Bypass CGNAT: Reach Your Home Server or Raspberry Pi from Anywhere

Description and use

Problem: Home server behind CGNAT cannot be reached via standard port forwarding. Solution: open an outbound SSH reverse tunnel to free.pinggy.io, obtain a public HTTPS URL or SSH access, configure systemd for auto‑restart, and harden security.

Problem

Home servers or Raspberry Pi behind Carrier‑Grade NAT cannot be reached via traditional port forwarding because the ISP assigns a private WAN IP.

Outcome

The Pi becomes reachable from any network via a public HTTPS URL or SSH host, without router changes, even when behind CGNAT.

Workflow

• Confirm CGNAT by comparing router WAN IP to public IP and checking for 100.64.0.0/10 range.
• Enable SSH on the Pi and secure it with key authentication.
• Run an SSH reverse tunnel: ssh -p 443 -R0:localhost:8080 free.pinggy.io for HTTP or ssh -p 443 -R0:localhost:22 [email protected] for SSH.
• Optionally use the Pinggy CLI or set up a systemd service to keep the tunnel alive.
• Add security measures such as SSH keys, disable root login, and use basic auth or TLS tunnels if needed.

Evidence

If your router's WAN IP does not match the public IP from a "what is my IP" search, or it sits in 100.64.0.0/10, your ISP uses CGNAT and no port forward will ever receive traffic.

Source

Run ssh -p 443 -R0:localhost:8080 free.pinggy.io on the Pi to get a public HTTPS URL, or ssh -p 443 -R0:localhost:22 [email protected] to expose its SSH port.

Source

A tunnel started in a terminal dies when the session closes, and the free plan has a 60‑minute time limit per tunnel.

Source