Skip to main content

NAT product usage guide

This guide applies to products whose name or details page mentions NAT, shared IPv4, or port mapping. Products with a dedicated public IPv4 address usually do not need to use port mapping in this way.

IPv4 port limits for NAT products​

NAT products use a shared public IPv4 address. Public IPv4 access is limited to the mapped ports assigned to your service. Other IPv4 ports cannot be accessed directly from the public internet.

Open NAT Management from the product details page to view the actual public IPv4 ports and internal port mappings assigned to your service. The port range is subject to the product details page and may vary by product.

Common mapping example:

Public IPv4 portMapped internal portTypical use
3010122SSH
30102-3012030102-30120Web services, proxies, and similar services

The table above is only an example. When connecting or deploying services, use the ports shown on your own product details page.

How to connect over SSH​

If NAT Management shows that public IPv4 port 30101 maps to internal port 22, the SSH command is:

ssh root@public-ipv4 -p 30101

Do not connect to the NAT product's public IPv4 address on the default 22 port. The public IPv4 port available to you is the assigned mapped port.

Deploying web or other services​

If you want to access a service through public IPv4, the service must listen on the internal port that matches the mapping.

For example, NAT Management shows:

  • Public IPv4 port: 30102
  • Internal port: 30102

The service should listen on 30102 inside the VPS. Public access will use:

public-ipv4:30102

The listen address must also be correct. Listen on the internal address, 0.0.0.0, or IPv6 [::]. Do not listen only on 127.0.0.1, otherwise the public port mapping usually cannot reach the service.

IPv6 usage​

If the product includes IPv6, IPv6 usually does not require NAT port mapping. You can access service ports directly through the IPv6 address.

Example:

[IPv6-address]:80

Before using IPv6, confirm:

  • Your local network has IPv6 connectivity.
  • The VPS has an IPv6 address and route configured.
  • The service listens on the IPv6 address or [::]:port.
  • The VPS firewall allows the required port.

You can use test-ipv6.com to check whether your local network supports IPv6.

What conditions are required for TCP port connectivity?​

For a port to be reachable from the public internet, these conditions usually all need to be true:

  • The service is running and listening on the correct port.
  • The VPS firewall allows the port.
  • The public and internal port mapping in NAT Management is correct.
  • The route is reachable and is not blocked by the local network, ISP, or transit path.
  • For special protocols, the protocol itself supports NAT scenarios. For example, FTP may require passive mode or additional NAT traversal configuration.

Inside the VPS, check the listening status with:

ss -tunlp | grep <port>
# or
netstat -tunlp | grep <port>

From an external network, test port connectivity with:

nc -zv public-ip port
telnet public-ip port

nc -zv -6 ipv6-address port
telnet -6 ipv6-address port

How to identify China-direction connectivity issues​

If mainland China networks cannot access the server but overseas networks can, the issue may be related to China-direction routing or access restrictions.

You can use ping.pe to test the public IPv4 or IPv6 from multiple regions. If overseas nodes are normal but China-direction nodes fail, try:

  • Connecting over IPv6.
  • Connecting from an overseas network or through an overseas relay server.
  • Using ByteVirt WebSSH.

For WebSSH, fill in the public IP, SSH port, username, and password. Other options can usually stay at their defaults.

If overseas networks can ping the server but SSH still cannot connect, use VNC or the console to confirm whether the sshd service is still running.

How to handle Connection Refused​

Connection refused usually means no service is listening on the target port, or the service is rejected by the system firewall.

Check in this order:

  1. Confirm the service has started.
  2. Confirm the service listens on the correct port.
  3. Confirm the service is not bound only to 127.0.0.1.
  4. Confirm the VPS firewall allows the port.
  5. Confirm the NAT Management port mapping is correct.

For example, with ufw:

sudo ufw allow <port>

If using IPv6, confirm the service listens on [::]:port or the specific IPv6 address. Listening only on 0.0.0.0:port usually means IPv4 only.

Small-memory product suggestions​

If the NAT VPS has limited memory, such as 256 MB, avoid high-resource environments such as Docker. Prefer lighter stacks such as Caddy, PHP, and SQLite.

Please provide in your ticket​

If the service is still unreachable after the steps above, please provide:

  • Product ID or service name.
  • Screenshot of the port mapping shown in NAT Management.
  • The connection command or access address you actually used.
  • Output of ss -tunlp or netstat -tunlp.
  • Firewall rule screenshots or related command output.
  • External connectivity test results, such as ping.pe, traceroute, MTR, nc, or telnet output.