The Disappearing Port Forward: Self-Hosting Behind CGNAT in the UK

Port forwarding used to be the handshake of the home lab. You bought a router, found the NAT page, forwarded 443 to a Raspberry Pi, and felt like a wizard. In 2026, that ritual is increasingly unreliable. More UK broadband connections sit behind carrier-grade NAT, and the public IPv4 address you think you have may not be yours at all.

This is not a disaster. It is a change in design. The fix is to stop assuming inbound connections and start building outbound ones.

What CGNAT actually does

Carrier-grade NAT, or CGNAT, puts many customers behind one public IPv4 address. Your router gets a private or shared address, often in the 100.64.0.0/10 range. The ISP translates your traffic on the way out. Inbound connections have nowhere to go unless the ISP maps a port for you, which most do not.

UK ISPs have leaned on CGNAT for years, especially on mobile broadband and some fibre-to-the-premises products. IPv4 addresses are scarce and expensive. Ofcom and the wider industry have been talking about the transition for decades. The practical result is that a growing number of lines cannot accept a port forward, even if the router's admin page lets you type one in.

Test before you blame the router

First, find your router's WAN address. It is usually on the status page. Then ask the internet what it sees:

curl -4 ifconfig.co

If the router says 192.168.1.50 and the internet says 81.2.69.142, you are behind NAT. If the router says 100.64.23.7, you are almost certainly behind CGNAT. A traceroute can help: if the first few hops are private addresses and then a public one, that is another clue.

Check your ISP's documentation too. Some UK providers offer a static public IPv4 address as a paid add-on. Others do not offer one on residential plans at all. If remote access matters to you, ask before you sign a new contract.

IPv6 is not a free pass

IPv6 removes the need for NAT in theory. In practice, it comes with caveats. Not every UK ISP gives you a routed prefix. Some hand out a single address or a prefix that changes. Your router's firewall still needs to allow inbound traffic, and many default to blocking it. Mobile networks often run IPv6-only with translation for IPv4, which can break older services.

If you do get a stable prefix, IPv6 can be excellent for self-hosting. You can give a service a global address and open only the ports you need. But test from outside your network, not from inside. A phone on mobile data is a good test client. Remember that a changing prefix will break DNS unless you use dynamic DNS.

Tailscale: the path of least resistance

For most people, Tailscale is the answer. It builds a WireGuard mesh between your devices, handles NAT traversal, and gives you MagicDNS names. You install it on the home server and on your laptop or phone. No port forward, no public IP, no router gymnastics.

It is not a replacement for a public website. It is a replacement for 'I just want to reach my NAS from a hotel'. Tailscale's free tier is generous for personal use. You can also use subnet routers to reach devices that cannot run Tailscale themselves.

WireGuard with a small VPS

If you want to own the whole stack, run WireGuard on a cheap UK VPS and have your home server dial out to it. The VPS becomes the public endpoint. Traffic from your laptop goes to the VPS, through the tunnel, and into the home lab. You control the keys and the routing.

This is the reverse-proxy VPS pattern. Put Caddy or nginx on the VPS, terminate TLS there, and proxy requests through the WireGuard tunnel to the home server. Only expose 443. Keep SSH on the VPS locked down. Use fail2ban or equivalent, and keep the VPS patched.

The cost is small: a UK VPS with 1GB of RAM is often £3 to £5 a month. The trade-off is that you are now a sysadmin for a public-facing box. That is fine if you enjoy it. It is not fine if you forget about it for six months.

Cloudflare Tunnel and its limits

Cloudflare Tunnel is another outbound-only option. You run cloudflared on the home server, and Cloudflare connects to it. You get a public hostname without opening a port. It works well for HTTP services and is popular with Home Assistant and Nextcloud users.

Read the terms and think about the data path. Traffic is decrypted at Cloudflare's edge unless you use additional encryption. That may be fine for a personal dashboard. It may not be fine for sensitive files. Cloudflare Tunnel is not a general-purpose VPN, and it is not a magic solution for every protocol.

A sensible 2026 default

Start with Tailscale for private access. Add a reverse-proxy VPS only if you need a public website or a service that cannot use a mesh VPN. Use Cloudflare Tunnel for low-risk HTTP dashboards if you like the convenience. Test IPv6 separately, and do not assume it will save you.

Above all, stop treating port forwarding as the default. The UK's broadband market is diverse, and CGNAT is now part of the landscape. Design for outbound connections, keep the attack surface small, and you can keep self-hosting without begging your ISP for an address that may never come.