Why Can't I Host a Server Through My VPN?
Because a consumer VPN gives you a shared outbound address and no inbound path to your machine. Traffic goes out through it; nothing comes back in unless the provider explicitly maps a port to you, and almost none of them do. That is not a limitation you can configure your way around — it is what the product is. The confusion is worth untangling properly, because “VPN” now covers three different things that solve three different problems, and only one of them has anything to do with hosting.
Three things all called VPN
When someone says VPN they mean one of these, and the answer to “can I host through it” is different for each.
- A privacy VPN — the kind with a subscription and a country picker. Your traffic exits from the provider's address, shared with a large number of other customers.
- A mesh or overlay VPN — Tailscale, Nebula, plain WireGuard between your own machines. A private network your devices join. Excellent at what it does.
- A corporate VPN — you dial into an employer's network to reach things inside it. Not related to hosting at all.
The four things people actually want
Almost every “can I use a VPN for this” question is one of four needs. Laying them against the tools makes the gap obvious.
| What you want | Privacy VPN | Mesh VPN | A public IP |
|---|---|---|---|
| A private network between my own devices | No | Yes | Not on its own |
| Anyone on the internet can reach my service | No | Partly, via a funnel or relay | Yes |
| Control which address I appear to come from | Shared, not yours | No | Yes |
| Forward arbitrary ports, not just HTTP | No | Within the mesh only | Yes |
Read across the rows and the pattern is clear. Each tool is genuinely good at one column and structurally incapable of another. Nobody is doing it wrong.
Why a privacy VPN structurally cannot host
Your packets leave through the provider's gateway, which is doing network address translation for everyone on that server. The address a website sees is the gateway's, not yours, and it is the same address a few thousand other subscribers are using at that moment.
For a connection you start, that works: the gateway remembers the mapping and sends replies back. For a connection someone else starts, there is nothing to remember. A packet arriving at the gateway on port 25565 has no way of knowing which of those thousands of subscribers it belongs to, so it is dropped. That is not a setting. It is the shape of the thing.
A handful of providers sell port forwarding as an add-on, which does map specific ports to specific customers. If yours does and the ports you need are on offer, that genuinely can work. Read the terms first — many prohibit running services outright.
Why a mesh VPN almost does it
A mesh VPN is a different and much better answer, right up to its edge.
Tailscale and friends build a private network across your devices. Any machine on it can reach any other by a stable address, wherever they physically sit, with no port forwarding and no public exposure. For remote access to your own things, this is the correct tool and you should probably be using it.
The edge is the word private. Your laptop is on the network. A stranger's browser is not. Funnels and relays exist to bridge that gap and they work, with two constraints worth knowing before you build on them: they are generally HTTP-shaped, so a game server or a mail daemon on its own port does not fit, and the address your visitors reach is the provider's, not one you hold.
If your audience is your own devices, stop here. Tailscale is free at the scale most people need and better at this job than anything you would assemble yourself.
What "all four at once" actually requires
The reason no single one of these ticks every row is that the rows need different things:
- A private subnet between your devices needs an overlay with its own addressing.
- Inbound reachability needs a routable address that is yours, announced to the internet, with nothing NATing in front of it.
- Controlled egress needs your traffic to leave from that same address.
- Arbitrary ports need forwarding that is not limited to HTTP.
Put together, that is an overlay network and a block of address space you can actually announce. The overlay is the easy half.
What we do
Read this with the suspicion it deserves: I build one of these.
TunnelNet gives a machine you own a real public IPv4 address, out of our own address block, announced from our own network number. The machine keeps a private link to the network, so your devices can also talk to each other over it; the address is routable, so the internet can reach the machine; any port works, not just 80 and 443; and outbound traffic leaves from that same address, which is what a vendor allow-list wants.
That is the $10/month ingress plan. It is not magic and it is not a replacement for Tailscale — if all you need is your own devices reaching each other, Tailscale is free and I would use it.
Get a public IP — $10/mo For businesses See all plans