The problem: The company I work for offers a hardware solution that is managed from a web interface that runs on a local network on a dedicated machine that we built. Because of low-level constraints, it is not possible for us to move this web interface solution into the cloud, but some of our customers do want their web interface to be reached from outside the network. Our machines already have the option to connect to a central server, publicly reachable, to report their status. I would like to extend that connection to include information on the whereabouts of the machine so users can be forwarded to it.

What solution do I need? My perfect solution would be the following: users can log in to our publicly reachable server and click on a button to connect to the machine on the private network. No further software would be required on the user's side. A browser, a click on a button, and a connection is set up to the website hosted on our machine on a private network.

What is this web server exactly? The web server is an ARM-based device running a custom Debian-based Linux. The web server software is Kestrel (ASP.NET Core) and serving a HTTPS website encrypted with a self-signed certificate. Some of the pages offer dynamic content using SignalR and websockets.

What have you researched? Well, "talk to a resource on a private network from a different private network" is something we have done before with VPN. Our issue is scalability and data use, so VPN is not preferred. The line does not have to be open all the time, only when a client wants to connect.

Another option would be TURN. This is definitely possible, although you would still have all your traffic routed through a server in the middle. It does solve the issue with exhausting IP's on a VPN.

Port forwarding and a static IP on the private network would be an easy fix, but some clients cannot or do not want to do that.

That led me to STUN, and ICE, and WebRTC. But the way I read it, WebRTC is more useful for a peer-to-peer connection while on a static page. Examples are often a chat-app or a webcam view; one element in a public website comes from a private source and a UDP connection is set up. For my solution I need to be able to surf on a website hosted in a private network, moving from page to page. As a website, TCP would be preferred over UDP.

STUN does allow me to do some TCP Hole Punching, and combined with an Apache reverse proxy on our machine I could do some port forwarding. However, I am not sure how I would forward a range of ports without limiting the number of ports available for the hole punching.

TL;DR I want to connect to a machine on a private network from any other network and access its website. There are so many options available that I can't see the forest for the trees. TURN, STUN, ICE, WebRTC, PeerJS. They are all a part of the solution I seek, but which components I should select and how to link it all together is where I can use your advice.

1 Answer 1


For IPv4, that inbound connection from public to private network requires port forwarding aka destination NAT aka reverse NAT on the WAN router. There are various methods that may work on some networks, but nothing reliable.

With either IPv4 and IPv6 an explicit firewall rule permitting the data flow is required when a decent firewall is used.

Additionally, with dynamic IP addressing some way of discovering the current address will be required. Commonly, dynamic DNS with an update daemon is used.

The cloud option is much simpler for your customer...

  • I wish that I could move it to the cloud. But the purpose of our machine is to manage other devices in the local network; devices using low-level communication protocols. It is physically impossible to move the device to the outside world, but if I could expose just the website on our machine it would improve usability.
    – Yuregenu
    Nov 22 at 9:13
  • Deploy a local agent (appliance or software) and manage via cloud - but we're straying far from this site's topics here...
    – Zac67
    Nov 22 at 10:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.