Reach a home service behind CGNAT

Your ISP puts you behind CGNAT, so you have no public IP and no inbound port to forward — the usual "open a port on the router" advice simply does not apply. A media server, a NAS UI, or a home automation panel is stuck on your LAN. Because the Kepeink agent connects outbound, none of that matters: it reaches the router plane from the inside and your service becomes reachable over HTTPS.

Why Kepeink is great for this

• CGNAT, mobile, and satellite links block inbound connections — the agent's outbound-only design works anyway.
• No router configuration, no port forwarding, no dynamic-DNS scripts.
• Your service stays on the LAN; only the specific target you choose is exposed.

The recipe

1. Find the local address of the service at home, for example a media server on port 8096:

   curl -sI http://localhost:8096 | head -n 1
   # → HTTP/1.1 200 OK

2. Create a proxy tunnel targeting http://localhost:8096 and copy its agent token.
3. Install the agent as a service on the always-on machine at home so it reconnects on reboot:

   curl -fsSL https://cdn.kepeink.hu/install.sh | sudo sh -s -- --token=kpt_xxxxxxxx

4. Open the assigned hostname from anywhere. Requests travel down the tunnel to your home machine and reach the service on http://localhost:8096.

Because the agent runs as a service, the tunnel comes back on its own after a power cut or a reboot.