Technology
Jul 29, 2026
2 min read
1 views
Network Architecture: Bypassing CGNAT and Secure Access via WireGuard and VPS A Secure Tunnel to Home: How I Solved the Lack of a Static Public IP
Most modern Internet connections from ISPs come with a nagging problem for networking enthusiasts: Carrier-Grade NAT (CGNAT). That means you don't have a static public IP directly on your home router, and your ISP cares less about your external access needs — having to share the same public IP with a bunch of other subscribers.
In such a scenario, the classic port forwarding rules fail from the start, and access from the outside to one's own servers becomes a major challenge. The solution we implemented combines a virtual private server (VPS) in the cloud (which has a fixed public IP) with an on-premise TrueNAS Scale server, linked together by a super fast and encrypted virtual private network using WireGuard.
How the architecture works in detail
To break the barrier imposed by CGNAT without depending on third-party commercial DDNS-type services with limitations, the data flow was thought to work based on an inside-out initiative:
Node on the VPS (Anchor Point): The rented VPS acts as a central point visible on the Internet, having a static public IP.
On it runs the main instance of WireGuard which listens for connections and routes incoming traffic from the outside. Local Network Persistent Tunnel: The home TrueNAS Scale server (which sits behind the CGNAT) constantly initiates and keeps active an encrypted tunnel to the VPS. Since the connection goes from the inside to the outside, the home router allows it smoothly by establishing a permanent route.
Traffic Routing and Forwarding: When I want to access home services from outside, the traffic hits the public IP of the VPS first. Through finely configured routing rules and iptables on the cloud server, packets are routed through the WireGuard tunnel directly to your home TrueNAS or other containers and services on your local network.
Advantages of this implementation
Completely Bypassing Provider Limitations: I'm no longer dependent on the type of IP assigned by my home ISP and have eliminated any CGNAT frustration. Military-grade security: WireGuard uses state-of-the-art cryptography (ChaCha20 for encryption, Curve25519 for key exchange), providing a shielded connection against eavesdropping with very little overhead on system resources.
Total control and independence: The entire system is manually configured exactly to my needs, providing long-term stability and instant access from anywhere to my home-hosted resources and data.
In such a scenario, the classic port forwarding rules fail from the start, and access from the outside to one's own servers becomes a major challenge. The solution we implemented combines a virtual private server (VPS) in the cloud (which has a fixed public IP) with an on-premise TrueNAS Scale server, linked together by a super fast and encrypted virtual private network using WireGuard.
How the architecture works in detail
To break the barrier imposed by CGNAT without depending on third-party commercial DDNS-type services with limitations, the data flow was thought to work based on an inside-out initiative:
Node on the VPS (Anchor Point): The rented VPS acts as a central point visible on the Internet, having a static public IP.
On it runs the main instance of WireGuard which listens for connections and routes incoming traffic from the outside. Local Network Persistent Tunnel: The home TrueNAS Scale server (which sits behind the CGNAT) constantly initiates and keeps active an encrypted tunnel to the VPS. Since the connection goes from the inside to the outside, the home router allows it smoothly by establishing a permanent route.
Traffic Routing and Forwarding: When I want to access home services from outside, the traffic hits the public IP of the VPS first. Through finely configured routing rules and iptables on the cloud server, packets are routed through the WireGuard tunnel directly to your home TrueNAS or other containers and services on your local network.
Advantages of this implementation
Completely Bypassing Provider Limitations: I'm no longer dependent on the type of IP assigned by my home ISP and have eliminated any CGNAT frustration. Military-grade security: WireGuard uses state-of-the-art cryptography (ChaCha20 for encryption, Curve25519 for key exchange), providing a shielded connection against eavesdropping with very little overhead on system resources.
Total control and independence: The entire system is manually configured exactly to my needs, providing long-term stability and instant access from anywhere to my home-hosted resources and data.