How to Access Your Home Network Remotely Under CGNAT in Brunei

CGNAT makes remote access to your home network difficult but not impossible. Three technologies let you punch through CGNAT without requiring a public IP address from your ISP. Each has different trade-offs in speed, complexity, and cost.

Method 1: Cloudflare Tunnel (Free, Fastest Through Cloudflare's Network)

Cloudflare Tunnel creates an encrypted connection from a device inside your home network to Cloudflare's global network. Your services are then accessible through a Cloudflare domain, which routes traffic through the tunnel back to your home device. No port forwarding, no public IP, no CGNAT issues.

What you can do with Cloudflare Tunnel:

• Access your home NAS, security cameras, or home server from anywhere
• Host a website or application from a computer at home
• Share files with family or colleagues without uploading to a third-party service

Cloudflare Tunnel requires a domain name (roughly 10 US dollars per year) and a Cloudflare account (free). The tunnel software, cloudflared, runs on any device in your home: a Raspberry Pi, an old laptop, a NAS, or even a Docker container on your home server. It maintains an outbound connection to Cloudflare, which means it works through CGNAT without any inbound port requirements.

Installation is straightforward:

# Install cloudflared
curl -L https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64 -o cloudflared
sudo mv cloudflared /usr/local/bin/
sudo chmod +x /usr/local/bin/cloudflared

# Authenticate
cloudflared tunnel login

# Create a tunnel
cloudflared tunnel create home-tunnel

# Configure and run
cloudflared tunnel route dns home-tunnel home.yourdomain.com
cloudflared tunnel run home-tunnel

Once configured, your home services are accessible through your domain via Cloudflare's network with automatic SSL. The connection is encrypted end-to-end. Cloudflare handles the DNS, the SSL certificates, and the DDoS protection.

Method 2: Tailscale (Free, Peer-to-Peer, Easiest Setup)

Tailscale creates a private mesh network between all your devices using WireGuard. It uses NAT traversal techniques to establish direct peer-to-peer connections even through CGNAT. If direct connection fails, Tailscale relays traffic through its own servers (called DERP relays).

Tailscale is the easiest option to set up. Install the app on every device you want to connect: your home server, your laptop, your phone. Each device gets a private Tailscale IP address (100.x.x.x). From your laptop, you connect to your home server using its Tailscale IP. No port forwarding, no domain names, no DNS configuration.

The free plan supports up to 100 devices and 3 users. For a family or a small home setup, the free plan is sufficient. The connection is peer-to-peer whenever possible, which means your data does not go through Tailscale's servers. It goes directly between your devices over an encrypted WireGuard tunnel.

Method 3: NetBird (Open-Source, Self-Hosted, for the Privacy-Conscious)

NetBird is an open-source alternative to Tailscale. It also uses WireGuard for peer-to-peer connections with NAT traversal. The difference is that you can self-host the NetBird management server, meaning your network topology and access policies never leave hardware you control.

NetBird is more complex to set up than Tailscale but gives you complete control. For users who want the functionality of Tailscale without relying on a third-party service, NetBird is the answer. It can be self-hosted on a cheap VPS or on a computer that has a public IP (such as a business internet connection or a cloud VPS).

Method 3: Pangolin (Self-Hosted Reverse Proxy with Built-in Tunnelling)

Pangolin is a self-hosted reverse proxy with an encrypted tunnel architecture. You deploy Pangolin on a VPS with a public IP address. Then you install a lightweight connector agent on your home device (a Raspberry Pi, old laptop, or home server). The connector creates an outbound encrypted connection to your Pangolin server. Traffic to your Pangolin domain is automatically routed through the tunnel to your home services. Similar to Cloudflare Tunnel, but entirely self-hosted.

Pangolin gives you the same functionality as Cloudflare Tunnel (expose services from behind CGNAT through a public-facing server) without relying on Cloudflare. All traffic flows through infrastructure you control. It includes automatic SSL via Let's Encrypt, a management dashboard, and support for multiple services on different subdomains.

Pangolin works well for Brunei residents because the connector makes outbound connections only. No inbound ports required. No public IP required on your home connection. The VPS only needs to be reachable from the internet, which any cloud VPS provides.

Method 4: WireGuard with a VPS Relay (Lowest Latency, Most Control)

This is the DIY approach. Rent a cheap VPS with a public IP address (roughly 5 to 10 US dollars per month). Install WireGuard on the VPS and on your home device. Configure your home device to maintain a persistent WireGuard connection to the VPS. Then configure iptables on the VPS to forward specific ports to your home device through the WireGuard tunnel.

This gives you full control over the entire connection path with no third-party servers involved. The trade-off is setup complexity. You need to understand WireGuard configuration, iptables rules, and potentially dynamic DNS if your VPS IP changes.

Method 5: NetBird (Open-Source, Self-Hosted Mesh VPN with ZTNA)

NetBird is an open-source Zero Trust Networking platform that creates a WireGuard-based peer-to-peer mesh overlay network. Every device runs a lightweight agent that auto-connects over encrypted WireGuard tunnels. NetBird handles NAT traversal automatically using STUN/ICE (the same WebRTC techniques that power video calls). When direct P2P fails (e.g., carrier-grade NAT on both ends), connections fall back to relay servers.

NetBird is self-hostable via Docker Compose and includes a management dashboard, SSO/MFA integration (Okta, Azure, Google, GitHub), device posture checks, DNS management, activity logging, and a Terraform provider. Unlike Tailscale where the coordination server is a third-party service, NetBird's coordination server runs on your own VPS.

NetBird is BSD-3 licensed (management components are AGPLv3). It has native clients for Linux, macOS, Windows, Android, and iOS. If you want Tailscale's ease of use but refuse to trust a third party with your network topology and access policies, NetBird is the answer.

Which Method Should You Choose?

You want...	Use...
Easiest setup, zero configuration	Tailscale
Host a website or public service from home	Cloudflare Tunnel
Complete control and no third parties	NetBird (self-hosted)
Lowest latency, willing to configure networking	WireGuard + VPS

All five methods work perfectly under Brunei CGNAT because they all initiate outbound connections. None of them require inbound port forwarding. They all use encrypted tunnels that protect your data in transit.

If setting up tunnels and configuring WireGuard sounds like your entire weekend, VPS1 handles this for you. We configure remote access to your home network or set up a VPS with all the services you need, accessible from anywhere.