Networking foundations
This page explains the networking behind Obacht for everyone who is new to the topic. It starts with how a home network is addressed, then how the public internet routes traffic, and why hosting a service from home is harder than it looks. No prior networking knowledge is needed. If you already know how NAT and public IP addresses work, skip ahead to What Obacht does.
Your local network
When you plug a device into your home network, over Ethernet or Wi-Fi, your
router gives it a local IP address. This address only has a meaning inside
your home. Typical local addresses look something like 192.168.1.42,
192.168.0.15 or 10.0.0.7.
These ranges are reserved for private networks and are never used directly on the
public internet. Every household uses the same ranges, so the 192.168.1.42 in
your home is a completely different machine than the 192.168.1.42 in your
neighbour's home. The address is only unique inside your own network, nowhere
else.
Your router hands out these addresses and keeps a small table of which device has got which address. Devices on the same local network can talk to each other directly. Your laptop can reach your Raspberry Pi at its local IP. Nothing from the outside can use that address to reach in.
The public internet and global IP addresses
The public internet uses a different set of addresses, called global (or
public) IP addresses. Unlike the private ones, a global address is unique
across the whole internet at any given moment. So if a website's server has the
address 203.0.113.5, there is exactly one machine on the internet which is
reachable at that address.
Your internet provider (ISP) assigns a global address to your connection. In the simplest case that single global address represents your whole household on the public internet. Every request that leaves your home, loading a web page or sending a mail, appears to the outside world as coming from that one global address.
The difference between the two kinds of address is more or less the root of everything that follows:
| Address type | Example | Unique where | Reachable from the internet |
|---|---|---|---|
| Local / private | 192.168.1.42 | Only inside your network | No |
| Global / public | 203.0.113.5 | Across the whole internet | Yes (in principle) |
NAT: how many devices share one address
Usually you have many devices at home but only one global IP address. The mechanism that lets them all share it is called NAT (Network Address Translation), and it runs on your router.
When your laptop (local address 192.168.1.42) requests a web page, the router
rewrites the outgoing request so that it appears to come from your single global
address. It notes down, in a translation table, that "this particular outgoing
connection belongs to 192.168.1.42". When the reply comes back to the global
address, the router looks up the table again and forwards the reply to the right
local device.
NAT works really well for traffic that starts from inside your network. The router always has a table entry to match the reply to the device which asked for it.
The problem starts with traffic that starts from outside. If someone on the internet sends a request to your global address out of nowhere, the router has no table entry telling it which internal device the request is meant for. By default it has nowhere to send it, so it just drops the request. This is exactly why home networks are safe by default: unsolicited inbound traffic simply does not get through. It is also the reason why hosting a service from home is so difficult.
Why hosting from home is hard
To host a service (a website, a dashboard, a small app), something on the public internet has to be able to start a connection to you. That is exactly the inbound direction NAT blocks. On top of that there are two more realities at home which make it even harder.
Dynamic IP addresses
Most home connections do not get a fixed global address. The ISP assigns one from
a pool and may change it again, after a reconnect, a router reboot or on a fixed
schedule. A service is normally reached through a domain name (for example
example.com), which is mapped to an IP address in the DNS system. So if your
global address keeps changing, this mapping goes stale and visitors get sent to
the wrong place, or nowhere at all.
Carrier-grade NAT (CGNAT)
There are far fewer IPv4 global addresses than there are internet connections, so many ISPs don't give each household its own global address anymore. Instead they run a second, bigger layer of NAT inside their own network, called carrier-grade NAT, where many customers share one single global address.
Under CGNAT you don't control the address that faces the internet at all, your provider does, and it is shared with strangers. Inbound connection tricks that depend on having your own global address just don't work here, because there is no public address which belongs only to you.
How a data center is different
A data center is built for the exact opposite situation. A server in there gets a static global IP address, one that is fixed and belongs to that server alone. It is not behind NAT, and nothing changes the address away under its feet.
Because the address is global, fixed and unshared, a domain name can be pointed at it once and stays valid. Anyone on the internet can start a connection to it, which is exactly what a public service needs. This is the reason why hosting "in the cloud" is so straightforward: the hard networking problems were already solved by giving the server a permanent, reachable address.
| Home connection | Data center server | |
|---|---|---|
| Global address | Often shared (CGNAT) | Dedicated to the server |
| Address stability | Often dynamic | Static |
| Inbound connections | Blocked by NAT | Allowed |
| Pointing a domain at it | Unreliable | Reliable |
The trade-off is that a data center server is, by design, exposed to the open internet and managed as part of a big shared facility. Your device at home is not. For a lot of people that is exactly the point of self-hosting.
The traditional workarounds
People have been self-hosting from home for a long time using a few techniques, and each of them adds some manual setup and has its limits.
Port forwarding tells your router to send inbound traffic that arrives on a specific port straight to one internal device, which creates the table entry NAT is otherwise missing. It requires changing router settings, it exposes that device directly to the internet, and it does not work at all under CGNAT.
Dynamic DNS (DynDNS) works around the changing global address by running a small program which notices when your address changes and updates the DNS record to match. It solves the dynamic-IP problem but not NAT or CGNAT, and it still leaves your device exposed once the traffic does get through.
On top of those, you would normally also have to get and renew a TLS certificate yourself so that the service is reachable over HTTPS instead of plain, unencrypted HTTP.
So in the end you have a whole chain of moving parts, from port forwarding to dynamic DNS to certificate management, which all have to be set up correctly and kept running. Obacht exists to remove exactly this chain.
What Obacht does
Obacht never relies on an inbound connection to your device. Instead, your device starts an outbound connection to Obacht and keeps it open. Outbound is the direction NAT, CGNAT and dynamic addresses all allow without any configuration, the same direction your laptop uses to load a web page. This always-on connection is the Obacht network. Visitors reach Obacht's gateway, and the gateway passes their traffic through the open connection to your device, which answers and holds the certificate itself. Nothing is forwarded on your router and Obacht cannot read the traffic. The details are on How Obacht connects your device.
Ports and web addresses
A single device can run several apps at the same time. Each one listens on its own port, a numbered channel on the device, a bit like an apartment number at a building address. You should not have to type port numbers, so Obacht maps web addresses to apps (or ports) per device. One Raspberry Pi can serve several independent sites under different addresses. How addresses are set up is on How web addresses work, and pointing an address at a bare port is on Point an address at a port.
The mental model
- Your home network gives devices private addresses which the internet cannot reach directly.
- NAT lets those devices share one public address for outbound traffic, but blocks unsolicited inbound traffic.
- CGNAT and dynamic addresses make traditional home hosting unreliable or even impossible, because you don't have a stable, dedicated public address.
- A data center solves this with a static, dedicated, reachable address, at the cost of exposure and of running your service on someone else's infrastructure.
- Obacht reaches the same result from home by letting your device open an outbound connection, the Obacht network, so no inbound connection, port forwarding or dynamic DNS is ever needed.
- The Obacht gateway acts like a router that passes encrypted traffic through. Your service never runs there. TLS ends on your device, so your service stays yours and your traffic stays private.
- Web addresses map to apps or ports per device, so one device can serve several apps under different names.
With this model, self-hosting from home comes down to plugging in a device and attaching a web address. The addressing, the tunnelling and the certificate work all happen for you.