I am afraid that the author of the article is not quite fortunate to explain his situation. That is the article can be somewhat misleading. Let me briefly explain, please.
- The preamble reads that home router may not have a public IP but private provider’s address only. Ergo, NAT, and no port forwarding for homelab. Yes, that well may be true if a provider uses dynamic NAT. At the same time there is no problem with port forwarding if provider uses static NAT while giving private IP to his client.
- Usually cloud/collocation datacenters serve as Internet providers for their clients as well and rent not only servers, but (statically NAT’ted) public IP’s for them.
- A tunnel from homelab (Spain) to datacenter (France)? Quite obvious that it has to be built over Internet. Please note that configuration is not clear. To me, there are two tunnels. I think that the author missed to mention the fact that his homelab is attached to datacenter via primary tunnel and yet another secondary tunnel (within the first one).
- All in all it looks like the author
- rented a bridge with (statically NAT’ted) public IP from datacenter
- attached his homelab’s router to that bridge via vpn/tunnel(s)
That is the problem of not having public static IP for homelab can be solved by attaching the homelab to another provider via vpn/tunnel given that this extra provider rents public static IPs.
That is not “behind CGNAT” as such. Do you see?