◇ Guide · CGNAT · Public IP

Host a server behind CGNAT. Give it a real public IP.

Behind carrier-grade NAT, nobody outside can reach the game or home server you run, and port forwarding goes nowhere. To host a server behind CGNAT, use a POT Cloud Server with its own public IPv4: your server dials out to the VPS over a tunnel, and players connect to the VPS.

See Cloud Servers Jump to the steps

IPv4

Dedicated public IP

UDP + TCP

Any game port

2 ways

WireGuard or FRP

Kuwait

Our own datacenter

// the problem

Why port forwarding fails behind CGNAT

Many ISPs, especially on 4G and 5G home internet, share one public address between many customers. Your router never gets a public IP, so any port you forward opens on a private network the internet can’t reach.

No public IP

Shared address

Your router’s internet (WAN) address is private, often in the 100.64.0.0/10 range, so inbound connections never reach you.

How to check for CGNAT

Two different addresses

Compare the WAN IP in your router with the one a “what is my IP” site shows. If they differ, you’re most likely behind CGNAT.

The way out of CGNAT

Connect outbound

Outbound connections still work. Your server opens a tunnel to a VPS with a public IPv4, and the VPS passes players through to you.

// how it works

Players reach the VPS. The VPS reaches you.

You open the tunnel from your side, so CGNAT never blocks it, and players only ever see the VPS address. That is how you host a server behind CGNAT without any change at your ISP.

PlayersAnywhere

→↓Connect

POT Cloud ServerPublic IPv4

→↓Tunnel

Your serverBehind CGNAT

// step by step

Two ways past CGNAT

Both run on a Linux Cloud Server. Our examples forward Minecraft Java on port 25565 — swap in your game’s ports.

Option A · WireGuard tunnel

Best for UDP games and many ports

Order a Cloud Server with Ubuntu or Debian. A small plan is enough to start, since it only passes traffic — pick one with the bandwidth your players need, and note its public IP.

Install WireGuard on both machines and make a key pair on each:

sudo apt install wireguard
wg genkey | tee private.key | wg pubkey > public.key

On the VPS, create /etc/wireguard/wg0.conf. Replace eth0 with your public interface — ip route get 1.1.1.1 shows it:

[Interface]
Address    = 10.66.0.1/24
ListenPort = 51820
PrivateKey = <VPS_PRIVATE_KEY>
# forward the game port to your home server (one PREROUTING line per port/protocol)
PostUp   = sysctl -w net.ipv4.ip_forward=1
PostUp   = iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25565 -j DNAT --to-destination 10.66.0.2
PostUp   = iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE
PostUp   = iptables -I FORWARD -i eth0 -o wg0 -j ACCEPT
PostUp   = iptables -I FORWARD -i wg0 -o eth0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
PostDown = iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 25565 -j DNAT --to-destination 10.66.0.2
PostDown = iptables -t nat -D POSTROUTING -o wg0 -j MASQUERADE
PostDown = iptables -D FORWARD -i eth0 -o wg0 -j ACCEPT
PostDown = iptables -D FORWARD -i wg0 -o eth0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

[Peer]
PublicKey  = <HOME_PUBLIC_KEY>
AllowedIPs = 10.66.0.2/32

On your home server, create the same file with the other side’s keys. PersistentKeepalive keeps the tunnel open through CGNAT. On Windows, import it into the official WireGuard app instead:

[Interface]
Address    = 10.66.0.2/24
PrivateKey = <HOME_PRIVATE_KEY>

[Peer]
PublicKey           = <VPS_PUBLIC_KEY>
Endpoint            = <VPS_PUBLIC_IP>:51820
AllowedIPs          = 10.66.0.1/32
PersistentKeepalive = 25

Start the tunnel and open its port:

# on the VPS
sudo ufw allow 51820/udp
sudo systemctl enable --now wg-quick@wg0

# on your home server
sudo systemctl enable --now wg-quick@wg0

Connect: players join VPS_IP:25565. For a UDP game, use -p udp in the two port lines, and add a line for each extra port.

Option B · FRP

Simplest per-port setup

Download FRP, the open-source fatedier/frp project, on both machines: the server part frps runs on the VPS, the client part frpc at home.

On the VPS, create frps.toml, open the ports and run it:

# frps.toml (on the VPS)
bindPort   = 7000
auth.token = "change-me-to-a-long-random-string"

sudo ufw allow 7000/tcp
sudo ufw allow 25565/tcp
./frps -c frps.toml

At home, create frpc.toml and run it with ./frpc -c frpc.toml. For a UDP game, set type = "udp" and open the port with /udp:

# frpc.toml (at home)
serverAddr = "<VPS_PUBLIC_IP>"
serverPort = 7000
auth.token = "change-me-to-a-long-random-string"

[[proxies]]
name       = "minecraft"
type       = "tcp"
localIP    = "127.0.0.1"
localPort  = 25565
remotePort = 25565

Connect: players join VPS_IP:25565. Run both sides as services so they start on boot.

// before you go live

Before you open it to players

Four things that keep the setup safe and steady.

Lock it down

Firewall + secrets

Open only the tunnel and game ports, use a long random FRP token, and keep private keys to yourself.

Keep it running

Start on boot

Run WireGuard or frpc as a service at home so the tunnel comes back after a reboot or a power cut.

Player IPs

Seen from the tunnel

Your server sees connections arriving from the tunnel, not each player’s address — manage bans and whitelists by player name, not IP.

Bandwidth

Counts on the VPS

Every player’s traffic passes through the VPS, so pick a plan with enough bandwidth for your players.

// questions

CGNAT questions

Does this work for any game?

Yes. You can host a server behind CGNAT for any game that players reach on TCP or UDP ports — Minecraft, ARK and most others. WireGuard forwards as many ports as you need; with FRP you add one entry per port.

Will it add lag?

A little: traffic makes one extra hop through the VPS. Our Cloud Servers run in Kuwait, so that hop stays short for players in the region.

Which option should I pick?

WireGuard if your game uses UDP or many ports, or you want everything in one tunnel. FRP for the quickest setup of one or two ports.

Can I use it for a home website or media server, not just games?

Yes. The same tunnel forwards any TCP or UDP service you run at home — a website, a Plex or Jellyfin server or a NAS. For a website, point your domain at the VPS address.

Wouldn’t hosting the game server with you be simpler?

Often, yes. A POT game server already has a public address, low ping and the Game Panel with Zeta built in — no tunnel to maintain. See our game servers.

Need a public IP? Start with a Cloud Server.

Host a server behind CGNAT with a Cloud Server that has its own public IPv4, in our own Middle East datacenter.

Middle-East coreZeta AI, always onReal engineers behind it

No forms to chase — Zeta is on this page, bottom-right, whenever you want to talk.