Hosting a website from home

The machine is rarely the problem

People assume hosting from home is a hardware question. It isn't. A ten-year-old laptop can serve a personal site to more visitors than it will ever have. What stops it is that residential internet is designed for fetching things, not for being found.

There are four obstacles. They are independent of each other, and fixing three of them still leaves you offline.

One: you may not have a public address

Many providers, mobile broadband and newer fibre networks especially, put customers behind carrier-grade NAT, where one public address is shared between many households. Nothing on the internet can open a connection to you, because there is no address that means you.

You can check this in a minute. Compare the address your router reports on its WAN interface with the one a what-is-my-IP page shows. If they differ, you are behind CGNAT, and no amount of router configuration will change it. You cannot forward a port you were never given.

Two: the useful ports are often blocked

Plenty of residential providers block inbound traffic on ports 80 and 443 outright, partly as an anti-abuse measure and partly because home lines are not sold as hosting. Some will unblock on request. Many will not, or only on a business plan.

Three: your address changes

Even with a public address, most home connections lease it dynamically. It changes after a reboot, an outage, or on the provider's own schedule. Dynamic DNS papers over this by updating a record when the address moves, but the propagation gap is real downtime, and when it fails it fails silently.

Four: certificates

Browsers treat plain HTTP as unsafe, so you need a certificate. Getting one means proving you control the domain, which means being reachable on a public address, which was the thing you were trying to arrange in the first place. Renewal then has to keep working unattended every couple of months, forever.

The three ways out

Each of these solves a different subset of the four, and it is worth knowing which.

• Port forwardingfree and direct, but it needs a real public address and unblocked ports, and it exposes a machine on your home network to the internet. It does nothing about CGNAT.
• A private network such as Tailscale or WireGuardexcellent for reaching your own machines from anywhere, and it works through CGNAT. It does not make a site public: visitors would have to join your network, which is not what a website is.
• An outbound tunnel to a relaythe machine opens a connection outwards to a server that has a public address, and that server forwards visitors back down it. Because the connection starts from your side, CGNAT, blocked ports and changing addresses all stop mattering.

What the last option costs you

A relay puts someone else's server in the path of your traffic. That is a real trade, and you are trusting it to stay up and to forward honestly.

In exchange your router keeps every inbound port shut, your address can change as often as it likes, and certificates are handled where the public address lives. This is the approach MacServe takes: your Mac holds an outbound tunnel, the relay terminates HTTPS and forwards traffic back through it, and nothing on your home network is exposed.