Does your ISP block ports? Many do, at least where I am. Some allow you to opt-out.

I may be stupid, but I want to learn.

Wanting to learn is the least stupid thing there is.

I have the same problem, I think the ISP blocks incoming traffic to residential IPs (non static).

Glad you got it working, but you could have hosted it with a tor hidden service and not had to pay for a public IP address and shit.

Because you’re serving the website on a non-standard port, you will always need to provide the port in the web browser.

That said, I don’t see anything wrong here. It looks like you’ve got the right ports set, TCP should be correct. You may not get a ping, because ICMP is likely not enabled at the modem. When you ping, you ping the first device that’s exposed to the internet, not an open server.

Just to be sure, when you’re on your phone, you’re using data? If you’re on wi-fi, the modem/router may not be configured to perform NAT reflection, so you won’t be able to access anything via your WAN IP.

Are you on carrier grade NAT (CGNAT) WAN ip in the address space 100.64.0.0 to 100.127.255.255?

2 potentials

ISP blocking Web hosting ports/traffic - often opt Out or flat out blocked for residential connections.

ISP using CGNAT so your “public ip” isn’t really public? But you got this far so i would guess you already know that.

For reference, the cgnat “public ip range” should be 100.64.0.0 to 100.127.255.255

If you do have cgnat i think maybe cloudflare tunnels, tailscale or a vps are your solutions.

Your ISP might make you go through another layer of NAT. Can you find the WAN IP address of your router and compare it to your public IP address from a website such as ipinfo.io ?

If they do not match, you’re probably out of luck and will need to forward your port from an actually public IP in order to achieve what you want

More details : CGNAT (Carrier Grade Network Address Translation) is basically a second router between your router and the public internet. This second router is configured in the same way as your personal one, the main difference being that your ISP fully manages it. From the viewpoint of this second router, your WAN IP is a private IP, and you share one actual public IP with several other customers (the same way all devices on you LAN share one single WAN IP)

Performing port forwarding from the public internet to your LAN, when behind a CGNAT, would require you to be able to configure a forwarding rule in the ISP’s NAT, which you usually cannot do.

In my experience it’s not safe to port forward if you don’t know how everything works. Why don’t you use Tailscale? It works well and it even has Mulvad plugin

Forward ports 80 and 443, set them up in nginx config and use certbot to get a SSL certificate if you have a domain for your site.

Why don’t you use a Cloud flare zero trust tunnel? In this way you don’t need a public IP and open port on your router.

Don’t do that

Get a VPS and host it there.

It’s probably a bit dangerous to expose your internal network in this way. If you really want a server running at home, there are interesting services which provide that for a fee, or you could set up a “reverse ssh proxy”.

It’s easier to do on some flavor of Linux, but you will set up a background service to ssh to a cloud server you rent, which links a local port on the cloud server to a local port on your home computer. You can then run a web service like caddy server on the cloud server to securely serve this port.

I realize this sounds rather complex, but something to look into and learn.

Your Caddyfile on the cloud server will look something like this:

my_subdomain.my_domain.com {
    reverse_proxy / {
        to 127.0.0.1:8081
    }
    encode gzip
}

And the service on your local will look something like this:

[Unit]
Description=Keeps a reverse tunnel to '<your cloud server ip>' open on port 8081 on the remote server
After=network-online.target

[Service]
Environment="AUTOSSH_GATETIME=0"
ExecStart=/usr/bin/autossh -N -M 10986 -o "PubKeyAuthentication=yes" -o "PasswordAuthentication=no" -o "ExitOnForwardFailure=yes" -R 8081:127.0.0.1:8080 root@<your cloud server ip> -i <path to your ssh key> -p 2097

ExecStop=/bin/kill $MAINPID
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target

You will have to allow ssh on a non standard port (arbitrarily 2097 here), that way you can still use ssh on the standard port 22. I have some services running like this through a NAT for years.

deleted by creator