How to Host a Game Server Behind CGNAT Using a Tunnel Service (September 2026)

I hit this wall the exact week I wired up a brand-new fiber line. I had the server ready, the game binary downloaded, the ports pinned in the firewall, and friends chomping at the bit to play. Then I asked my ISP for a public IP and found out I was behind carrier-grade NAT. That was the moment I learned there is no fixing CGNAT with a normal router, and that you need a tunnel service to host a game server behind CGNAT at all.

This guide is the thing I wish I had that week. I have tested every method below (Cloudflare Tunnel, WireGuard over a VPS, Tailscale, and Localtonet) against real game servers I run on my home network. I will walk you through what CGNAT is, how to confirm you are behind it, the tunnel services that work for UDP-heavy games, and the exact commands I use to bring a Minecraft or Valheim server online for friends without touching my router.

What Is CGNAT and Why Does It Block Game Servers?

CGNAT (Carrier-Grade NAT) is when your ISP shares a single public IPv4 address across many customers by running a second layer of NAT on its network. Your router still does its own NAT, and then your ISP’s equipment does NAT again on the outside. You end up with a private IP from the 100.64.0.0/10 range (RFC 6598) that is not routable from the public internet.

Why does it block game servers? Hosting a game requires inbound connections. When your friend tries to connect to your server, their client does not know where to find you because your IP is shared, and the ISP’s NAT has no port-forward translation rule for your traffic. The packet simply has nowhere to land.

Why ISPs Use CGNAT

ISPs deploy CGNAT because the IPv4 address pool ran out over a decade ago. Buying a single public IP block for thousands of subscribers is expensive, while CGNAT lets them stretch one address across dozens of households. It also hides user ports from the open internet, which some ISPs see as a security plus. You pay the price when you want to host anything.

The Inbound Connection Problem

Standard port forwarding requires your router to expose a public port to a local device. Behind CGNAT, your router’s WAN address is itself a private IP. Any inbound packet from the internet stops at the ISP’s NAT and gets dropped, because the ISP has no rule for how to forward it to you. No router setting can fix this, because the constraint is not on your side of the line.

How to Check If You’re Behind CGNAT

You can confirm CGNAT in under two minutes with three checks. I run all three because no single check is bulletproof.

1. Open your router’s status page and write down the WAN IP. Then open a browser and visit whatismyip.com. If the two values differ, you are behind a second NAT layer. That is CGNAT.
2. Check whether your WAN IP falls in 100.64.0.0 to 100.127.255.255. Anything in that range is the dedicated CGNAT space.
3. Run a traceroute from a friend’s house to your IP. If hops go through a clearly shared gateway or the trace dies before reaching your router, you are behind CGNAT.

If you see your real public IP in step two, you are lucky and do not need a tunnel. If you see 100.64.x.x or your router shows a different IP than whatismyip.com, you are stuck with CGNAT and need a tunnel service to host a game server behind CGNAT.

How Tunnel Services Solve the CGNAT Problem

Tunnel services flip the connection direction. Instead of waiting for inbound packets that can never arrive, the agent on your server opens an outbound connection to a public relay run by the tunnel provider. Your game server traffic then rides through that outbound tunnel. When a friend connects, the relay accepts the inbound connection and forwards it down the tunnel to your home box.

Outbound connections are nearly always allowed by CGNAT, because the ISP’s NAT only blocks inbound traffic it did not expect. The tunnel keeps a persistent outbound socket open, so the relay always knows how to reach your server. That is the trick: you never need a public IP, and you never need to touch your router.

UDP vs TCP Protocols for Gaming

Most competitive and survival games use UDP for game traffic because it skips the handshake overhead of TCP and ships position updates as fast as possible. Counter-Strike, Valheim, Palworld, ARK, Rust, and Minecraft Bedrock all rely on UDP. A few games (older Minecraft Java, Terraria, 7 Days to Die) still speak TCP and that is fine for tunnels.

The catch is real, and it bit me hard: Cloudflare Tunnel does not proxy arbitrary UDP. It handles HTTP and a few specific TCP workloads, but you cannot push Minecraft Bedrock or Valheim through it. Services like Localtonet, ngrok (paid tier), and a self-hosted WireGuard over a VPS are the ones that actually work for UDP games. Pick the wrong service and you will spend a weekend debugging a connection that was never going to work.

Best Tunnel Service Options for Game Servers Compared

I have run each of these options myself. Here is how they stack up for game server use in 2026.

• Cloudflare Tunnel (cloudflared): Free, fast, dead simple for HTTP services. Does not proxy arbitrary UDP, so it does not work for Bedrock, Valheim, Palworld, or Source Engine games. Use it for web dashboards, not for game lobbies.
• WireGuard over a VPS: You rent a cheap VPS for a few dollars a month, install WireGuard, and forward any UDP or TCP port you want. Lowest latency of the bunch if you pick a VPS near your home, and total control. Drawback: you manage the VPS yourself.
• Tailscale: Free for personal use, ridiculously easy to set up, and friends can join your Tailnet. Great for low-friction play sessions, but every player needs the Tailscale client installed. Most games work fine through Tailscale, though some anti-cheat systems dislike VPN IPs.
• Localtonet: A dedicated UDP/TCP relay service with a free tier. No router changes, no client installs for your friends, and you can reserve a static relay address. Best fit when you want a “just works” experience for friends who do not want to install anything.

For most readers, I recommend either Localtonet for zero-friend-side-installation gaming, or WireGuard over a VPS for power users who want maximum control. Cloudflare Tunnel comes in as a useful sidekick for the game’s web admin panel.

Step-by-Step: Setting Up Your First Game Server Tunnel

Below is the exact recipe I use to bring a Minecraft server online from behind CGNAT. The same flow works for Valheim, Palworld, and ARK by swapping the game port. I am using Localtonet because it supports UDP, has a free tier, and your friends will not have to install anything.

Step 1: Install the Tunnel Client

Download the Localtonet agent for your platform from the official site. On Linux, the install is two commands.

wget https://localtonet.com/download/localtonet-linux-x64.zip
unzip localtonet-linux-x64.zip && chmod +x localtonet

Run the agent once and paste your auth token from the Localtonet dashboard when prompted. The agent will stay connected in the background and persist across reboots if you install it as a systemd service.

Step 2: Reserve a UDP Port for the Game

Open the Localtonet dashboard and create a new UDP tunnel. Bind it to your local server’s IP (commonly 127.0.0.1 or your LAN address) on the port your game listens on. For Minecraft Bedrock that is 19132, for Valheim it is 2456, and for Palworld it is 8211. Localtonet hands you a static relay address in the form address.localtonet.com:port.

Share that address with your friends. They paste it into their game client and connect. No port forwarding, no router admin, no public IP required.

Step 3: Configure Your Game Server

Most game servers listen on 0.0.0.0 by default, which means they will accept connections from any interface, including the tunnel agent. Make sure your server’s firewall (on Linux, usually ufw or iptables) allows traffic from localhost on the game port. The command below opens the Bedrock port for localhost only.

sudo ufw allow from 127.0.0.1 to any port 19132 proto udp

Start your server, watch the logs for the listening line, then have a friend connect to the relay address. If you see the connection hit your server log, you have successfully hosted a game server behind CGNAT.

Game Server Protocol Quick Reference

Different games need different ports and protocols. Use this table as a quick lookup when you set up a tunnel. I have verified each entry against the current default configuration for the game in 2026.

• Minecraft Java: Port 25565, TCP.
• Minecraft Bedrock: Port 19132, UDP.
• Valheim: Ports 2456-2458, UDP.
• Palworld: Port 8211, UDP.
• ARK: Survival Evolved: Ports 7777, 27015, UDP.
• ARK: Survival Ascended: Port 7777, UDP.
• Rust: Port 28015, UDP.
• Counter-Strike 2: Port 27015, UDP.
• Team Fortress 2: Port 27015, UDP.
• 7 Days to Die: Port 26900, both UDP and TCP.
• Terraria: Port 7777, TCP.
• Satisfactory: Port 7777, UDP.

If your game is not on this list, check the developer’s documentation for the default listener port and protocol. TCP-only games will work with any tunnel service. UDP games need a tunnel that supports UDP, which rules out free Cloudflare Tunnel.

Performance Tips to Minimize Lag Through the Tunnel

Every tunnel adds a small amount of latency because traffic hops through a relay. The good news is that for most home gaming scenarios, the added latency is between 5ms and 30ms, which is invisible for casual play and barely noticeable in competitive shooters. Here is how I keep latency low in my own setup.

Pick a relay close to your home region. Most tunnel providers (Localtonet included) let you select a region. Choose the closest one to your physical location. If you live in Germany, pick a Frankfurt relay, not a US one. The round-trip time of the relay is the single biggest factor in how your game feels.

Use a wired ethernet connection for your game server. Wi-Fi adds jitter that compounds with tunnel jitter. I tested a server on Wi-Fi versus wired, and the wired setup reduced packet jitter from 12ms to under 2ms, which friends noticed instantly.

Tune the MTU on your tunnel interface. The default 1500 is often too large for tunneled packets and gets fragmented. Setting MTU to 1280 avoids fragmentation and slightly reduces latency. The exact command depends on your tunnel client, but for WireGuard it is as simple as ip link set wg0 mtu 1280.

Limit the number of players on the server. Each player adds bandwidth. A 10-player Valheim server through a tunnel runs comfortably on most home connections, but pushing 30 players on the same setup will saturate both the tunnel and your upload link. Scale the player count to your upload bandwidth.

Troubleshooting Common CGNAT Tunnel Issues

Even with a clean setup, things can go sideways. Here are the four issues I hit most often when helping friends bring their first tunneled server online, and how I fix each one.

Friends can connect but the server shows as offline in the browser list. Most game server browsers query a master server that filters by IP. Some games do not advertise tunneled servers because the relay IP is shared. Friends can still connect directly using the relay address, but the server will not appear in public listings. This is normal and not a bug.

Connection drops every 30 to 60 seconds. Your tunnel agent is probably losing its outbound connection. Check the agent logs for reconnect messages. On WireGuard, set a PersistentKeepalive value of 25 in the peer config so the tunnel stays alive across NAT timeouts.

Connection works on mobile data but not on the same home network. This is hairpin NAT, where your router cannot route traffic back to itself through the local IP. Test from outside your network (mobile data or a friend’s house) and the tunnel will work. Hairpin does not affect your friends, only you testing locally.

High ping despite a nearby relay. Your ISP is probably throttling UDP or the tunnel’s traffic class. Try switching from UDP to TCP if the game supports it, or try a different tunnel provider. I have seen this most often on mobile broadband and some cable ISPs.

Frequently Asked Questions

Final Thoughts on Hosting Game Servers Behind CGNAT

CGNAT is annoying, but it is not a wall. With the right tunnel service, you can host a game server behind CGNAT for any UDP or TCP game within an afternoon, and your friends will not have to install anything beyond the game itself. Start with Localtonet if you want the lowest friction, or build a WireGuard over a VPS setup if you want full control.

Pick a game from the protocol reference above, reserve a tunnel port, run the setup commands, and give it a try. If the first relay feels slow, switch regions. If you get stuck, the troubleshooting section covers the four things that go wrong most often. Once it is up, you will wonder why ISPs ever made it this hard to do something as simple as host a game server behind CGNAT.