I have buy a NAT VPS with 20 ports and I dont know how to organize them lol. I have make a list in my head but since 2 days I am lost with all services. I run nginx, a game servr, some docker things... it is possible to do that without going crazy? I think maybe a spreadsheet but I am not good with this. How you do this? 😅
Oh man I feel you on this one (and I have been there trust me) so what I do is I just pick a range and stick to it (like 15000-15019 for web stuff 15020-15039 for games etc etc) and I keep a text file (not a spreadsheet because who has time for formulas am I right) but the real trick is iptables rules (you need to mark them somehow) and I use comments in the rules themselves (which you can do with -m comment --comment "minecraft server" or whatever) so when I do iptables -L -n I can actually see what port maps to what service (because otherwise you will forget I guarantee it I have forgotten so many times) and then there is the whole issue of reverse proxying through the NAT gateway which is another layer of fun (nginx stream module is your friend here) but honestly 20 ports is plenty for most homelab stuff (or is it? Some people will argue this point forever) I have run like 8 services on 12 ports before and it was fine (tight but fine) the thing is you need discipline (which I lack but pretend to have) and also document everything (which I also pretend to do) so yeah text file plus iptables comments plus consistent ranges that is my whole system (not elegant but it works and has worked for years through three different NAT providers one of which died in a fire probably metaphorically)
Iperf3 to NAT gateway: 940 Mbps down / 880 Mbps up
iperf3 through forwarded port: 720 Mbps down / 690 Mbps up
Overhead: ~23% which is typical
Decent disk IO, meh network
Hey sweetie, whatever system you choose, please back up that port mapping file! I learned the hard way when a provider rebooted my node and I had to reconstruct everything from memory. 😊
Did you test your restore? Even a simple `iptables-save` to a off-site location counts. Remember 3-2-1: 3 copies, 2 media types, 1 offsite.
My checklist:
- export rules weekly
- screenshot your panel
- keep provider contact handy
20 ports is insane value on ARM! My Ampere NAT box at OVHcloud runs 14 services on 18 ports and still has headroom. The efficiency of Neoverse cores means less overhead per forwarded connection!
Specs:
Pro tip: use 1-1024 range mentally for "stable" services, 1025+ for experiments. Easy to remember which tier is which.
Thank you all for the ideas. I have try the iptables comment trick and it work well. But I have a new problem: my provider give me ports in range 30000-30019 and I want to use port 443 for my nginx. Is there a way to do this or I am stuck with high ports? I have see something about SNI but I dont understand if this help me.
You are stuck with high ports on the public side, that is the whole point of NAT VPS. What SNI does is let you run multiple HTTPS sites behind one port (like 30000) because the client sends the hostname in plaintext before encryption. But you still need a reverse proxy somewhere with a real IP to forward to your NAT box.
I used to do this with a $5 Vultr instance in Dallas as the front end. Not elegant but it works.
Same situation here in Seoul, my provider also uses 30000+ range. I run Caddy on the NAT box with local port 8443 mapped to public 30001, then my "real" VPS handles 443 and forwards based on SNI. The latency Seoul to Singapore is only 45ms so users do not notice.
The Ampere box barely breaks a sweat doing TLS passthrough.
Member
I rewrote my entire port mapping system in Rust. It generates iptables rules and a Caddyfile from a single TOML config. 847 lines including comments.
Before that I used a spreadsheet. I have seen things.
This is the architecture I recommend to clients. Two points: that front-end VPS is now a single point of failure, and you MUST back up its config too. I have seen people obsess over the NAT node and forget the proxy.
Test your failover. Actually pull the plug on the proxy and time how long before you can restore.
