What breaks when you try to reach your own server
I could not reach my own server from outside, and I wanted to know whether that was my problem or a general one. So rather than guess, I counted: a year of threads across thirteen self-hosting subreddits, read and sorted. Some of it contradicts the advice those subs repeat most — including advice I used to give.
31 August 2026 3,268 posts 1,274 comments 61 threads 13 subreddits
How this was collected
Searches across r/selfhosted, r/homelab, r/HomeNetworking, r/HomeServer, r/jellyfin, r/PleX, r/CloudFlare, r/Tailscale, r/synology, r/unRAID, r/truenas, r/docker and r/pihole, for the obvious terms — cloudflare tunnel, cgnat, port forwarding, ddns, reverse proxy, remote access — limited to the last twelve months, deduplicated. Of 3,268 posts, 843 were directly on topic by title. Comments came from the 61 threads with the most discussion, keeping those scored 3 or above.
This was done with an AI assistant, and that is worth saying plainly. Reading a year of threads by hand was not something I was going to finish, and the question I actually had — is this just me? — needed volume to answer. The model ran the collection through a browser session, deduplicated, counted the mentions, and made the first pass at grouping complaints into the categories below. I set the questions, checked the groupings against the threads, and wrote the conclusions.
What that means for you: the things a model gets wrong are miscounts, quotes lifted out of context, and two different complaints merged into one category. All three are checkable, which is why every quote below is verbatim and every thread is in the raw data. If a number here looks wrong, it probably is — tell me and I will fix it.
Where this is wrong
Keyword sampling misses pain the community names differently — if people describe a problem in words I did not search for, it is not here. Comment collection stopped at 61 threads because Reddit rate-limited it, and those threads skew toward engagement, which skews toward controversy. It is English-language Reddit, so the ISP situation described here is not everyone's; there is no Latin American data in it at all. Counts below are from this sample, not from the subs as a whole.
The problem has four layers, and the famous one is the easy one
Most of the arguing in these threads comes from treating different layers as the same question.
Dynamic DNS is layer 1: an agent notices your residential IP changed and calls an API to update an A record. It is an HTTP request on a timer. DuckDNS, No-IP, Dynu and the Cloudflare API all do it, mostly for free.
The bleeding happens in layers 2, 3 and 4 together — and it gets far worse when the person trying to connect is not you, and their device will not run software.
What actually breaks, ranked by how often it came up
CGNAT: there is no public address to point at
95 mentions
The ISP puts the customer behind carrier-grade NAT. There is no port to forward, and dynamic DNS becomes pointless because the address it publishes does not route to you. This is the moment that creates demand: someone upgrades to fibre, gains speed, and loses remote access.
"Just got fiber… but CGNAT killed my Plex dreams 😭"
r/PleX — 170 points, 333 comments
Worth trying before spending money: a recurring reply is that phoning the ISP and asking to be moved off CGNAT works in some markets. One person reported it "sorted in about 5 minutes" (102 points). The paid alternatives are a dedicated IP at around $15 a month, IPv6 where it exists, or a reverse tunnel.
The visitor is not technical, and their device will not run a VPN
55 mentions — the most underestimated finding here
Smart TVs, Roku, Fire Stick, Chromecast, consoles and hotel televisions do not install VPN clients. And even on a phone that could, a relative will not open an app and press connect before watching something.
"My parents especially — they're not going to open a VPN app and hit 'connect' every time."
r/PleX
"Their smart TVs can't connect to tailscale, they forget to connect on their phones for vaultwarden."
r/selfhosted
"As someone whose Plex server is used by a lot of old/tech-inept people, it would be an abject nightmare."
40 points
There is an entire thread called How do people share their VPN protected stuff to tech illiterate people? — 220 points, 215 comments, and no satisfying answer inside it.
The consequence is blunt: anything requiring software on the visitor's side is disqualified for sharing with other people, which is most of what these threads are actually about.
Fear of exposure, and incidents that justify it
127 mentions
Two large threads argue the question directly — Is port forwarding that dangerous? (396 points, 313 comments) and Why does everyone insist on no public facing ports? (503 points, 427 comments) — and they are the same argument from opposite ends. Alongside them sit the incidents:
"Accidentally exposed publicly my entire LAN for 2 weeks"
r/selfhosted — 536 points
"My Raspberry Pi music server has been infected by a Ransomware"
r/selfhosted — 1,379 points
The useful distinction that emerged from the argument: exposing an application you maintain, with unknown patch latency, is a different risk from exposing one hardened process whose only job is to authenticate. People conflate the two and then talk past each other.
What most of them want is not everything closed. It is a safe default that does not require understanding the threat model first.
Managed tunnels have specific, documented walls
120 mentions of Cloudflare Tunnel
People who use it mostly like it, and then hit one of these:
- 100 MB per upload on the free and Pro plans, returning 413. It kills photo and video backup. One r/unRAID user removed their tunnel over it: "my apps (specifically Immich) isn't able to use the tunnel properly; the max free upload size being 100Mb, my videos aren't backing up."
- Edge authentication breaks native apps. The second most upvoted comment in the PSA to Cloudflare Tunnel users thread: "Cloudflare application oauth is not compatible with basically all mobile apps FYI. Bitwarden cannot sync the vault with this in place. Immich can't login."
- The media terms stay ambiguous. The CDN terms restrict serving video, and the community argues endlessly about whether a tunnel with caching off is covered. The practical effect is not mass enforcement — it is background anxiety across every Jellyfin and Plex install (37 mentions).
- TCP and HTTP only, so games and anything over UDP are out.
- TLS terminates at their edge, which is the stated reason a recurring group refuses the whole category.
Too many options, and the recommended stack is enormous
32 explicit mentions of being confused or giving up
The stack this community recommends has six or more moving parts: a VPS, a proxy, WireGuard, certificates, an identity provider, an intrusion blocker, GeoIP filtering. Nobody who just wants their mother to watch a series on her phone is going to assemble that.
"Well. I'm sure OP is even more overwhelmed by the new barrage of options provided in response to their post about feeling overwhelmed by the number of options."
41 points
Hostile networks: DPI, campus firewalls, national blocking
Lower volume, highest intensity
"College WiFi blocks EVERYTHING (Cloudflare Tunnels, Tailscale, Steam). How do I bypass strict DPI?"
812 points, 393 comments
"I self-host a tunnel in a country that actively hunts them. Here's what survives, and what keeps me up at night"
1,084 points
A niche, but it explains why looking exactly like ordinary web traffic on port 443 is a feature rather than an implementation detail.
Free dynamic DNS is flaky — and it barely matters
49 mentions, 130 posts with DDNS in the title
The complaints are real and shallow: outages, slow propagation after a power cut, an update script that broke, an out-of-date Docker client. Engagement is low — the largest such thread has 68 comments, against 439 on a single remote-access question.
This is the finding that reordered my own plans. Dynamic DNS is a solved commodity, and a product built on it is a product built on the one layer nobody is bleeding from.
The incumbents just started charging for remote access
Market trigger, one thread with 277 comments
Plex now charges for remote streaming: the Remote Watch Pass moved from $1.99 to $2.99 a month on 1 June 2026, and the lifetime pass went to $750. The visible effect is people migrating to Jellyfin — which ships no remote-access solution at all. That is demand walking straight into this problem, right now.
What surprised me most
The community answers "remote access", but the threads with the most pain in them are about sharing with someone else. Those are different problems, and the standard answer only solves the first.
Every "just use Tailscale" reply under a Plex or Jellyfin question is answering a question nobody asked. Tailscale is excellent at what it does — it puts your devices on one network — and that is not the same as letting your father watch something on a television that will never run a client.
The question I could not answer
Everything here comes from people who posted. There is a category of pain that never shows up in a thread, because whoever hit it gave up quietly instead of writing about it. I have no way to measure that from this data, and I suspect it is the most interesting group.
If that was you, the front page has the same questions and a box to answer them in. Or reply wherever you found this — either reaches me.