I currently have Tailscale and Cloudflare Tunnels set up to bust through my CGNAT. These get a lot of gripe because they’re not truly 100% self-hosted and thus vulnerable to snooping. The only alternative I have seen is renting a VPS and setting up wireguard to the VPS.

Wouldn’t a VPS also be vulnerable to snooping? Seems like two sides of the same coin to me.

My ISP doesn’t offer ipv6. I don’t have access to another server/connection.

Is there any other truly 100% selfhosted way to get past CGNAT?