How to bypass Cloudflare Tunnel 100MB limit for Immich/Storage behind CGNAT?
Hi everyone, I have a home server running various Docker containers (including Immich, Nextcloud, jellyfin, qbittorrent and other storage services). Where I live, getting a static/public IPv4 is extremely expensive, and I am stuck behind a CGNAT. Fortunately,…
Hi everyone, I have a home server running various Docker containers (including Immich, Nextcloud, jellyfin, qbittorrent and other storage services). Where I live, getting a static/public IPv4 is extremely expensive, and I am stuck behind a CGNAT. Fortunately, high-speed fiber is quite cheap, so I have a 1 Gbps symmetrical line at home. To make my services accessible from the outside, I’ve been using Cloudflare Tunnels. It works incredibly well for basic web apps, but I’ve hit a major roadblock: the dreaded 100MB upload limit. Whenever my wife or I try to upload large video files or backup photos via Immich/Nextcloud, the upload fails and throws errors due to Cloudflare's proxy body size limits. What I've tried / My constraints: Tailscale: I use Tailscale for my own remote access, and it works flawlessly. However, installing and configuring Tailscale on my wife's phone and asking her to remember to toggle it on/off every time she wants her photos to auto-sync/backup is a major UX friction. I need a solution that is 100% seamless and "spouse-approved" (i.e., she just opens the app or enters a regular HTTPS URL, and it works). Local DNS (Split-Brain DNS): I'm planning to set up AdGuard Home/Pi-hole with local DNS overrides so that when we are at home, traffic to immich.mydomain.com goes directly to the local IP of the reverse proxy (bypassing the Cloudflare Tunnel entirely). This fixes the upload limit at home, but does not solve the issue when we are outside on mobile data (WAN). My Questions: What is the easiest and most effective way to completely bypass the 100MB limit while staying behind CGNAT for WAN access? Would buying a cheap VPS (like a $4-5/month instance from Hetzner/OVH) and setting up a reverse proxy (Nginx/NPM/Caddy) connected to my home server via a WireGuard/Tailscale tunnel be the best bet? Are there any alternative tunnel services (like Rathole, FRP, or Localtonet) that you guys recommend specifically for media heavy self-hosted apps? I would love to hear how you solved this in your own setups! Thanks in advance.
已收录讨论
Expand the replies to this comment to learn how AI was used in this post/project.
That's not addressing old mates problems..
This is exactly what I do for the same problem that OP has. Good suggestion.
Yes, I have a IPV6.
Yeah, if OP have v6 but didn't aware then the (ISP router) firewall works properly anyway (Deny-All Default). Just allow the Immich or the Reverse Proxy (you can host this locally) v6 ip, 443 only. If you need it accessible for ipv4 only client, proxy your dns through CF (orange cloud). Ipv6 is a godsend for self-hoster IMO and if anyone wonder, go here. If you can access it, you have a public ipv6.
Why does she have to turn Tailscale on and off Because it drains the battery. Sometimes quite a lot
Huh, I never noticed. My wireguard split tunnel turns on whenever I leave my home wifi.
This, chunks is the solution, unsure why this isn't higher up.... In the meantime local address is sufficient for a home setup.
Is IPV6 an option for you? It would solve your issues with zero cost and zero extra software if so. Although a bit of a learning curve
Why not?
OP, If you have no IPV6 by your ISP but your router has the ability to use WireGuard look into route64.org IPv6 Tunnelbroker.
Yes I think this would be the right solution for OP. Set local IP as the first target and the external domain as the fallback.
Immich has “Uploading in chunks ” on its roadmap. This would eliminate your problem. My advise? Just use local address in the app, to directly connect when at home. Then wait for this feature to be developed so remote uploading also works. https://immich.app/roadmap
an external VPS with its own tunnel in is how i would do it, you just need to check the ingress/egress charges (if any) with the provider to see whether it's going to be an appropriate place for a proxy. Ensure your WAN dns is dns-only record (if cloudflare) so you aren't pumping all that data through the CF proxy (which would likely get you flagged), and then just setup a dns record for the same fqdn locally to the local IP.
ipv6 : you can simply put your immich ipv6 in dns, open the firewall to it and have it accessible externally without any third party services. You also don't need split horizon DNS or auto switching to a local IP since your phone will just go to your server directly when you're on your local network. If you have a gigabit fiber line chances are high that your ISP has v6. Mobile ISPs are mostly v6 only, so accessing through mobile data will almost certainly work.
You can make a tunnel with tail scale without connecting to the network. Tailscale funnel
I have a VPS with Pangolin. The connection is high latency and slower than direct IPv6, but it’s good enough for when I need it. I set up DNS overrides in the home network to make sure that I don’t go from home -> VPS -> home.
As other said , a vps would be your best bet. Alternatively, you could use tailscale.
Why does she have to turn Tailscale on and off? Why not just leave it on always and access immich/next-cloud through it, you can use the Tailscale generated domain names as address in your apps. If you are happy to get a vps you could set up pangolin. I’ve been using it and find it makes it easy to set up both publicly accessible pages and private ones that require you to run the pangolin client software on device to access. It does seem to struggle if you run many services though one newt tunnels so either run one per heavy resource or run a basic WireGuard tunnel for the heavy ones.
Is there anything in your use case array that can't cope with IPv6, and can your ISP give you IPv6 without CGNAT?
If you have IPv6, just use that instead, then you don't have to deal with CG-NAT (or any NAT for the matter) If you need to stick with IPv4, a cheap VPS, Wireguard and Split Horizon DNS works as well. Note that depending on your config you might loose the source IP, but there are ways around that (e. g. Proxy Protocol)
Don't. Just set use your local IP address for the immich app and let it upload when you're local.
Normally you use IPv6 in this case, not an option?
OMG I had no clue that this was a thing until now. This explains all my Immich video failed uploads. Thank you OP
Run Netbird on a VPS. Its basicly self hosted CloudFlare Tunnels