The Problem I Wanted To Solve

I had a website (React frontend + Node.js backend + MongoDB) running on my Ubuntu laptop at home. I wanted to share it with the world — give a public link to friends, clients, and testers.

But there was a big problem: CG-NAT.

My internet provider (ISP) does not give me a real public IP address. They put hundreds of customers behind one shared IP. This is called Carrier-Grade NAT (CG-NAT). Because of this:

• I cannot do normal port forwarding from my router.
• Tools like ngrok work, but the free version gives random URLs and has limits.
• Buying a VPS to host the full website is expensive and slow to set up.

I wanted something that is:

1. Free
2. Permanent (same IP every time)
3. Fast (because the website actually runs on my powerful laptop, not a tiny VPS)
4. Simple to maintain

The answer: Rathole + Oracle Cloud Free Tier VPS.

What Is Rathole? (In One Line)

Rathole is a small, fast program that creates a tunnel between a cheap VPS (with a public IP) and your home computer. People visit the VPS IP, and Rathole quietly forwards their request to your laptop.

Think of it like this:

Visitor  →  VPS Public IP (Oracle)  →  [Rathole Tunnel]  →  My Laptop at Home

The visitor never knows the website is actually running in my bedroom.

What You Need Before Starting

1. A laptop or PC at home running Ubuntu (I used Ubuntu 20.04).
2. Your website / app running locally (mine runs on ports 3000 frontend, 4000 backend, 27017 MongoDB).
3. A free Oracle Cloud account (https://www.oracle.com/cloud/free/).
4. Basic terminal knowledge (copy-paste commands).
5. About 1–2 hours of patience the first time.

That's it. No domain needed (you can add one later). No money needed.

The Big Picture (5 Stages)

1. Create a free VPS on Oracle Cloud and get a public IP.
2. Open the right ports in Oracle's firewall.
3. Install Rathole server on the VPS.
4. Install Rathole client on the laptop.
5. Start everything and test from your phone's mobile data.

Let's go.

Stage 1: Create a Free Oracle Cloud VPS

Oracle gives you a small Linux server forever free. It has only 1 GB RAM and 1 CPU — which sounds tiny, but we don't need power here. The VPS only forwards traffic. The real work happens on your laptop.

Steps

1. Go to https://www.oracle.com/cloud/free/ and sign up. (Credit card needed for verification, but they will not charge.)
2. In the Oracle Console, go to Compute → Instances → Create Instance.
3. Fill the form:
   • Name: rathole-server
   • Image: Ubuntu 22.04
   • Shape: VM.Standard.E2.1.Micro (this is the "Always Free" one — make sure it says "Always Free Eligible")
   • SSH Key: Click "Generate a key pair for me" and download both keys. Save them somewhere safe. You will not be able to download them again.
4. Click Create. Wait 1–2 minutes.
5. After the instance starts, copy the Public IP address. It will look something like 203.0.113.45. Write yours down — you will use it many times. (In this guide I will use YOUR_VPS_IP as a placeholder — replace it with your actual IP everywhere.)

Set permission on your SSH key (on your laptop)

chmod 400 ~/Downloads/ssh-key.key

Without this, SSH will refuse to use the key (security rule).

Stage 2: Open the Ports in Oracle's Firewall

Oracle has two firewalls — this is the part where most beginners get stuck. You must open ports in both.

Firewall 1: Oracle Security List (cloud-side)

1. Go to Networking → Virtual Cloud Networks.
2. Open your VCN → Security Lists → Default Security List.
3. Click Add Ingress Rules and add these rules one by one:

⚠️ VERY IMPORTANT: The Source CIDR must be 0.0.0.0/0 (means "anyone on the internet"). By default Oracle suggests 10.0.0.0/8, which only allows internal traffic. This was the mistake that wasted 2 hours of my life. Double-check it.

I used port ranges (3000–3020, 4000–4020) instead of single ports so I have spare slots for future projects without coming back here.

We will set up Firewall 2 (iptables on the VPS) in Stage 3.

Stage 3: Install Rathole on the VPS (Server Side)

Step 1: SSH into the VPS

ssh -i ~/Downloads/ssh-key.key ubuntu@YOUR_VPS_IP

(Replace the IP with yours.) If it asks "Are you sure you want to continue?", type yes.

Step 2: Update the system

sudo apt update && sudo apt upgrade -y
sudo apt install unzip -y

Step 3: Download Rathole v0.4.8

cd /tmp
wget https://github.com/rapiz1/rathole/releases/download/v0.4.8/rathole-x86_64-unknown-linux-musl.zip

Why exactly v0.4.8 musl? The "musl" version is a single static file — no extra libraries needed. It works on old and new Ubuntu the same way. Also, the server and client must be the same version, otherwise they will not talk to each other.

Step 4: Install it

unzip rathole-x86_64-unknown-linux-musl.zip
sudo mv rathole /usr/local/bin/
sudo chmod +x /usr/local/bin/rathole
rathole --version    # should print: rathole 0.4.8

Step 5: Create the server config

mkdir -p ~/rathole && cd ~/rathole
nano server.toml

Paste this (change the token to your own secret):

[server]
bind_addr = "0.0.0.0:2333"
default_token = "my_secret_token_12345"

[server.services.frontend-3000]
type = "tcp"
bind_addr = "0.0.0.0:3000"
token = "my_secret_token_12345"

[server.services.backend-4000]
type = "tcp"
bind_addr = "0.0.0.0:4000"
token = "my_secret_token_12345"

[server.services.mongodb]
type = "tcp"
bind_addr = "0.0.0.0:27017"
token = "my_secret_token_12345"

What this means in plain English:

• bind_addr = "0.0.0.0:2333" → The server listens on port 2333 for the client (your laptop) to connect.
• Each [server.services.xxx] block says: "When someone visits this port on the VPS, forward it through the tunnel."
• token is a password so random strangers can't hijack your tunnel.

Save (Ctrl+O, Enter) and exit (Ctrl+X).

Step 6: Open ports in Firewall 2 (iptables on the VPS)

This is the second firewall. Oracle's Ubuntu image comes with iptables blocking everything by default.

sudo iptables -I INPUT 6 -m state --state NEW -p tcp --dport 2333 -j ACCEPT
sudo iptables -I INPUT 6 -m state --state NEW -p tcp --dport 3000:3020 -j ACCEPT
sudo iptables -I INPUT 6 -m state --state NEW -p tcp --dport 4000:4020 -j ACCEPT
sudo iptables -I INPUT 6 -m state --state NEW -p tcp --dport 27017 -j ACCEPT

sudo apt install iptables-persistent -y
sudo netfilter-persistent save

The last line saves the rules so they survive a reboot. If you skip this, your tunnel will break the next time the VPS restarts.

Step 7: Make Rathole start automatically (systemd service)

sudo nano /etc/systemd/system/rathole-server.service

Paste:

[Unit]
Description=Rathole Server
After=network.target

[Service]
Type=simple
User=ubuntu
WorkingDirectory=/home/ubuntu/rathole
ExecStart=/usr/local/bin/rathole /home/ubuntu/rathole/server.toml
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target

Save and exit. Then:

sudo systemctl daemon-reload
sudo systemctl enable rathole-server
sudo systemctl start rathole-server
sudo systemctl status rathole-server

You should see active (running) in green. If yes, the VPS side is done. Type exit to leave the SSH session.

Stage 4: Install Rathole on Your Laptop (Client Side)

Open a terminal on your home laptop (not the VPS).

Step 1: Install the same Rathole version

cd /tmp
wget https://github.com/rapiz1/rathole/releases/download/v0.4.8/rathole-x86_64-unknown-linux-musl.zip
unzip rathole-x86_64-unknown-linux-musl.zip
sudo mv rathole /usr/local/bin/
sudo chmod +x /usr/local/bin/rathole
rathole --version

Step 2: Test that the VPS is reachable

nc -zv YOUR_VPS_IP 2333

It should say succeeded!. If it says refused or hangs, go back and recheck both firewalls (Stage 2 and Stage 3 Step 6). Don't move on until this works.

Step 3: Create the client config

mkdir -p ~/rathole && cd ~/rathole
nano client.toml

Paste (use the same token and same IP as your server):

[client]
remote_addr = "YOUR_VPS_IP:2333"
default_token = "my_secret_token_12345"

[client.services.frontend-3000]
type = "tcp"
local_addr = "127.0.0.1:3000"

[client.services.backend-4000]
type = "tcp"
local_addr = "127.0.0.1:4000"

[client.services.mongodb]
type = "tcp"
local_addr = "127.0.0.1:27017"

In plain English:

• remote_addr → where the VPS is.
• Each [client.services.xxx] block says: "When the VPS sends traffic for this service, deliver it to this local port on my laptop."
• The service names must match exactly between server and client (frontend-3000, backend-4000, mongodb).

Step 4: Start your website locally

Before starting the tunnel, your actual app must be running on your laptop:

# Frontend (React/Vite)
cd ~/my-website/frontend && npm run dev

# Backend (Node.js)
cd ~/my-website/backend && npm start

# MongoDB usually runs as a service already
sudo systemctl status mongod

Step 5: Start Rathole client

rathole ~/rathole/client.toml

You should see logs like:

[INFO] Control channel established
[INFO] Service frontend-3000: Heartbeat established
[INFO] Service backend-4000: Heartbeat established
[INFO] Service mongodb: Heartbeat established

🎉 The tunnel is live.

Stage 5: Test From the Real Internet

This is the fun part. Open your mobile phone, turn off WiFi, and use mobile data (so you are testing from a real outside connection, not your home network).

In your phone browser, visit:

http://YOUR_VPS_IP:3000

If your website loads — congratulations, you are now self-hosting from your bedroom. 🚀

Test the backend too:

http://YOUR_VPS_IP:4000/api/health

Make the Client Auto-Start on Your Laptop Too

Right now, if you close the terminal or reboot, the tunnel dies. Fix it the same way as the server:

sudo nano /etc/systemd/system/rathole-client.service

[Unit]
Description=Rathole Client
After=network.target

[Service]
Type=simple
User=YOUR_USERNAME
WorkingDirectory=/home/YOUR_USERNAME/rathole
ExecStart=/usr/local/bin/rathole /home/YOUR_USERNAME/rathole/client.toml
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target

Replace YOUR_USERNAME with your actual Linux username (run whoami to find out).

sudo systemctl daemon-reload
sudo systemctl enable rathole-client
sudo systemctl start rathole-client
sudo systemctl status rathole-client

Now Rathole starts every time you boot your laptop. (You still need your dev servers running, of course.)

Mistakes I Made (So You Don't Have To)

1. Source CIDR was 10.0.0.0/8 instead of 0.0.0.0/0 in Oracle Security List. Nothing worked from the outside. Took me 2 hours to find.
2. Forgot the second firewall (iptables) on the VPS. Oracle's Ubuntu image silently blocks ports even after you open them in the cloud console.
3. Mismatched Rathole versions between server and client. Always use the same version on both sides.
4. Forgot to save iptables rules. After a VPS reboot, the tunnel was broken. netfilter-persistent save fixes this.
5. Started Rathole client before starting the local app. The tunnel works, but visitors get "connection refused". Always run your app first.
6. Used CORS with localhost only in the backend. Once the site is on a public IP, you must allow that IP in CORS, otherwise the frontend will silently fail to call the backend.

Why This Setup Is So Good

• Free forever. Oracle Always Free + Rathole open source = ₹0/month.
• Fast. Your website actually runs on your powerful laptop (16 GB RAM, SSD), not a 1 GB VPS. The VPS is just a postman.
• Permanent IP. Same address every time, no random ngrok URLs.
• Private. Your data stays on your hardware. The VPS never sees decrypted traffic if you add HTTPS later.
• Scalable. Want to host 5 more projects? Just add new service blocks in server.toml and client.toml and reload. I kept ports 3001–3020 spare for exactly this.

What's Next

Things I plan to add later, and maybe write follow-up blogs about:

1. A free domain (from DuckDNS or Freenom) so visitors don't have to type an IP.
2. HTTPS with Let's Encrypt using Caddy or Nginx on the VPS as a reverse proxy in front of Rathole.
3. A second tunnel for SSH so I can access my home laptop from anywhere.
4. Monitoring with a simple uptime ping, so I know if the tunnel ever drops.

Final Thought

Before this setup, I thought self-hosting was only for people with expensive servers and static IPs. Turns out, with one free VPS and a 5 MB binary called Rathole, any normal laptop with normal home internet can host real websites for the world — even from behind a CG-NAT ISP.

If you got stuck anywhere, the two things to check first are always:

1. Both firewalls (Oracle Security List + VPS iptables).
2. Both Rathole versions match.

Happy tunneling. 🕳️