57
submitted 2 days ago by [email protected] to c/[email protected]

Hi, I live in Germany and only have public IPv6. My address changes only very, very rarely and has never changed in the time I've been self-hosting.

I also have a very small, pretty cheap VPS with static IPv4/IPv6 – which would seem like a great fit for some sort of tunneling/proxy setup. Now comes the question: What/how should I use it? I would like to not have the additional latency for IPv6 enabled hosts, can I just setup a reverse proxy for IPv4? Would Tailscale work for my usecase, what are some resources you found useful when using it?

Currently, I'm just hosting everything IPv6-only and hoping my address never changes, but that does not work for everyone, as especially many new buildings with fiber optic connections still only have IPv4 (strangely).

top 30 comments
sorted by: hot top new old
[-] [email protected] 4 points 1 day ago

Ionos.de has a €1 a month VPS

I think 1 core, 1gb ram, and 10gb.

Use either caddy or Nginx proxy manager. Both are easy to setup. Also both are dockerized.

I use Tailscale as my tunnel.

Total latency is about 70-90ms for me.

[-] [email protected] 1 points 1 day ago* (last edited 1 day ago)

I did something very similar via netcup tiny vps, nginx and wireguard. I could post my setup notes tomorrow if someone needs them.

[-] [email protected] 1 points 1 day ago

simplest that comes to mind is a reverse ssh tunnel and a reverse proxy on the vps maybe

[-] [email protected] 23 points 2 days ago

I'd just set up the reverse proxy on the VPS and make it forward everything via IPv6. But you could also use a tunnel/VPN, everything from Tailscale to Wireguard or even an SSH tunnel would work. And there are dedicated services like Cloudflare, nohost, neutrinet, pagekite...

[-] [email protected] 4 points 1 day ago* (last edited 1 day ago)

I'll add Pangolin to the list, it's a self-hosted Cloudflare tunnel alternative.

[-] [email protected] 16 points 2 days ago

Wire guard to the vps with nftables port forwarding.

Check my wiki here https://wiki.gardiol.org/doku.php?id=networking%3Awireguard_redirects

Or setup ssh with port forwarding as well. Less reliable but nothing to install on a basic Linux.

[-] [email protected] 1 points 1 day ago

I do this already, but I'm going compare my nftables rules when i get home. You're ip table looks more elegant.

[-] [email protected] 2 points 2 days ago

This. Using simple ssh tunneling with port forwarding in a similar scenario. Working flawlessly with zero maintenance for 5 years and counting. Very reliable

[-] [email protected] 4 points 2 days ago

Not really reliable, much less than wire guard. If your connection is unstable ssh not the best option. Autossh make it better, but still after a forced disconnection ssh will take a while to drop and reconnect. Wire guard is much better. I moved from ssh+autossh to wireguard and wished I did that sooner.

[-] [email protected] 3 points 2 days ago* (last edited 2 days ago)

Fair comment, I should qualified my answer: I use an ssh tunnel with auto-reconnect option, wrapped inside a systemd service. In all this years, I still have to run into a problem that wasn't external (server down, no internet at home etc) I agree that wireguard is the proper solution however it requires a lot of extra configuration and support in both ends, which now is prevalent but not so much 5+ years ago. Also for a single port solution, ssh is so much simpler, practical and reliable, you only need an ssh user at the other end.

ExecStart=/usr/bin/ssh -NT -o ServerAliveInterval=60 -o ServerAliveCountMax=3 -o ExitOnForwardFailure=yes -R localhost:YOUR_PORT:localhost:YOUR_PORT SOME_USER@YOUR_SERVER

[-] [email protected] 10 points 2 days ago

Tailscale is amazing. When i first started self hosting i tried a bunch of things to avoid a companies solution but tailscale just works perfectly and form what they say in interviews they dont intend to change the free tiers. Its also open source and there's headscale so eventually you could not rely on the company at all.

[-] [email protected] 6 points 1 day ago

I switched from Tailscale to headscale, and I still would suggest Tailscale to anyone. It’s just really done well and they seem to actually love that self-hosters and hobbyists use their stuff.

[-] [email protected] 2 points 1 day ago

I have a VPS hosted on Digital ocean with Nginx running as proxy, I use openvpn to connect to the VPS and access all my services over the VPS ip address.

I own a domain and forward all the requests from my domain to the Home server IP from my VPS, very useful because I can use different subdomains for different services all on port 80 or 443 even though the service is running on random port.

[-] [email protected] 6 points 2 days ago

Curious question, why would IPv6 introduce additional latency?

[-] [email protected] 6 points 2 days ago

It doesn't, but running everything through a tunnel to get IPv4 access would. OP wants only the IPv4 traffic to go over a tunnel.

[-] [email protected] 4 points 2 days ago

Small and stupid question.

Why don't use a ddns client to update your ipv6 evytime it changes? With a ttl of a minute your shouldn't be able to see any downtime...

I (genuinely) thinks you are trying to solve a small problem in the complicated and hard way.. M

[-] [email protected] 1 points 1 day ago

Plenty of IPv4 only networks still exist from which you would not be able to access the services. I am in a similar situation as OP with my offsite address being IPv6 + CGNAT IPv4 and my own address being IPv4 only.

[-] [email protected] 3 points 2 days ago* (last edited 2 days ago)

Another option if you need public access without something like tailscale would be to use ddns and a AAAA record. Something like https://github.com/ddclient/ddclient would help do that.

That way if the IP changes, you'd pick up on the change for your vanity url within a few minutes.. and can get https certs for that url as well.

Edit: I reread the OP. This doesn't help if clients need direct ipv4. Sorry about that.

[-] [email protected] 4 points 2 days ago* (last edited 2 days ago)

Yes, you can just use a reverse proxy for IPv4 only and point it to the IPv6 upstream. That is what I do, with a separate DNS record which then combines the two. See the DNS records for id.knifepoint.net (CNAME), http.vineta.knifepoint.net (AAAA, A) and vineta.knifepoint.net (AAAA).

The reverse proxy config and certificate management is set up with NixOS, if it helps: https://git.dblsaiko.net/systems/tree/nixos/defaults/v4proxy.nix https://git.dblsaiko.net/systems/tree/nixos/modules/sys2x/v4proxy.nix

[-] [email protected] -5 points 2 days ago

But having a reverse proxy would enable someone getting access to it to read traffic, while having a VPN Tunnel won't.

[-] [email protected] 13 points 2 days ago

If someone manages to get root (!) access on this VPS it's over either way.

[-] [email protected] 3 points 2 days ago

Your reverse proxy should have a cert with HTTPS.

[-] [email protected] 1 points 2 days ago

Tbf, technically data is still decrypted at the reverse proxy and then re-encrypted. So if someone manages to reconfigure the proxy or read its memory somehow they could read traffic in plain text.

However then since they have to control the VPS, they could also get a new cert for that domain (at least the way I’ve configured it) even if it was passed as is to the real host via a tunnel and read the plaintext data that way, so I don’t think a tunnel protects against anything.

[-] [email protected] 1 points 2 days ago

Or just use Nginx stream proxy, and all the encryption happens on the endpoints. No need for certs on the proxy at all.

This is how I make https and mqtts available on ipv4.

[-] [email protected] 1 points 2 days ago

Oh interesting, I’ll have to look into that. Is this with that “proxy protocol” I’ve seen mentioned? If not, does this preserve it pass through the client socket address?

[-] [email protected] 1 points 1 day ago

It's merely a tcp proxy. It doesn't even have to be http since it has no idea. The trick with tls is that it can extract the requested host name via SNI.

[-] [email protected] 1 points 1 day ago

Hm, okay, that does sound like the real client IP will get lost and every connection will appear to come from the proxy then. It would be good if that were passed somehow. My current setup adds the X-Forwarded-For header for example.

[-] [email protected] 1 points 1 day ago* (last edited 1 day ago)

That is correct. There is a trick where you can set the source ip to the ipv6 mapped ipv4 ip it originally came from. I have implemented that in a transparent tcp proxy I worked on some years ago, but I am not sure if nginx supports that.

I should look into that actually. It would be useful to me as well.

Edit: actually that only works if you are in the routing path. However a nat64 solution would work as well, where you map a /64 back to the proxy.

[-] [email protected] 1 points 2 days ago

I use this setup and don’t terminate SSL at the VPS and solely tunnel the encrypted traffic over a wire guard tunnel to the home lab where SSL is terminated.

The VPS solely serves to move the traffic from an external IP to an internal one.

It’s possible that someone could log into my server, change the nginx config to terminate SSL and then siphon data but it would take a few steps and can be somewhat mitigated by stapling the SSL certs that should be seen from the homelab.

[-] [email protected] 1 points 2 days ago

vpn to your vps for ipv4.

Dynamic dns to whatever your local hosted services use in case your local ipv6 changes. I’d just use the vps vpn for everything though unless the speeds are really bad.

this post was submitted on 08 Jun 2025
57 points (96.7% liked)

Selfhosted

46672 readers
1432 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS