Best way to get IPv4 connectivity to my self-hosted services

Submitted ⁨⁨3⁩ ⁨weeks⁩ ago⁩ by ⁨Quik@infosec.pub⁩ to ⁨selfhosted@lemmy.world⁩

Hi, I live in Germany and only have public IPv6. My address changes only very, very rarely and has never changed in the time I’ve been self-hosting.

I also have a very small, pretty cheap VPS with static IPv4/IPv6 – which would seem like a great fit for some sort of tunneling/proxy setup. Now comes the question: What/how should I use it? I would like to not have the additional latency for IPv6 enabled hosts, can I just setup a reverse proxy for IPv4? Would Tailscale work for my usecase, what are some resources you found useful when using it?

Currently, I’m just hosting everything IPv6-only and hoping my address never changes, but that does not work for everyone, as especially many new buildings with fiber optic connections still only have IPv4 (strangely).

source

Comments

Sort:hotnew top

hendrik@palaver.p3x.de ⁨3⁩ ⁨weeks⁩ ago
I'd just set up the reverse proxy on the VPS and make it forward everything via IPv6. But you could also use a tunnel/VPN, everything from Tailscale to Wireguard or even an SSH tunnel would work. And there are dedicated services like Cloudflare, nohost, neutrinet, pagekite...

source
- robber@lemmy.ml ⁨2⁩ ⁨weeks⁩ ago
  I’ll add Pangolin to the list, it’s a self-hosted Cloudflare tunnel alternative.
  
  source
Shimitar@downonthestreet.eu ⁨3⁩ ⁨weeks⁩ ago
Wire guard to the vps with nftables port forwarding.

Check my wiki here wiki.gardiol.org/doku.php?id=networking%3Awiregua…

Or setup ssh with port forwarding as well. Less reliable but nothing to install on a basic Linux.

source
- ari_verse@lemmy.ca ⁨3⁩ ⁨weeks⁩ ago
  This. Using simple ssh tunneling with port forwarding in a similar scenario. Working flawlessly with zero maintenance for 5 years and counting. Very reliable
  
  source
  - Shimitar@downonthestreet.eu ⁨3⁩ ⁨weeks⁩ ago
    Not really reliable, much less than wire guard. If your connection is unstable ssh not the best option. Autossh make it better, but still after a forced disconnection ssh will take a while to drop and reconnect. Wire guard is much better. I moved from ssh+autossh to wireguard and wished I did that sooner.
    
    source
    -> View More Comments
- DevoidWisdom@sh.itjust.works ⁨2⁩ ⁨weeks⁩ ago
  I do this already, but I’m going compare my nftables rules when i get home. You’re ip table looks more elegant.
  
  source
SpacePirate@lemmy.ml ⁨3⁩ ⁨weeks⁩ ago
Curious question, why would IPv6 introduce additional latency?

source
- cmnybo@discuss.tchncs.de ⁨3⁩ ⁨weeks⁩ ago
  It doesn’t, but running everything through a tunnel to get IPv4 access would. OP wants only the IPv4 traffic to go over a tunnel.
  
  source
randombullet@programming.dev ⁨2⁩ ⁨weeks⁩ ago
Ionos.de has a €1 a month VPS

I think 1 core, 1gb ram, and 10gb.

Use either caddy or Nginx proxy manager. Both are easy to setup. Also both are dockerized.

I use Tailscale as my tunnel.

Total latency is about 70-90ms for me.

source
- lemonuri@lemmy.ml ⁨2⁩ ⁨weeks⁩ ago
  I did something very similar via netcup tiny vps, nginx and wireguard. I could post my setup notes tomorrow if you someone needs them.
  
  source
thelittleblackbird@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
Small and stupid question.

Why don’t use a ddns client to update your ipv6 evytime it changes? With a ttl of a minute your shouldn’t be able to see any downtime…

I (genuinely) thinks you are trying to solve a small problem in the complicated and hard way… M

source
- Keelhaul@sh.itjust.works ⁨2⁩ ⁨weeks⁩ ago
  Plenty of IPv4 only networks still exist from which you would not be able to access the services. I am in a similar situation as OP with my offsite address being IPv6 + CGNAT IPv4 and my own address being IPv4 only.
  
  source
  - thelittleblackbird@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
    Plenty of ipv4 only in 2025?? Really?? Without a possibility to activate dual stack or just the dslite-crap?
    
    I honestly didn’t think this could be a real issue in those years.
    
    source
    -> View More Comments
2xsaiko@discuss.tchncs.de ⁨3⁩ ⁨weeks⁩ ago
Yes, you can just use a reverse proxy for IPv4 only and point it to the IPv6 upstream. That is what I do, with a separate DNS record which then combines the two. See the DNS records for id.knifepoint.net (CNAME), http.vineta.knifepoint.net (AAAA, A) and vineta.knifepoint.net (AAAA).

source
- rirus@feddit.org ⁨3⁩ ⁨weeks⁩ ago
  But having a reverse proxy would enable someone getting access to it to read traffic, while having a VPN Tunnel won’t.
  
  source
  - 2xsaiko@discuss.tchncs.de ⁨3⁩ ⁨weeks⁩ ago
    If someone manages to get root (!) access on this VPS it’s over either way.
    
    source
    -> View More Comments
  - gray@pawb.social ⁨3⁩ ⁨weeks⁩ ago
    Your reverse proxy should have a cert with HTTPS.
    
    source
    -> View More Comments
spanac@lemmy.zip ⁨2⁩ ⁨weeks⁩ ago
I have a similar situation, where I only get a public IPv6 prefix. I ended up renting small vps at netcup and installed OpenVPN and ha-proxy. My home router connects to the VPS’s public IP and I do port forwarding for the services I need, or use the proxy.

Initially I setup SNAT for my web server (otherwise replies were going out the wrong interface) and that meant you don’t see the public IP of the connecting client in your access logs.

Recently I switched to using ha-proxy which does tcp level proxying and works well with ports 80 and 443 and Traefik, which i use to expose my docker containers.

My connection chain looke like vps -> ha-proxy -> OpenVPN -> port forward to Traefik -> reverse proxy to the final service. It’s not a fast server, and I didn’t measure latency, but it’s for sure not small.

As others have mentioned, ha-proxying to your IPv6 might be an interesting solution, and I think I will also try it out.

source
csm10495@sh.itjust.works ⁨3⁩ ⁨weeks⁩ ago
Another option if you need public access without something like tailscale would be to use ddns and a AAAA record. Something like github.com/ddclient/ddclient would help do that.

That way if the IP changes, you’d pick up on the change for your vanity url within a few minutes… and can get https certs for that url as well.

source
tfowinder@lemmy.ml ⁨3⁩ ⁨weeks⁩ ago
I have a VPS hosted on Digital ocean with Nginx running as proxy, I use openvpn to connect to the VPS and access all my services over the VPS ip address.

I own a domain and forward all the requests from my domain to the Home server IP from my VPS, very useful because I can use different subdomains for different services all on port 80 or 443 even though the service is running on random port.

source
yournamehere@lemm.ee ⁨2⁩ ⁨weeks⁩ ago
simplest that comes to mind is a reverse ssh tunnel and a reverse proxy on the vps maybe

source
Brkdncr@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
vpn to your vps for ipv4.

Dynamic dns to whatever your local hosted services use in case your local ipv6 changes. I’d just use the vps vpn for everything though unless the speeds are really bad.

source