Developers · 0 upvotes · 0 comments - [My second Cloudflare Tunnel](https://daily.dev/posts/my-second-cloudflare-tunnel-ackpjuxtl) · A Java geek · 3 upvotes · 0 comments --- Tags: [#self-hosting](https://daily.dev/tags/self-hosting), [#docker-compose](https://daily.dev/tags/docker-compose) [View this post on daily.dev](https://daily.dev/posts/my-isp-stuck-me-behind-cgnat-and-a-free-cloudflare-tunnel-made-my-home-server-reachable-again-k8tt9qe2s) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"My ISP stuck me behind CGNAT, and a free Cloudflare tunnel made my home server reachable again","url":"https://daily.dev/posts/my-isp-stuck-me-behind-cgnat-and-a-free-cloudflare-tunnel-made-my-home-server-reachable-again-k8tt9qe2s","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/my-isp-stuck-me-behind-cgnat-and-a-free-cloudflare-tunnel-made-my-home-server-reachable-again-k8tt9qe2s"},"datePublished":"2026-07-16T14:01:25.113Z","dateModified":"2026-09-14T06:25:06.110Z","description":"After moving and discovering his ISP placed him behind carrier-grade NAT (CGNAT), the author lost external access to his self-hosted dashboard. CGNAT assigns a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/454924a869f6aa257159fdb727226c0d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/454924a869f6aa257159fdb727226c0d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"XDA Developers","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"XDA Developers","logo":"https://media.daily.dev/image/upload/s--kCg6yyAP--/f_auto,q_auto/v1774964407/logos/xda-developers?_a=BAMAMiWQ0","url":"https://daily.dev/sources/xda-developers"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/my-isp-stuck-me-behind-cgnat-and-a-free-cloudflare-tunnel-made-my-home-server-reachable-again-k8tt9qe2s","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"self-hosting,docker-compose","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"XDA Developers","item":"https://daily.dev/sources/xda-developers"},{"@type":"ListItem","position":3,"name":"My ISP stuck me behind CGNAT, and a free Cloudflare tunnel made my home server reachable again"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/my-isp-stuck-me-behind-cgnat-and-a-free-cloudflare-tunnel-made-my-home-server-reachable-again-k8tt9qe2s#faq","mainEntity":[{"@type":"Question","name":"How do I make my home server reachable from the internet if my ISP put me behind CGNAT?","acceptedAnswer":{"@type":"Answer","text":"Use a free Cloudflare Tunnel instead of port forwarding, since CGNAT removes your router's public IPv4 address so incoming connections can't reach it. Run cloudflared alongside your service in a Docker Compose stack, create a tunnel in the Cloudflare Zero Trust dashboard, and point a public hostname at the container's internal address, such as http://glance:8080, with no ports exposed on the host. Anyone stuck behind CGNAT can browse home-lab networking guides like this on daily.dev."}},{"@type":"Question","name":"How can I tell if my ISP has put me behind carrier-grade NAT (CGNAT)?","acceptedAnswer":{"@type":"Answer","text":"Compare the WAN address your router reports against what a 'what's my IP' website shows; if they don't match, something upstream is translating your traffic. A WAN address in the 100.64.0.0/10 range is a strong giveaway that your ISP is using CGNAT rather than assigning you a dedicated public IPv4 address. Diagnosing tricky networking issues like this gets easier by following home-lab troubleshooting content on daily.dev."}},{"@type":"Question","name":"What is the downside of using a Cloudflare Tunnel to expose a self-hosted service?","acceptedAnswer":{"@type":"Answer","text":"Cloudflare terminates TLS at its edge, meaning it can technically inspect traffic between visitors and the server, and it inserts a third party into the critical path so an outage on Cloudflare's side makes the service unreachable. It's also limited to HTTP-based services, so non-HTTP traffic needs a separate solution like a mesh VPN. Weighing trade-offs like this helps when choosing self-hosting tools to track on daily.dev."}}]} ```