Networking · Remote lab
A remote lab behind CGNAT
An isolated server I can reach from any network, built on a laptop. Halfway through I found that my ISP puts the connection behind CGNAT, which makes port forwarding impossible, so the final design looks nothing like the plan.
Design challenge
Keep the lab separate from the host it runs on, and still reach it from a MacBook on any network.
Engineering focus
A KVM and libvirt virtual machine running Debian, iptables DNAT and router port forwarding, a step by step diagnosis of why inbound traffic never arrived, and Tailscale as the working answer.
What I learned
Test the path before building on it. Two hours of firewall work could never have succeeded, and the debugging log, error index and methodology notes are the most useful part of the write up.
Next project
Bitcoin price prediction, honestly measured