<!DOCTYPE html><html><head><title></title></head><body><div>You don't need to with this setup. There are two machines involved, a frontend, and a backend. The frontend is the only thing that needs a "clear" internet connection. This can be a cheap VPS. You then connect to that VPS from the "backend" box that just needs *some* internet connection - even just over WiFi or whatever. The frontend forwards packets to the backend. </div><div><br></div><div>On Tue, Apr 14, 2026, at 8:51 PM, Steve Wolf wrote:</div><blockquote type="cite" id="qt" style=""><div dir="ltr"><div>Assume I'm not going to have any access to the internet hardware, which is why I need some other location to host whatever I migrate my server to. I'm starting to investigate a virtual private server (VPS) at <a href="https://www.bluehost.com/">https://www.bluehost.com/</a> for example.</div><div><br></div><div>Regards,</div><div>Steve</div></div><div><br></div><div class="qt-gmail_quote qt-gmail_quote_container"><div dir="ltr" class="qt-gmail_attr">On Tue, Apr 14, 2026 at 9:36 PM Daniel Vinci <<a href="mailto:me@danielvinci.com">me@danielvinci.com</a>> wrote:</div><blockquote class="qt-gmail_quote" style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204, 204, 204);padding-left:1ex;"><div><u></u><br></div><div><div>I thought you meant as a Matrix homeserver, and I got excited. Anyway. </div><div><br></div><div>I'm behind two CGNAT connections. I have a cheapo cloud VPS that has the sole purpose of running FreeBSD and pf rdr'ing most ports to an internal server connected over WireGuard. Make sure said VPS is close to you topographically or things will get slow because TCP congestion algorithms don't really know how to handle a hop having a stupid high RTR. Yes, I have tried all the tunables and algorithms. rdr doesn't do NAT or anything, so you need some funky configuration to make sure packets leave through the WireGuard tunnel as well. </div><div><br></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">root@newcaddy:~ # cat /etc/wireguard/wg0.conf</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">[Interface]</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">PrivateKey = strictly verboten</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span><br></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">[Peer]</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">PublicKey = wHhPCBIh4NysNsM+AP84/dq2Wa/53B3NU2KgPlk5OWM=</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">Endpoint = <a href="http://74.91.124.64:5280" target="_blank">74.91.124.64:5280</a></span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">AllowedIPs = <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a></span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">PersistentKeepalive = 25</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">root@newcaddy:~ # cat /etc/start_if.wg0</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">#!/bin/sh</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">/usr/bin/wg setconf wg0 /etc/wireguard/wg0.conf</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">root@newcaddy:~ # cat /etc/rc.conf</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">hostname="newcaddy"</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">firstboot_freebsd_update_enable=YES</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">growfs_enable=YES</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">sshd_enable=YES</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">nuageinit_enable=YES</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">dumpdev="AUTO"</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"># RSA host keys are obsolete and also very slow to generate</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">sshd_rsa_enable="NO"</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">cloned_interfaces="wg0 wg1"</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">ifconfig_wg0="inet <a href="http://10.0.0.3/24" target="_blank">10.0.0.3/24</a> mtu 1420 up"</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">gateway_enable="NO"</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">firewall_enable="YES"</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">firewall_type="/usr/local/etc/ipfw/rules.conf"</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">route_wg_fib1="-fib 1 default -iface wg0"</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">caddy_enable="NO"</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">ifconfig_vtnet0="inet 172.17.31.1 netmask 255.255.0.0"</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">defaultrouter="172.17.0.1"</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">tailscaled_enable="YES"</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">nginx_enable="YES"</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">ifconfig_wg1="inet <a href="http://10.1.0.1/24" target="_blank">10.1.0.1/24</a> mtu 1420 up"</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">static_routes="wg_fib1"</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">root@newcaddy:~ # cat /usr/local/etc/ipfw/rules.conf </span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> </span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">add 100 setfib 1 ip from 10.0.0.3 to not <a href="http://10.0.0.0/24" target="_blank">10.0.0.0/24</a> out</span><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"></span></span></div><div><span style="color:rgb(0, 0, 0);"><span style="background-color:rgb(255, 255, 255);"></span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">add 65534 allow ip from any to any</span></span></div><div><br></div><div>The "frontend" box just rdrs everything using pf, as mentioned.</div><div><br></div><div>On Tue, Apr 14, 2026, at 7:26 PM, Steve Wolf wrote:</div><blockquote type="cite" id="qt-m_-1519594645361015024qt"><div dir="ltr"><div>I have a server running RedHat with two domain names and a static IP. It's hosting a couple of WordPress sites, light mail, and family photo albums.</div><div><br></div><div>Eventually we might move to an independent living community that provides its own internet, and static IP won't be possible. I figure my options at that point are colocation, dedicated (leased) server, shared server, and cloud server. Colocation is probably off the table for cost reasons.</div><div><br></div><div><div>What are the advantages/disadvantages of the other options? Which has the most bang for the buck? Are there other options I haven't thought of? Who are the best providers?</div><div><br></div><div>Optimally, I'd like a solution that gives me most of what I currently have: root access, multiple domain support, email support, MariaDB support...</div><div><br></div><div>Regards,</div><div>Steve</div></div></div></blockquote><div><br></div><div id="qt-m_-1519594645361015024sig151485415"><div>Daniel Vinci</div><div>em: <a href="mailto:me@danielvinci.com" target="_blank">me@danielvinci.com</a></div><div>mx: @xylobol:<a href="http://amber.tel" target="_blank">amber.tel</a></div></div><div><br></div></div></blockquote></div></blockquote><div><br></div><div id="sig151485415"><div class="signature">Daniel Vinci</div><div class="signature">em: <a href="mailto:me@danielvinci.com">me@danielvinci.com</a></div><div class="signature">mx: @xylobol:amber.tel</div></div><div><br></div></body></html>