Bypass CGNAT: Reach Your Home Server or Raspberry Pi from Anywhere

说明与用途

问题：位于 CGNAT 后的家庭服务器无法通过传统端口转发访问。解决方案：使用 SSH 反向隧道连接 free.pinggy.io，获取公共 HTTPS URL 或 SSH 访问，配置 systemd 自动重启，并加强安全措施。

问题

Home servers or Raspberry Pi behind Carrier‑Grade NAT cannot be reached via traditional port forwarding because the ISP assigns a private WAN IP.

结果

The Pi becomes reachable from any network via a public HTTPS URL or SSH host, without router changes, even when behind CGNAT.

工作流

• Confirm CGNAT by comparing router WAN IP to public IP and checking for 100.64.0.0/10 range.
• Enable SSH on the Pi and secure it with key authentication.
• Run an SSH reverse tunnel: ssh -p 443 -R0:localhost:8080 free.pinggy.io for HTTP or ssh -p 443 -R0:localhost:22 [email protected] for SSH.
• Optionally use the Pinggy CLI or set up a systemd service to keep the tunnel alive.
• Add security measures such as SSH keys, disable root login, and use basic auth or TLS tunnels if needed.

证据

If your router's WAN IP does not match the public IP from a "what is my IP" search, or it sits in 100.64.0.0/10, your ISP uses CGNAT and no port forward will ever receive traffic.

来源

Run ssh -p 443 -R0:localhost:8080 free.pinggy.io on the Pi to get a public HTTPS URL, or ssh -p 443 -R0:localhost:22 [email protected] to expose its SSH port.

来源

A tunnel started in a terminal dies when the session closes, and the free plan has a 60‑minute time limit per tunnel.

来源