--- title: Port forwarding at home is dead, and that’s probably for... description: Overlay networks like NetBird and Tailscale are now a better default than port forwarding for home self-hosting, the author argues. Opening a port widens your... canonical: https://daily.dev/posts/port-forwarding-at-home-is-dead-and-that-s-probably-for-the-best-bcrx99yqu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Port forwarding at home is dead, and that’s probably for the best | daily.dev og:description: Overlay networks like NetBird and Tailscale are now a better default than port forwarding for home self-hosting, the author argues. Opening a port widens your... og:url: https://daily.dev/posts/port-forwarding-at-home-is-dead-and-that-s-probably-for-the-best-bcrx99yqu og:image: https://api.daily.dev/og/posts/BCRx99yqu.png og:image:alt: Port forwarding at home is dead, and that’s probably for the best og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Port forwarding at home is dead, and that’s probably for the best **[XDA Developers](https://daily.dev/sources/xda-developers)** · 4 min read · 13 upvotes · 0 comments ## Summary Overlay networks like NetBird and Tailscale are now a better default than port forwarding for home self-hosting, the author argues. Opening a port widens your attack surface since any scanner can reach it, and CGNAT increasingly makes port forwarding unworkable on home and mobile connections anyway. NetBird lets devices connect through a mesh after installing a client, and its reverse proxy feature can expose services like game servers to the public without opening a router port, handling raw TCP and UDP. Tailscale Funnel offers similar web access but only fixed TCP ports with no UDP, while Pangolin handles game-server setups with more manual configuration. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does CGNAT break port forwarding on my home network? Carrier-grade NAT shares one public IP address across many customers, so your router no longer has its own public IP. Inbound traffic stops at the ISP's NAT before it reaches your router, making port forwards non-functional. This is standard on mobile networks and increasingly common on home internet connections as IPv4 addresses run out. _daily.dev surfaces networking deep dives for anyone troubleshooting CGNAT or planning remote access setups._ ### How can I expose a game server at home without forwarding a port? NetBird's reverse proxy feature lets you expose services like game servers publicly without opening any router port. A proxy on a publicly reachable server accepts incoming TCP and UDP connections and forwards them over an encrypted mesh to the machine at home, so friends connect to the proxy address while your home IP stays hidden. _Developers weighing self-hosting approaches can track overlay network options like this on daily.dev._ ### What's the difference between NetBird's reverse proxy and Tailscale Funnel for exposing a home server? NetBird's reverse proxy handles Layer 4 traffic, meaning both raw TCP and UDP, which supports use cases like game servers. Tailscale Funnel only accepts TCP connections on a few fixed ports with no UDP support, ruling out anything like a game server. Pangolin is another option suited to game-server setups but needs more manual configuration. _daily.dev helps developers comparing self-hosting tools like NetBird, Tailscale, and Pangolin stay informed._ ## Similar posts on daily.dev - [I ditched port forwarding for a mesh VPN, and my home network is finally secure](https://daily.dev/posts/i-ditched-port-forwarding-for-a-mesh-vpn-and-my-home-network-is-finally-secure-pk0onln3h) · XDA Developers · 9 upvotes · 4 comments - [I stopped forwarding ports on my router, and a self-hosted mesh VPN made my home lab safer overnight](https://daily.dev/posts/i-stopped-forwarding-ports-on-my-router-and-a-self-hosted-mesh-vpn-made-my-home-lab-safer-overnight-mfessuzf6) · XDA Developers · 0 upvotes · 0 comments - [I don't expose my home server anymore: I let Tailscale do the scary part](https://daily.dev/posts/i-don-t-expose-my-home-server-anymore-i-let-tailscale-do-the-scary-part-xccmpdrgo) · XDA Developers · 0 upvotes · 0 comments - [Self-Hosting Behind CGNAT](https://daily.dev/posts/self-hosting-behind-cgnat-lrdls1bcr) · Lobsters · 1 upvotes · 0 comments - [Cloudflare Tunnel: Self-Host Behind CGNAT and Hide Your IP](https://daily.dev/posts/cloudflare-tunnel-self-host-behind-cgnat-and-hide-your-ip-oym3uguge) · Milan Jovanović · 56 upvotes · 2 comments --- Tags: [#self-hosting](https://daily.dev/tags/self-hosting), [#tailscale](https://daily.dev/tags/tailscale) [View this post on daily.dev](https://daily.dev/posts/port-forwarding-at-home-is-dead-and-that-s-probably-for-the-best-bcrx99yqu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Port forwarding at home is dead, and that’s probably for the best","url":"https://daily.dev/posts/port-forwarding-at-home-is-dead-and-that-s-probably-for-the-best-bcrx99yqu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/port-forwarding-at-home-is-dead-and-that-s-probably-for-the-best-bcrx99yqu"},"datePublished":"2026-11-07T18:01:52.029Z","dateModified":"2026-11-07T18:02:23.224Z","description":"Overlay networks like NetBird and Tailscale are now a better default than port forwarding for home self-hosting, the author argues. Opening a port widens your...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/352923970096b6008770e7084761d2db?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/352923970096b6008770e7084761d2db?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"XDA Developers","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"XDA Developers","logo":"https://media.daily.dev/image/upload/s--kCg6yyAP--/f_auto,q_auto/v1774964407/logos/xda-developers?_a=BAMAMiWQ0","url":"https://daily.dev/sources/xda-developers"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/port-forwarding-at-home-is-dead-and-that-s-probably-for-the-best-bcrx99yqu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":13},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"self-hosting,tailscale","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"XDA Developers","item":"https://daily.dev/sources/xda-developers"},{"@type":"ListItem","position":3,"name":"Port forwarding at home is dead, and that’s probably for the best"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/port-forwarding-at-home-is-dead-and-that-s-probably-for-the-best-bcrx99yqu#faq","mainEntity":[{"@type":"Question","name":"Why does CGNAT break port forwarding on my home network?","acceptedAnswer":{"@type":"Answer","text":"Carrier-grade NAT shares one public IP address across many customers, so your router no longer has its own public IP. Inbound traffic stops at the ISP's NAT before it reaches your router, making port forwards non-functional. This is standard on mobile networks and increasingly common on home internet connections as IPv4 addresses run out. daily.dev surfaces networking deep dives for anyone troubleshooting CGNAT or planning remote access setups."}},{"@type":"Question","name":"How can I expose a game server at home without forwarding a port?","acceptedAnswer":{"@type":"Answer","text":"NetBird's reverse proxy feature lets you expose services like game servers publicly without opening any router port. A proxy on a publicly reachable server accepts incoming TCP and UDP connections and forwards them over an encrypted mesh to the machine at home, so friends connect to the proxy address while your home IP stays hidden. Developers weighing self-hosting approaches can track overlay network options like this on daily.dev."}},{"@type":"Question","name":"What's the difference between NetBird's reverse proxy and Tailscale Funnel for exposing a home server?","acceptedAnswer":{"@type":"Answer","text":"NetBird's reverse proxy handles Layer 4 traffic, meaning both raw TCP and UDP, which supports use cases like game servers. Tailscale Funnel only accepts TCP connections on a few fixed ports with no UDP support, ruling out anything like a game server. Pangolin is another option suited to game-server setups but needs more manual configuration. daily.dev helps developers comparing self-hosting tools like NetBird, Tailscale, and Pangolin stay informed."}}]} ```