[Guide] How to host web server in CGNAT with ports like 8096

Hey guys, I finally figured out how to host a server in Jio Fiber or under CGNAT for ipv4 only isp's, so here is the detailed guide for it.

Prequisitories:

• Docker on your server for ipv4 support
• Any domain (eg: tk, ml, ga, cf, gq)
• A Cloudflare account.

DO NOT TRY THIS IF YOU DON'T FEEL SAFE IF ANYONE CAN ATTACK YOUR NETWORK OR STEAL YOUR SENSITIVE DATA, THOUGH IT IS VERY UNLIKELY. Let's begin.
Setup-1:


install docker on your Linux machine for me it is going to be a Raspberry PI 4 GB version and the Linux Distro is Raspberry PI OS. Follow these steps to install docker: Install Docker Engine. Docker can be installed on Windows too, but Linux is recommended

Now we need to install "Nginx Proxy Manager" on it. Follow this universal guide-Install Nginx Proxy Manager on a Raspberry Pi 4 - DB Tech. PS: use "yobasystems/alpine-mariadb" image for the database in arm based computers like rpi4.

Now we need to install portainer.First type this command: docker network create portainer_agent_network and then: docker service create --name portainer_agent --network portainer_agent_network --publish mode=host,target=9001,published=9001 -e AGENT_CLUSTER_ADDR=tasks.portainer_agent --mode global --mount type=bind,src=//var/run/docker.sock,dst=/var/run/docker.sock --mount type=bind,src=//var/lib/docker/volumes,dst=/var/lib/docker/volumes --mount type=bind,src=/,dst=/host portainer/agent . More deatailed way provided here-https://documentation.portainer.io/v2.0/deploy/linux/. Setup portainer and select docker as an endpoint, if you don't see an option feel free to comment.

Now we need a domain, follow the steps given below.

Enabling ipv6 for docker-1.1:
follow Enable IPv6 support
Now we will use portainer here,
Go to containers in portainer and select nginx-app-1 or equivalent, scroll down till you see the network section, and click on the Dropbox menu and select bridge and click join the network.

we have enabled ipv6 and now we can continue
Setup for domain:
We can get a free domain on freenom as I did.
Once you get a domain go to cloudflare and login or sign up for an account there, after that we need to add the domain that we just got or any existing domain that you had previously purchased and just follow the steps given by cloudflare to use cloudflare instead of your domain provider.
Once all of that is complete go to your domain or "zone" dashboard and go to dns.
We need to add an AAAA record pointing to our server.

Click on add a record[fig 1] and select AAAA type, add @ in name and your ipv6 address in the ipv6 address text box[fig:2]

You can create a cname record which would go infront of your domain eg: Fig:3, the value of name replaces www and you need to add @ in target as it would use your domain as the its domain. The domain for this eg is going to be example.yourdomain.com

Fig:1

Fig:2

Fig:3



Setup for Nginx Proxy manager:

Now we will move to our reverse proxy manager. Before we start make sure that your server doesn’t have an occupied port 80. Now that is out of the way lets begin:

• Login to your Nginx Proxy Manager by using your server’s ipv4 address with :81 at the end. Example: http://120.0.0.1:81
• Default login is Username: [email protected] and Password is “changeme”, after you login for the first time it will ask you some details and fill them correctly with your correct email address(required for ssl cert).
• Go to proxy hosts and create a new proxy host with your domain and other options that you want. Refer Fig:4, Forward Port is your port number of your service.
• Refer Fig:5 for using SSL certificate.

Fig:4

Fig:5

Setup for Jio's firewall:

• Open your Jio router's dashboard and login to it.
• Go to security->firewall->ipv6 firewall rule and copy the settings from Fig:6

Fig:6

Great!! We are done, you should be able to access your server outside you home. Reply for help.

 

[priv4cy1sgr8]

I actually do two more things :
1. Use some paid domain as cloudflare has disabled API dns access to freenom domains. As the ip address changes after reboot of router i use a cloudflare ddns docker container to update the AAAA record automatically using API.
2. Use Cloudflare Full strict for SSL including DNSSec and HSTS for more security.
I use ACT and its the same situation CG-NAT but atleast have Public IPv6 address.

 

[priv4cy1sgr8]

also checkout homer dashboard docker container, it gives a nice dashboard to view all your hosted services.

 

[PrayagPrajapati]

2. Use Cloudflare Full strict for SSL including DNSSec and HSTS for more security.

I use it too, forgot to add it, and also mention to turn of proxy while getting SSL cert

 

[PrayagPrajapati]

also checkout homer dashboard docker container

I am more comfortable with portainer

 

[ackr8]

@PrayagPrajapati homer is not a portainer replacement, instead a dashboard to easily access your hosted services instead of remembering the port and ip of each service. here is my homer setup.

 

---

[PrayagPrajapati]

Ohk thanks to know, I actually learned about it few days back only

 

[sheikmeister]

I can't connect to my JIO ONT's ipv6 from the internet, has anyone faced such an issue?

 

[rahulnegi1409]

ngnix reverse proxy will only redirect http requests
which usually can be done with xampp or any other webserver

i think with your method we still cant make any request from the host's IPv4 address whatsoever

the hostname is just redirecting AAAA records to whosoever is making the request

it might show that , we are accessing webserver from ipv4 but actually its just a redirection from hostnam's record and ngnix reverse proxy

try to access from ipv4 adrress and see if its accessible ( which i doubt it will )

 

[rahulnegi1409]

@sheikmeister

if you mean you cant ping from your own system which is on jio network

then , you have to allow access in firewall for ipv6

make 2 rules ( one for incoming and one for outgoing )