Homelab / Architecture

Connectivity

Dual 5G uplinks, carrier-grade NAT, outbound tunnels and IPv6 via a WireGuard broker — internet without port-forwards.

Two 5G uplinks. Carrier-grade NAT. No inbound port.

The lab does not sit on a classic fixed line with a public IPv4 address. Upstream is two independent 5G links — and both sit behind carrier-grade NAT (CGNAT). The provider does not assign a real public address; inbound port-forwarding is not a viable strategy.

Constraint as a feature

CGNAT sounds like a limitation at first. For this portfolio it is the design brief:

  1. No port-forward as the primary path — nothing punches holes into the site from the outside.
  2. Outbound first — the lab builds tunnels out to an identity-aware edge.
  3. Dual remote — browser/HTTPS and admin overlay stay separate, equal paths.

In short: reachability comes from controlled exits, not from inbound ports.

Dual 5G

Two mobile uplinks give WAN-side redundancy. The site router orchestrates both paths (failover / dual-WAN); operational detail stays private — publicly only the pattern matters: two 5G paths, both behind carrier NAT.

Outbound tunnels & dual remote

Both 5G uplinks sit behind carrier-grade NAT — inbound port-forwarding is not a viable base. Carrier CGNAT no public IPv4 First independent 5G uplink — WAN-side redundancy. 5G Uplink A mobile WAN path Second independent 5G uplink — dual-WAN instead of a single point. 5G Uplink B mobile WAN path Orchestrates both uplinks and segments the site — without inbound port holes. Site Router Dual-WAN · Firewall The lab builds tunnels outbound — reachability comes from controlled exits. Outbound Tunnel Newt · Overlay VPN Browser remote via identity-aware HTTPS; admin overlay stays a parallel path. Identity-aware Edge HTTPS · OIDC

Hover or focus a node for details.

Both 5G uplinks sit behind carrier-grade NAT — inbound port-forwarding is not a viable base.

Orchestrates both uplinks and segments the site — without inbound port holes.

The lab builds tunnels outbound — reachability comes from controlled exits.

Browser remote via identity-aware HTTPS; admin overlay stays a parallel path.

Path Role
Identity-aware HTTPS Published apps via an outbound tunnel to the edge; login with OIDC
Overlay VPN Admin and ops access — parallel, not a substitute for the browser path
IPv6 uplink Outbound WireGuard to a community broker → routed prefix, dual-stack on the LAN (no inbound)
LAN proxy TLS and routing inside the site — separate from remote

More on layering: Architecture. Hardware context: MikroTik Chateau 5G, UCG-Fiber.

IPv6 despite CGNAT

The 5G upstream provides no native IPv6 — and behind carrier NAT there is no inbound v4 address to reliably anchor classic 6in4 (protocol 41) to. Instead of dropping IPv6, the lab obtains it the same way as everything else: through an exit.

A WireGuard tunnel (outbound UDP only, so it survives CGNAT) connects the site router to a community IPv6 broker. The broker routes a dedicated IPv6 prefix into the lab; the router carves it into per-segment prefixes and advertises them via router advertisements. The result: dual-stack on the LAN — clients reach the IPv6 internet without a single inbound port.

The separation stays deliberate: the IPv6 tunnel is its own exit for egress and LAN prefixes, not the app ingress. Public reachability of services still runs through the identity-aware edge — for dual-stack additionally via AAAA to that same edge, not directly to lab addresses.

What is deliberately missing

No WAN IPs, no IPv6 prefixes or GUAs, no VLAN plans, no “how to get in” guide, and no list of which apps are reachable from the internet. The portfolio shows the pattern — operations stay internal.