Running Ollama behind CGNAT

Every guide to exposing a home server starts the same way: log into your router, forward a port, done. Behind CGNAT, that step fails silently, not because you configured it wrong, but because there's no public IP on your side of the connection to forward anything to.

What CGNAT actually is

Carrier-grade NAT sits between your router and the real internet, sharing one public IPv4 address across hundreds or thousands of customers. Your router's "WAN IP" is itself a private address on the carrier's network, one more layer of NAT stacked on top of the one already happening in your home. A port forwarding rule on your router only ever affects traffic that already reached your router. Under CGNAT, nothing from the outside reaches your router directly, no matter what rule you add.

It's common on mobile connections, increasingly common on residential fiber and cable as ISPs run out of IPv4 addresses to hand out, and effectively universal on IPv6-only deployments talking to an IPv4 world. If forwarded ports never seem to actually open when you test them externally, and your router's WAN IP doesn't match what a "what's my IP" site reports, that's CGNAT.

The usual workarounds, and their cost

• Pay for a static IP. Many ISPs sell a dedicated public IPv4 address as a business-tier add-on. It works, and it's the "correct" fix. It's also a recurring cost for something that used to be free.
• IPv6. If both ends have real IPv6 connectivity, CGNAT doesn't apply. But that pushes the problem onto whichever client is trying to reach you, and mobile carriers frequently don't route IPv6 the way home connections do.
• A VPN with a public relay. Tailscale and similar tools solve this by having every device dial out to a coordination server, which is the same trick that gets you out of CGNAT. But now you're running a VPN client on every device that wants access, not just serving one API.

The actual fix for Ollama specifically

None of the above matter if nothing needs to reach your machine from outside in the first place. Amallo runs in the menu bar or system tray and dials out to Relay, the same direction of connection your browser uses to load a webpage. CGNAT, and the NAT under your own router, only get in the way of inbound connections; an outbound one just works, the same as it does for every other app on your machine that phones home.

Set up is identical regardless of what's on the other side of your router:

1. Have Ollama running on 127.0.0.1:11434 with a model pulled.
2. Install Amallo for macOS or Windows.
3. Point Cursor, Aider, Open WebUI, or any OpenAI-compatible client at the base URL and key Amallo opens with.

There's no port to forward, so there's no CGNAT layer for it to fail against.