NAT VPS in 2026 — actually usable or still a toy?

Been running NAT VPS from OVHcloud and Vultr for a full year now, figured id write up my experience

The port forwarding is... quirky. You get a control panel to map ports but sometimes it takes 5-10 min to propagate, sometimes instant. no ICMP on Vultr which breaks my smokeping setup, had to switch to TCP probes. OVHcloud gives you 20 ports which is plenty for a fun little project

It actually works though. I run wireguard, pihole, and a small gitea mirror on a 1GB NAT box. Cost me $14/year. Heres my wg-quick config if anyone wants it:

[Interface]
Address = 10.200.200.2/24
ListenPort = 51820
PrivateKey = <redacted>

[Peer]
PublicKey = <redacted>
AllowedIPs = 0.0.0.0/0
Endpoint = ovhcloud.com:51820
PersistentKeepalive = 25

The endpoint is their shared IP, port allocated in panel. Not beautiful but functional

Anyone else using these for actual wor

Virtualization tax on NAT is higher than people admit. Youre sharing not just the IPv4 but usually the kernel network stack too, depending on how the provider implements it.

Seen two models in the wild:

• Proper KVM with bridged NAT and iptables forwarding rules per tenant
• OpenVZ garbage where everyone hits the same conntrack table and one person doing heavy UDP floods the whole node

The second one is more common at the price point youre describing. Cgroup limits on net_prio dont save you when the host kernel is spending all its time in softirq. I benchmarked a $12/year NAT box last month, disk was fine at 800 MB/s sequential, but network latency to the same DC as my dedicated IP box was 3ms worse. Small but measurable.

Shared IPv4 means shared reputation too. Email is basically impossible, and some APIs will rate-limit you hard because someone else on that IP scraped them last week

Shared IPv4 is a SECURITY NIGHTMARE!!!

You dont control who else is on that IP!!! What if theyre running a C2 node? Now YOUR traffic is mixed with theirs!!! Law enforcement doesnt care about "it was the other tenant"!!!

Ive seen NAT VPS where the provider forwards ALL ports by default until you configure them!!! Thats every service you forgot about exposed to the internet!!!

What could go wrong:

• ssh on nonstandard port, brute forced within hours
• Any web panel you left running, found by Shodan
• The shared IP ends up on a blocklist and your legitimate API calls get rejected
• Provider gets abuse report, suspends entire IP, YOUR stuff goes down too

You NEED fail2ban!!! You NEED a firewall!!! You NEED to audit every open port weekly!!!

The $14/year isnt worth the sleepless nights 👀

The whole point is cheap lol

$14/year vs $3/month for same specs with dedicated ip

Thats $22/year difference, a lot of money for broke hobby

Im running 4 nat vps from RackNerd, $11/year each, total monitoring stack for $44/year. Cant receive icmp either but who cares, tcp checks work fine

Definitely not for production but for my homelab alerts? Fine

If you need dedicated ip just pay €2 more at Hetzner, they got €26/year with ipv4. Still cheap

I run 52 boxes and 8 of them are NAT, mix of Contabo and Hostinger

Honestly the math works for certain workloads. My monitoring nodes dont need dedicated IPs, they just need to phone home. $/GB/RAM on these things is insane if you ignore the IP situation

Lists:

• 3x NAT for prometheus remote-write (no incoming ports needed)
• 2x NAT for offsite backups via rclone (outbound only)
• 2x NAT for personal wireguard exit nodes (one port each)
• 1x NAT I forgot what its doing 😂 probably expired certs somewhere

The reputation thing is real though. One of my Hostinger boxes shares an IP with someone who spammed, now I cant hit a specific CDN edge. Had to rotate to another NAT box.

Still, at $13/year its disposable. Burn it, deploy new one, update DNS in my panel.

Been up since 3am anyway so I rewrote my nat port forward script

Idk why I do this. The api for my provider keeps changing the auth token format and I keep fixing it instead of sleeping

#!/bin/bash
# KnownHost nat port sync, 3am edition
TOKEN=$(cat /run/secrets/cl_api)
curl -s -H "Authorization: Bearer $TOKEN" \
  https://api.knownhost.com/v1/nat/ports | \
  jq -r '.ports[] | select(.active) | "iptables -t nat -A PREROUTING -p \(.protocol) --dport \(.external) -j DNAT --to \(.internal_ip):\(.internal_port)"' | \
  sh

Anyway they dont actually clear the rules on reboot so this appends forever. My box has 847 prerouting rules now. 840 of them are duplicates. Works though

Icmp would be nice for actual debugging but ive just accepted that traceroute dies at their edge. Tcptraceroute exists. Move on.

Like if I want to host a small website??

I found a $12/year nat vps on some forum but im scared to buy it cause I dont understand the port thing. Do I just get a random port and tell people to go to website.com:51234?? That seems weird??

Also can you run mail server on nat or is that impossible like @kate3 said??

Thank you everyone!!

NAT is only option for many

For website use reverse proxy service or cloudflare tunnel, no need public IP. Port forwarding works but ugly for visitors

Mail server impossible on NAT, every blacklist will flag shared IP immediately. Use relay through professional service instead

Question for @hankels: how you manage 52 boxes? Use ansible or similar? In my country bandwidth expensive so many lowend boxes spread across regions for latency

Simple is better

NAT is a tool. Use it for outbound. Dont fight it for inbound.

The $22/year you save buys silence

What kernel is OVHcloud running? OpenVZ or proper KVM?