Six months on a NAT VPS

Six months behind NAT with Contabo. The young people call it "budget hosting". I call it character building. Twenty ports forwarded by hand. No static IP to speak of. Yet the website loads. Eventually. The cloud nonsense would have this done in clicks. But where is the learning in that. Shared IPv4 means sharing headaches too. port 443 went missing one Tuesday. Took three tickets to find it. The young people do not know patience. They know only dashboards and instant gratification. I run nginx on a ten dollar slab — https://contabo.com/en/vps/. It serves. That is enough...

Privacy demands you control every packet. NAT is a cage but self-hosting is the key. Why trust Vultr or HostHatch with your termination when you can tunnel everything through a OVHcloud VPS and four layers of reverse proxy? Lazy admins buy convenience. I run my own authoritative DNS on a Pi in a closet. Port forwarding is freedom practice. The cloud is surveillance with better marketing. Your data deserves better than someone elses router table.

Oh the port forwarding life (and I have lived it friend let me tell you) so you get this NAT address (not even a real one mind you just some shared thing floating in the ether) and then you think ok fine I will just forward 80 and 443 (classic choices obviously) but then you realize they gave you twenty ports total (twenty! Can you imagine) and you have already used three for ssh (because of course you need multiple fallback ports when the first one gets scanned which it will immediately) and then you want matrix (federation ports you know) and maybe a mailserver (dont do this behind NAT I beg you but we all try anyway) and suddenly you are playing sudoku with integers (port sudoku I call it) and the reverse proxy becomes not just convenient but absolutely mandatory (I use caddy personally but nginx is fine fine whatever works) and the real trick (the real trick) is when you need to host

A correction on terminology: what you describe is not technically "NAT" in the carrier-grade sense but NAPT with port-restricted cone behavior. The IPv4 address is not "shared" in the BGP table; it is announced normally by the upstream. Your /32 simply lacks a dedicated assignment. For web hosting behind such constraints, consider using a reverse proxy on a dedicated IPv4 elsewhere (Hetzner offers these cheaply) and tunneling via WireGuard or GRE. The SNI routing mentioned works at the TLS layer, not TCP. Your latency budget increases by the tunnel RTT, typically 20-40ms within a continent. RPKI validation on the upstream path is advisable regardless; invalid ROAs will cause reachability issues no amount of port forwarding resolves.

Contabo NAT went down again. Ticket open. 14 hours. No response. Port 80 dead. Switched to backup on InterServer https://www.interserver.net/vps/. Graphs show 3 packet loss on tunnel. Not great not terrible. Young people would have given up. I just wait.