For exposing stuff publicly? Yeah that's possible in the free tier. Just not for things that use websockets (like headscale as I mentioned) or non-HTTP things (XMPP server, TURN for calls etc)

What If I just use cloudflare tunnels and configure a reverse proxy there, would that work?

Tailscale or Netbird is a good approach. They both have a SaaS control plane where you can sign devices up, and you'll connect to your home server via its VPN-internal IP.

Note that headscale or netbird cannot be hosted via Cloudflare Tunnels, as they require websockets support and/or UDP for STUN. You may just wanna rent a VPS for that.

For hosting a website publicly, you may employ reverse proxies on the Tailscale/Netbird nodes like my setup

Hurricane Electric offer free IPv6 tunnels over IPv4 for exactly that situation. I used them until I moved to an ISP that did do IPv6.

I think they also offer a free online introduction course for IPv6.

I had a pay for a monthly static IP addon

Nope. Provider doesn't support it :/

I'm with you on that. Prefer to host things myself. I was planning to setup wireguard, but because im behind CGNAT, I cant just use my server as the entrypoint for the VPN. I still need some proxy or server to tunnel into my home network.

How do you configure yours? Do you just have a public ip that connects straight to your home server?

Ipv6?

I’ve always rolled my own, and I’ve never touched Cloudflare, but from what I understand of what they offer, it should be possible, and largely equivalent from a security perspective.

I prefer to not be dependent on systems I don’t or can’t control or jettison, but that requires a level of commitment to continual vigilance and learning few can justify.

Yeah. Thats what I did with my previous provider. But this provider said all their ips are used up and they have a waitlist to opt out. And they dont offer static ips.

Really weird

Apparently not. I think I really need to change provider.

Would it be suitable to use a reverse proxy from cloudflare for the public access to a single port? Or would that still be insecure?

Yeah, I dont really want to publish anything publicly. Ssh access would be good, but I can do that with VPN tunnel because it would be from my own devices.

But sometimes I need access to my server with gui via other devices, like public computers or somebody elses laptop.

I was thinking to setup a reverse proxy and point it to apache guacamole on the server. Then I can do remote desktop via any browser with 2fa from my phone.

Do they allow you to ‘rent’ a static v4 address?
Do you have v6 available and configured?

I personally use WireGuard links to my home and VPS nodes, it’s a bit involved to setup, but you could do the same with Tailscale if you’re not up for the admin overhead.

As for hosting stuff for others to access, I’d put the advertised public interface on a VPS and locate it there, or tunnel it back to your home network if that’s not practical.

Yes, the free version.

You can probably publish the services via the cloud server too. Personally I always recommend against publishing stuff to the public, especially if you run it out of your LAN.

when my ISP turned on CGNAT I phoned them up and complained that they broke all my selfhosted services, got a free static ip4 address out of it

YMMV

Arw you using the free version?

I suppose I can try this out, but that wouldn't be suitable for public access to my server, right? Just for myself to have a secure connection.

Thats what I was planning to do before I realised that all the network providers here dont support ipv6.

I dont understand why. (╥﹏╥)

I run a tiny little netbird VPS in the cloud. A node at home makes an outbound connection to the cloud, and I connect to the cloud from my phone. Traffic transits that network to reach my LAN.

This is the answer that has worked for everyone who has asked me. I switched them to ipv6

IPv6 assuming your ISP provides it and the networks you're connecting from too.

Is your modem your gateway? Those bastards usually have a 100mbs port.

That's usually controlled by your isp, mught be worth dropping them a question or two

Back up the config before you start changing things just in case

I would just leave it be

If the disconnects are an issue you could open a ticket to see if they can help at all

Yea the lease renewal is already set to 1 day, should that be changed?

It's likely not the cause but a symptom or collateral damage.
It's probably just one of the things that no longer works when it disconnects.