Skip to content
CloudZH
Buy
EN
EnglishENDeutschDEFrançaisFREspañolESPortuguêsPTTürkçeTR

Docs / Getting started

Reachability, CGNAT & DynDNS

Remote access only works if your internet line has a public IPv4 address of its own. CloudZH checks this for you and keeps your DNS record up to date.

Check your line

The installer, System Health and Settings → Reachability and DynDNS show the result. On the server:

zh reach

CloudZH compares the address the internet sees, the WAN address of your router (UPnP or NAT-PMP, if enabled) and a test from outside on port 443.

ResultMeaning
Public IPv4All good. If port 443 is still closed, check the port forwarding in your router.
CGNATYour router has an address from 100.64.0.0/10 or a private one: your provider shares one public address between many customers.
DS-LiteIPv4 runs through a tunnel of your provider, only IPv6 is your own.
UnknownYour router does not tell. Look up the internet address in its status page: 100.64.x.x or 192.0.0.x means CGNAT or DS-Lite.

What works with CGNAT

  • Everything at home: dashboard, apps, Plex and downloads.
  • Plex away from home, through the Plex relay with reduced quality.
  • Not possible: direct access to the dashboard, the apps and the VPN from outside.

Ways around it

  • IPv6: many of these lines have real IPv6. Allow TCP 443 to the server in your router and turn on IPv6 for DynDNS. Works from networks with IPv6 only.
  • Ask your provider for a public IPv4 address or dual stack. Some providers do this on request, sometimes for a fee. The cleanest fix.
  • Your own relay: a small VPS with a public IPv4 address forwards port 443 to CloudZH over WireGuard. Works for video too.
  • Tailscale: your devices reach the server without open ports. Every device needs the app.
  • Cloudflare Tunnel: only for the dashboard and admin apps, never for Plex or other video. Cloudflare's terms do not allow serving mostly video through their network.

DynDNS

If your public address changes now and then, CloudZH notices within 5 minutes and updates your DNS records with the same credentials as the certificate.

  • Supported: Cloudflare and Duck DNS. Other DNS providers: use the dynamic DNS of your router or change the record by hand.
  • Updated: *.example.com and the dashboard name. The root domain, www and vpn only if they pointed to this server before. Mail and other records stay untouched.
  • On by default for new installations, off for existing ones until you turn it on. Paused automatically with CGNAT and DS-Lite.
zh dyndns          # status
zh dyndns on       # turn on (--ipv6 also updates AAAA)
zh dyndns update   # update now