I actually gave it 44000-65535 and it’s connecting well. That’s another reason why I wanted a more robust network: IOT VLAN to segregate that risk.

The setup is very strange. They don’t provide a router. They took the old phone lines going to each unit (which appears to have been done in Cat5 decades ago) and put an RJ-45 end on it. That plugs into a POE powered wireless access point with two more ports on it. Plugging my laptop in, the gateway does not respond to HTTP requests. The tech who installed it said I have to call the home office to change my wireless password. I got them to disable the wireless so I could put my router on the other end but I’m either running on a network that my shady small time ISP has full control over or I’m behind a double NAT. Speeds were 900+ up and down though.

I might see if I can get the AP re-enabled and let the switch connect to it directly if that even fixes the Switch’s NAT issues.

A little searching seems like Cloudflare Argo tunnels might be a good route to try. And possibly free, though I’m not opposed to paying for a better service. There seems to be a fair amount of step by step documentation on this. I’ll demo this on my lab as I haven’t moved it to the new apartment yet.

I ended up going with tailscale. Every other option exposed my secret services to the Internet, even if behind a password. Tailscale was ridiculously easy to set up too. The docker compose I used had Heimdall in it too so I was able put all my links on there. Procedure is connect with tailscale app -> go to http://illegalshit -> click/tap on relevant link. I might pull back on my Nginx proxy targets and port forwards for this more secure system.

What happens if tailscale goes down though?