NAT VPS in 2026 — actually usable or still a toy?

20 ports plenty? Gitea + wireguard + pihole = already 3

Answering @FyreJun on OVHcloud: theyre proper KVM, always have been. You get your own kernel, your own network namespace, the NAT is just iptables rules on the host. The propagation delay tomchan mentioned is their control plane pushing those rules, not a kernel thing.

OpenVZ is dying out but still lurks at the absolute bottom of the market. If youre paying under $10/year and the provider wont tell you the virtualization, assume the worst. I tested one last month that didnt even have /proc/user_beancounters readable so you couldnt diagnose why your network stalled.

@larryjeong RackNerd is KVM too, for what its worth. They just dont expose the IPMI.

Gitea web is one port, ssh is another, thats 2. Wireguard is 1. Pihole is DNS so outbound 53, no forward needed. So 3 ports total, leaves me 17 for whatever. I run a small minecraft server for my nephew on another, thats 4.

The point is im not running a datacenter here. Its a toy. Works fine as one.

@kate3 thanks for confirming OVHcloud is proper KVM. The 5-10 min thing is annoying but livable.

Thank you @minh1987 and everyone!!

So for website I should use cloudflare tunnel instead of port forwarding? That sounds easier actually. I already use cloudflare for dns on my domain

For mail I will just use my domain providers relay, they include 100 emails/day

One more question: do I need to worry about the shared IP blocklist thing if im using cloudflare tunnel? My traffic goes through their IP right?

No, cloudflare handles the edge IP. Your origin IP is hidden. Thats actually the whole point, you could host from your dorm room and nobody sees the real IP

BUT cloudflare tunnel still needs the tunnel daemon running on your VPS, which needs outbound HTTPS. NAT handles that fine. Just no inbound ports needed at all

I run 3 websites this way, all on $11/year NAT boxes. Cloudflare does the SSL, the caching, the whole thing. My origin just serves plain HTTP on localhost and cloudflared connects out

OVHcloud KVM confirmed, good. Their API for port rules is flaky though, had to wrap it in retry logic.

@tallinnying your script is horrifying. 847 rules? Just flush before append:

iptables -t nat -F PREROUTING
# then your curl | jq | sh

Or better, output to a file and diff it before applying. One day that API returns garbage and you DNAT your ssh to someone elses container.

Also KnownHost auth tokens rotate every 90 days now, check your email.

I know. I know. The 847 rules thing started as a joke and now its performance art

I added the flush after I realized why my box was eating 12% cpu on softirq alone. Fixed now, down to 7 rules. Still runs at 3am though, thats not a bug its a lifestyle

@FyreJun thanks for the token heads up, mine expired last week and I blamed their API. It was me all along

Ansible for config, but honestly most of it is just prometheus (https://prometheus.io) scraping node_exporter and me getting alerts when disk or memory spikes. The 8 NAT boxes are in a separate inventory group with a simpler playbook, no fail2ban, no complex firewall rules

I dont ssh to most of them for months at a time. Set up rclone or remote-write or whatever, let it run. The Hostinger IP reputation issue I mentioned earlier, I just blacklisted that one box in prometheus and spun up another $12/year replacement. Took 10 minutes

@olespete your security nightmare list is valid but youre talking about production. This thread is about hobby stuff. Different risk model

I pay Rp 180.000/year for NAT VPS in Singapore, thats like $11. Run wireguard and a small telegram bot. My coffee is Rp 25.000 so the VPS is 7 coffees per year

Never had port issue. Provider gives 10 ports, I use 2. ICMP blocked but I dont monitor, I just check when bot stops responding

This is cheaper than digitalocean smallest droplet by factor of 4. For personal stuff why would I pay more

@hankels 52 boxes is insane though, your electricity bill for alerts must be higher than some of the VPS