How to host a webserver through NAT?

Question

Alright, my situation isn't exactly the normal. I've come across many "How to host something while behind NAT". None are like my situation (I knew how to host a server through a simple NAT anyway).

This is how my ISP works....

First, start off with the public IP address (208.87.xxx.xxx), then it's "NATed" down from a wireless tower to all the clients (172.16.xxx.xxx), then the clients pick it up to their routers and NAT it from there (my situation, for example, is typical. 192.168.0.100 - 192.168.0.254).

I like to say I'm "double NATed".

I want to host a web server. Specifically a music server running a program Sockso. By default it uses port 4444. I happen to prefer that port but I can change it.

How can I go about it or is it not possible?

Thanks!

Answer 1

It's most likely not possible.

You can set a NAT rule on each router, the first from the public IP 208.87.xxx.xxx to the intermediate IP 172.16.xxx.xxx. Then the next router has a NAT rule from the 172.16.xxx.xxx to the internal IP, 192.168.0.x.

But I'm going to assume that your ISP controls the first NAT and won't setup a rule for you.

Answer 2

As you don't control the outer NAT, so can't set any port forwarding rules on it, you can not do this directly.

If you are looking to just use the service yourself, on your own PCs/laptops and other machines you have some control over, you could use a VPN solution like Hamachi to share the service between locations. Friends could access the service by the same means. Unless the VPN's NAT-punching technique works through your two-level arrangement, there will be extra latency involved, of course.

If you want to make you service more publicly available (so you can access it from almost any machine and/or so the general public can see the service) then you can set this up if you have some sort of external server such as a VPS. You can then setup you own VPN on the external service, connect to that from your home machine that is running Sockso, and have the server redirect the port on its public interface back down the line over the VPN. A simple SSH tunnel should do the trick, as would OpenVPN. Obviously this is not zero cost, but even the cheapest VPS should be able to host a small SSH server for this purpose, even the $1-or-2/month silly-small ones (64Mb RAM and a Gb or two disk space) that are occasionally seen (though the bandwidth allowance on those might be quite limiting, and be careful to make sure they don't count it as running a proxy if their TOS prohibits running a proxy). You will definitely see extra latency on the service with this method - as any connection to your server will have to go into and back out from the VPS.