Cloud Router as a Service: public IP despite DS-Lite and CGNAT

The IPv64.net Cloud Router is a virtual router in German data centres that you connect your home network to via WireGuard. It makes services behind DS-Lite, CGNAT or mobile internet reachable from outside – over IPv4 and IPv6. This page explains how it works, what it costs and how to set it up step by step.

Use case: port forwarding despite DS-Lite, CGNAT and mobile internet

With DS-Lite, CGNAT and many mobile or fibre plans you don't get your own public IPv4 address. You share it with other customers of your provider, so classic port forwarding in your router is not possible. From outside you are often only reachable via IPv6.

The Cloud Router solves this: your device opens a WireGuard connection from the inside to an IPv64.net server. Outgoing connections work even behind CGNAT. Through this tunnel the Cloud Router forwards requests from the internet to your service. Typical uses:

• Make your homelab, NAS, smart home or game server reachable via IPv4, even though your line only has DS-Lite.
• Connect several locations via site-to-site VPN and reach all networks from each other.
• Use the Cloud Router like a normal VPN provider: a client connects and goes out to the internet via the server.

The WireGuard access itself (clients, configuration, install script) is described on the VPN gateway page.

How the Cloud Router works

A Cloud Router is a router that runs entirely in the IPv64.net environment – with its own routing table and its own firewall rules. A Cloud Router hosts one or more VPN gateways. A VPN gateway is a WireGuard server with its own port on an IPv64.net VPN server. Your peers connect to it: routers, servers, smartphones or laptops.

 Internet                 IPv64.net (data centre in Germany)                    your line (DS-Lite/CGNAT)
 ─────────                ──────────────────────────────────                    ─────────────────────────
 Visitor ──► public IP:port ──► Cloud Router ──► VPN gateway ══WireGuard══► Peer (router/server) ──► service
              (port mapping)    (routing, firewall)                 ▲
                                                                    └── tunnel is opened from the inside

• All servers for the VPN gateways are located in German data centres, both the cloud gateways and the hardware gateways. The list with status is at VPN Gateway Server.
• The service is fully IPv4 and IPv6 capable.
• You manage the Cloud Router entirely on the website. IPv64.net applies changes to the server automatically, usually within a few seconds.

Ordering, account classes and prices

Cloud Router as a Service is part of every IPv64.net account, including the free one. You don't need to order it separately; you create it in the Cloud Router menu. What you can use depends on your account class (as listed on Pricing):

How many Cloud Routers, VPN gateways and peers you can create, how fast the gateway is (Mbit/s or Gbit/s, briefly with burst) and how much traffic per month (incoming and outgoing combined) is included is listed per account class on Pricing. According to a note in the portal you get at least 50 Mbit/s from Home / Supporter upwards.

• The yearly prices are a one-off payment for 365 days, not a subscription. You renew yourself. More about the classes under Account & limits.
• An own public IPv4 address costs €6.99 / month (incl. VAT). It belongs to exactly one Cloud Router. Book it by e-mail to info@ipv64.net.
• If you need a router just for yourself, there is the Managed Cloud Router.

With every Cloud Router and gateway you create, the IPv64.net terms and conditions and privacy policy apply.

Setup step by step

1. Create a Cloud Router with VPN gateway
   Open Cloud Router and click Quick add Cloud Router + VPN Gateway. From Home / Supporter upwards you can first pick a server under Choose a favorite Server and create it with Add Cloud Router + VPN Gateway. The router gets a name like “Router …” automatically; change it with the pen icon.
2. Wait until the gateway is ready
   As long as a spinner is shown, IPv64.net is setting up the gateway; the page reloads by itself. If no server has been assigned yet, the Server column shows “pending..”. Afterwards it shows the server name and the gateway's WireGuard port.
3. Create a peer
   At the gateway choose Gateway Options → Quick new WG Peer. The peer appears under Show WG Peers.
4. Adjust the peer
   Under Peer options → Edit Peer you set the name, tunnel addresses (IPv4 and/or IPv6 in CIDR notation, e.g. 10.7.0.2/32 and fd64::2/128), DNS server and Keepalive in the format hh:mm:ss. Behind DS-Lite or CGNAT, set a keepalive such as 00:00:25 so the tunnel stays open. Leave Endpoint and Endpoint Port empty (“dynamic”).
5. Get the configuration onto your device
   Peer options → Show WG Config shows the ready-made wg0.conf with QR code, Copy to Clipboard, Download as file, a direct download URL and the one-step installer for Linux. Details under VPN gateway.
6. Check the connection
   A green network icon in the peer list shows a recent handshake. Then set up port forwarding.

The tunnel addresses that gateway and peer get automatically are shown under Edit Gateway and Edit Peer.

WireGuard clients and routers

Any device that speaks WireGuard can connect to the gateway – according to IPv64.net for example FRITZ!Box, OPNsense or UniFi, plus Linux servers and the WireGuard apps for Windows, macOS, Android and iOS.

• Linux server: fastest with the one-step installer wg-install.sh from the configuration view.
• Smartphone: scan the QR code in the WireGuard app.
• Router and firewall: import the file wg0.conf or copy the values by hand.

For port forwarding, the peer must be the device running the service, or a router that forwards the requests into your home network (see routing).

Port forwarding with the port mapper

The port mapper forwards a port of an IPv64 server through the tunnel to your service – port forwarding for DS-Lite and CGNAT. You find it at the gateway under Gateway Options → Portmapping.

1. Name
   Any name, e.g. “Nextcloud”.
2. Public IP
   Default uses the address of the VPN server. If you have own public IPs (see IPv4 and IPv6), you can choose one of them. The IP type must match the destination.
3. Destination (IP-Address)
   The IP address of your service as the gateway reaches it – usually the peer's tunnel address, e.g. 10.7.0.2. A hostname is not allowed.
4. Map Port / Protocol
   The port of your service (1 to 65499) and the protocol TCP or UDP. Click Add Portmap.

The system picks a random public port. The table then shows the mapping server:port → destination:port; your service is reachable from the internet at that address. Use the On/Off switch to pause a mapping and the bin icon to delete it.

Public IPv4 and IPv6

Under Actions Cloud Router → Manage Public IPs you see the addresses of your Cloud Router:

• System addresses: By default every Cloud Router uses the IPv4 and IPv6 address of its VPN server. All routers on that server share these addresses; that is why the port mapper assigns random ports.
• Own IPv6 (free): With Add IPv6 to this Router, IPv64.net generates an own public IPv6 address for your router. One own IPv6 per Cloud Router is possible.
• Own IPv4 (€6.99 / month): A public IPv4 used only by your Cloud Router. Book it by e-mail to info@ipv64.net.

You can disable own addresses with the switch or delete them. Deleted addresses are then listed under Used IP-Addresses (“Deleted and saved”). With an own IPv4 you can point an A record of your DynDNS domain to that address.

Routing, site-to-site, firewall and OSPF

Routing table

Under Actions Cloud Router → Routing table you add static routes: Destination (CIDR), Gateway (IP address), the Peer the traffic goes through, and the Distance (default 1). This way the Cloud Router reaches whole networks behind a peer, e.g. your home network 192.168.178.0/24 via your router's tunnel address. System routes (“System”) cannot be deleted. Get live routing table fetches the current IPv4 and IPv6 routing table directly from the router.

Allowed IPs: Client Site and Server Site

Under Edit Peer there are two lists:

• Client Site: the AllowedIPs entries in your device's configuration – the networks your device sends into the tunnel. You add IP addresses or networks (single addresses become /32 or /128).
• Server Site: the networks IPv64.net forwards to this peer on the server side. This list is managed automatically.

Site-to-site VPN

Because the gateway is a router, you can connect several locations or homelabs and reach all networks from each other. Mark the connection under Peer options with Mark as S2S VPN connection; the list then shows “S2S”.

Firewall

Under Edit Router Firewall you add rules with Chain (Forward, Input, Output), Source and Destination (IP or CIDR, empty = Any) and Action (Accept or Drop). Source and destination must both be IPv4 or both IPv6. By default a rule “Any → Any: Accept” applies. In most cases Forward is the right chain, because your packets are forwarded from the WireGuard tunnel to the next destination.

OSPF

For dynamic routing, enable Enable OSPF per gateway. Under OSPF Settings you set the OSPF Area ID (format like 0.0.0.0), the version (2 = IPv4 only, default; 3 = IPv6 and IPv4) and the Interface cost (1 to 256, default 1). Get live OSPF instance data shows the neighbours and their state.

Management

• Delete Gateway removes the gateway together with all its peers.
• Reset Traffic Counter only resets the gateway's counter, not your account's traffic quota.
• Show Connections lists a peer's last 30 connections with IP address, port and time.

Limits and legal notes

• The number of routers, gateways and peers, bandwidth and monthly traffic are limited per account class (see above). In the free account, internet access via the gateway is limited.
• When the traffic limit is reached, the traffic display turns red and the bandwidth shows “2M”.
• The port mapper assigns random ports, does not translate between IPv4 and IPv6 and is still in test operation.
• Without a booked own IPv4 you share the server's IPv4 address with other customers.

Troubleshooting

More answers are in the FAQ, help is available in the v64.tech forum.

Found a mistake or missing something? Tell us in the v64.tech forum. · Updated: 2026-10-26