Aloha,
Long term lurker. I probably rather need help with knowing the right works to chant into Google than actual step by step help.
The Problem in short: my self hostet Nextcloud is only available most of the time locally…and rarely externally.
The Problem in long:
Back in 2020 I build a somewhat low energy NAS based on an AsRock J5005-ITX. It contains a single SSD with the OS on it (Debian, running Open Media Vault) and 2x 10TB HardDisks in Raid 1.
I live in Germany, this might be of some import.
In my last two previous flats my Internet was provided by Vodafone where I had a legacy IPv4 address that was mostly static (it changed every time cable reconnected which happened only every 100 days or so), I combined that with an .xyz domain to make it reachable from the outside. For that I had simple port forwarding rules in my FritzBox and some custom DNS entries in my PiHole to locally redirect the nc.[domain].xyz to a virtual machine inside the bare metal Debian box. That worked pretty good.
Now I moved to southern Germany and my new Provider is O2, again via cable, for some reasons I couldnt book Vodafone despite them actually owning the wires. Anyway, O2 only offers pooled IPv4 (DS-Lite Tunnel?) which in practice means that I can see IPv4 stuff but I don’t have a real outside IPv4 address. But I got whole /64 IPv6 Block all for myself. So I configured my domain to that IPv6 address of the virtual web server that contains the Nextcloud and that kinda worked (there was also some Router settings)
But it actually doesnt. Most public wifis or other residential networks dont seem to give me external access to my Nextcloud, ironically, my mobile network via phone does. This is Problem 1.
Problem 2 is a bit more fuzzy, I believe it is because i haven’t configured the DNS/Pi Hole for IPv6 correctly or rather, not at all. The observation is that on my Laptop, the connection to the Nextcloud randomly drops and then gets reestablished. On my phone, while in my home network, the NC is rarely available or only for a few seconds which screws my automatic backup of photos. This is annoying. I think it is because there are two conflicting routes to the NC, one via the internal IPv4 and the other over the publicly available IPv6. But I don’t know enough about networking to really unfuck that.
2020 me was rather knowledgeable when I set all those things up, 2024 me is somewhat busy and I already am busy enough just keeping PHP on the virtual web host current so I can update Nextcloud. I tried googling around, but I don’t quite get what my actual problem is which makes possible solutions a bit muddy. I can imagine that this problem is somewhat common, as there are a lot of folks with self hosted stuff around right? Right?
Problem 1 seems to be best solved with renting the cheapest VPS I can find and then…build a permanent SSH tunnel to it? Use the WireGuard VPN of my router? Some other kind of tunnel to expose a public IPv4? Iirc, VPS are billed by throughput, I am not sure if I might run into problems here, but the only people that use it are my gf and me, and when not at home, mostly for the CalDAV stuff.
Problem 2 looks like a configuration problem to me, but I might be deadly wrong and it might be complicated.
In short, I need confirmation for 1 and maybe some practical hints how to best slap something together, for 2 actual experience would be nice
Way to many words, thanks for your patience.
Some subjects you might wanna look into.
NAT hairpin, also called NAT loopback If you’re sending packets to your ISP’s public IP from inside your LAN and it fails, your ISP modem (or whichever device does the NAT, probably doesn’t support NAT hairpin.
Split-horizon DNS That’s when you configure your own DNS for your hosted services, but with a different config on your LAN (which would point towards your services LAN IP) and another config with your public DNS provider (which would point to your public IP)
Carrier NAT This could break your chances of having a reachable service as they likely won’t make a port forwarding rule for you in their stuff.
IPv6 address types Link-local addresses are within fe80::/10 (kinda similar to how 169.254.0.0/24 is used in ipv4). This IP wouldn’t be reachable from the outside.
Global unicast addresses are all in 2000::/3, this would be reachable from the outside.
5.IPv6 DNS Make sure to configure both A (ipv4) and AAAA (ipv6) records with the right info. Although if your LAN devices only have ipv4 addresses and you’re doing Split-horizon, you could theoretically omit the AAAA on your LAN
Some recent phones ignore the DNS they receive through DHCP and instead use something like Google’s which breaks split-horizon and can confuse troubleshooting. This wasn’t in the SSID settings, but in a global “private DNS” setting.
As for your problems, it depends.
There might be a way to make this work without the VPS, but I don’t have all the info.
That said, a VPS or something like a cloudflare tunnel could come in handy. I usually prefer to host directly but still, that’s an option if port forwarding doesn’t work with your ISP.
You’d configure the DNS for your services to the VPS IP and configure the VPS to reach your stuff.
Using the VPS kinda also gets rid of NAT hairpin problems although it is inefficient to go through the VPS from the LAN with the downside of not working when your Internet is down.
You can still use the VPS and Split-horizon DNS if you wanna have local availability from your LAN when your Internet is down.
Good luck
thanks, at least for the first point, those “Fritz Box” Routers are somewhat usual in german, I got my own to have more control over my network…and it does indeed support NAT loopback, I think that is what I had to configure in my previous IPv4 Setup for everything to work. For the rest…I will have to do some research. Although, my IPv6 address starts with 2a02 and is indeed reacheable from the outside, so apparently that is a thing