Bypassing NAT: Cloudflare, Tailscale, and the IPv6 Advantage

Network Address Translation (NAT) presents a significant challenge for home network enthusiasts and self-hosters. Triggered by a NAT joke (“I’d tell you a joke about NAT, but I’d have to translate”), this article explores the limitations of IPv4, the rise of Carrier-Grade NAT (CGNAT), and modern solutions like Cloudflare Tunnels, Tailscale, and VPS reverse proxies. We’ll also briefly examine how IPv6 eliminates NAT entirely.

The NAT Challenge and IPv4 Exhaustion

NAT was created to address IPv4’s limited address space (4.3 billion addresses). By sharing a single public IP among multiple devices, NAT extended IPv4’s lifespan. However, it introduced a critical flaw: devices behind NAT cannot receive unsolicited inbound connections, complicating remote access to home servers, IoT devices, or media libraries.

The problem has worsened with Carrier-Grade NAT (CGNAT), where ISPs assign private IPs to entire neighborhoods. Under CGNAT, your router lacks a public IPv4 address, rendering traditional port forwarding useless.

Why IPv6 Solves the NAT Problem

IPv6, with its 340* undecillion addresses, eliminates the need for NAT.

Every device gets a unique, globally routable IPv6 address. No more port forwarding or workarounds—services are directly accessible.

Globally, IPv6 adoption is still below 50% (as of April 2025).

Workarounds for IPv4/CGNAT Constraints

When IPv6 isn’t viable, these tools bypass NAT limitations:

Cloudflare Tunnels: Secure Outbound Proxying

How Cloudflare Tunnels Works

1. Outbound Tunnel Creation: The cloudflared daemon in your network establishes a persistent, encrypted TLS connection to Cloudflare’s nearest edge server. This outbound-only approach avoids firewall rules or open ports.
2. DNS-Based Routing: Traffic to your domain (e.g., home.example.com) is routed to the tunnel via a CNAME record pointing to .cfargotunnel.com.
3. Zero Trust Enforcement: Cloudflare applies authentication policies (e.g., MFA, geo-blocking) before forwarding requests through the tunnel to your local service.

Security Consideration Using Cloudflare Tunnels

• Encryption: Traffic is encrypted via TLS between cloudflared and Cloudflare’s edge. However, Cloudflare decrypts traffic to apply security rules, requiring trust in their infrastructure.
• Attack Surface Reduction: No open ports or public IP exposure. Attackers cannot directly probe your origin server.

Best practises:

The information that a tunnel is assigned to a subdomain is public information via a DNS record. It is important to ensure the application is secure.

• Use Zero Trust policies to enforce MFA and device attestation.
• Avoid caching sensitive data to comply with Cloudflare’s ToS.
• Consider making the application available on a selected path only.

Tailscale: WireGuard-Powered Mesh Networking

How Tailscale Works

1. NAT Traversal: Tailscale uses STUN and UDP hole punching to establish direct peer-to-peer WireGuard connections between devices, even behind symmetric NAT. If direct fails, traffic relays through Tailscale’s DERP (Detour Encrypted Routing Protocol) servers.
2. Coordination Server: A central server manages public keys and IP addresses, allowing devices to discover each other without manual configuration.
3. Subnet Routing: Home servers advertise local subnets (e.g., 192.168.1.0/24) to Tailscale, enabling seamless access to all LAN devices.

Security Consideration Using Tailscale

• End-to-End Encryption: WireGuard encrypts traffic directly between devices. Tailscale’s coordination server never sees decrypted data.

Best practises:

• Follow Tailscale’s best practices to secure your tailnet
• Consider enabling Tailnet lock to prevent unauthorized devices.

VPS Reverse Proxy: Manual Tunneling

How VPS Reverse Proxy Works

1. Site-to-Site VPN: A WireGuard/OpenVPN tunnel connects your home server to a VPS. The VPS acts as a public ingress point with a static IP.
2. Reverse Proxy Setup: Nginx or Traefik on the VPS forwards requests to the VPN’s private IP (e.g., 10.8.0.2:32400 for Plex).

Security Considerations Using VPS Reverse Proxy

• Full Control: You manage encryption (e.g., TLS termination at Nginx) and firewall rules.
• Risks: The VPS’s public IP is exposed to DDoS and port scans. Mitigation requires tools like Fail2Ban and rate limiting.

Best practises:

• Harden SSH with AllowUsers and key-based auth.
• Isolate services using Docker networks and read-only filesystems.

Comparative Analysis

Feature	Cloudflare Tunnels	Tailscale	VPS Reverse Proxy
NAT Traversal	Outbound TLS tunnel	WireGuard + STUN/DERP	VPN tunnel (e.g., WireGuard)
Encryption	TLS to Cloudflare edge	End-to-end WireGuard	TLS (proxy) + VPN encryption
Ease of Setup	GUI-driven (~15 minutes)	Automatic (~10 minutes)	Manual (~2+ hours)
Latency	+30ms (Cloudflare routing)	Peer-to-peer (often <10ms)	Depends on VPS location
Ideal For	Web apps, HTTP services (e.g. Nextcloud)	Full network access, non-HTTP	High-bandwidth (e.g., Plex)

Recommendations

• Prioritize Simplicity: Cloudflare Tunnels for web apps, Tailscale for full network access.
• Maximize Privacy: Tailscale’s end-to-end encryption avoids third-party decryption.
• Handle High Traffic: A VPS with WireGuard suits media streaming or large file transfers.

By leveraging these methods, users can securely bypass CGNAT constraints.

Conclusion

IPv6 is the future—offering direct, secure connectivity without NAT. However, uneven ISP adoption means tools like Cloudflare Tunnels and Tailscale remain essential for bypassing CGNAT. As IPv6 deployment grows, the internet will finally move beyond NAT’s constraints, but until then, hybrid approaches provide the best balance of accessibility and security.