<!DOCTYPE html><html><head><title></title></head><body><div>I thought you meant as a Matrix homeserver, and I got excited. Anyway. </div><div><br></div><div>I'm behind two CGNAT connections. I have a cheapo cloud VPS that has the sole purpose of running FreeBSD and pf rdr'ing most ports to an internal server connected over WireGuard. Make sure said VPS is close to you topographically or things will get slow because TCP congestion algorithms don't really know how to handle a hop having a stupid high RTR. Yes, I have tried all the tunables and algorithms. rdr doesn't do NAT or anything, so you need some funky configuration to make sure packets leave through the WireGuard tunnel as well. </div><div><br></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">root@newcaddy:~ # cat /etc/wireguard/wg0.conf</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">[Interface]</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">PrivateKey = strictly verboten</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">[Peer]</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">PublicKey = wHhPCBIh4NysNsM+AP84/dq2Wa/53B3NU2KgPlk5OWM=</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">Endpoint = 74.91.124.64:5280</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">AllowedIPs = 0.0.0.0/0</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">PersistentKeepalive = 25</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">root@newcaddy:~ # cat /etc/start_if.wg0</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">#!/bin/sh</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">/usr/bin/wg setconf wg0 /etc/wireguard/wg0.conf</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">root@newcaddy:~ # cat /etc/rc.conf</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">hostname="newcaddy"</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">firstboot_freebsd_update_enable=YES</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">growfs_enable=YES</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">sshd_enable=YES</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">nuageinit_enable=YES</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">dumpdev="AUTO"</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"># RSA host keys are obsolete and also very slow to generate</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">sshd_rsa_enable="NO"</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">cloned_interfaces="wg0 wg1"</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">ifconfig_wg0="inet 10.0.0.3/24 mtu 1420 up"</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">gateway_enable="NO"</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">firewall_enable="YES"</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">firewall_type="/usr/local/etc/ipfw/rules.conf"</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">route_wg_fib1="-fib 1 default -iface wg0"</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">caddy_enable="NO"</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">ifconfig_vtnet0="inet 172.17.31.1 netmask 255.255.0.0"</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">defaultrouter="172.17.0.1"</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">tailscaled_enable="YES"</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">nginx_enable="YES"</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">ifconfig_wg1="inet 10.1.0.1/24 mtu 1420 up"</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">static_routes="wg_fib1"</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">root@newcaddy:~ # cat /usr/local/etc/ipfw/rules.conf </span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">add 100 setfib 1 ip from 10.0.0.3 to not 10.0.0.0/24 out</span><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span class="color" style="color:rgb(0, 0, 0);"><span class="highlight" style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">add 65534 allow ip from any to any</span></span></div><div><br></div><div>The "frontend" box just rdrs everything using pf, as mentioned.</div><div><br></div><div>On Tue, Apr 14, 2026, at 7:26 PM, Steve Wolf wrote:</div><blockquote type="cite" id="qt" style=""><div dir="ltr"><div>I have a server running RedHat with two domain names and a static IP. It's hosting a couple of WordPress sites, light mail, and family photo albums.</div><div><br></div><div>Eventually we might move to an independent living community that provides its own internet, and static IP won't be possible. I figure my options at that point are colocation, dedicated (leased) server, shared server, and cloud server. Colocation is probably off the table for cost reasons.</div><div><br></div><div><div>What are the advantages/disadvantages of the other options? Which has the most bang for the buck? Are there other options I haven't thought of? Who are the best providers?</div><div><br></div><div>Optimally, I'd like a solution that gives me most of what I currently have: root access, multiple domain support, email support, MariaDB support...</div><div><br></div><div>Regards,</div><div>Steve</div></div></div></blockquote><div><br></div><div id="sig151485415"><div class="signature">Daniel Vinci</div><div class="signature">em: <a href="mailto:me@danielvinci.com">me@danielvinci.com</a></div><div class="signature">mx: @xylobol:amber.tel</div></div><div><br></div></body></html>