Home users running JWSTF/NitroWebExpress want to accept inbound traffic from the public internet. However, home routers use NAT and stateful firewalls that only permit outbound connections by default. Standard consumer internet packages do not forward inbound port 80/443 traffic to a home machine.
The NWE Gateway uses a two-phase approach:
┌───────────────────────────────────────────────────────────────────┐
│ PHASE 1: Try Direct (UPnP/NAT-PMP) │
│ │
│ Home Router supports UPnP? │
│ YES → Open ports 80, 443, 8080, 23 on the router │
│ → Verify reachability from outside │
│ → Register public IP with relay (directory only) │
│ → MODE: DIRECT (fastest, zero relay overhead) │
│ │
│ NO → Fall through to Phase 2 │
└────────────────────────────────┬──────────────────────────────────┘
│
┌────────────────────────────────▼──────────────────────────────────┐
│ PHASE 2: Reverse Tunnel (Relay Mode) │
│ │
│ Open outbound SSH tunnel to relay server │
│ → Tunnel ports: local 80/443/8080/23 → relay:assigned_port │
│ → Relay proxies inbound traffic through the tunnel │
│ → MODE: RELAY (works behind any NAT, including CGNAT) │
└───────────────────────────────────────────────────────────────────┘
INTERNET
│
┌─────────────┴─────────────┐
│ │
Direct Mode Relay Mode
(UPnP worked) (UPnP failed)
│ │
▼ ▼
┌─────────────────┐ ┌─────────────────────┐
│ Home Router │ │ relay.mearvk.us │
│ Port 80 → LAN │ │ (central console) │
│ UPnP Mapped │ │ │
└────────┬────────┘ │ nginx reverse proxy │
│ │ │ │
▼ │ SSH tunnel │
┌─────────────────┐ │ (outbound from │
│ Home JWSTF │ │ home → relay) │
│ Apache:80 │ └──────────┬───────────┘
│ Tomcat:8080 │ │
│ NWE:23 │ ┌──────────▼───────────┐
└─────────────────┘ │ Home JWSTF │
│ (behind NAT) │
│ SSH tunnel open │
└──────────────────────┘
| File | Role | Runs On |
|---|---|---|
nwe-gateway |
Client daemon (home instance) | Home machine |
nwe-relay |
Central console server | Public VPS/cloud |
gateway.conf |
Gateway configuration | Home machine |
nwe-gateway.service |
Systemd service (home) | Home machine |
nwe-relay.service |
Systemd service (server) | Public server |
install-gateway.sh |
Home instance installer | Home machine |
# Install (done automatically during OS install)
sudo bash gateway/install-gateway.sh
# Start
systemctl start nwe-gateway
# Check status
nwe-gateway status
# Test reachability
nwe-gateway test# First-time setup on a public VPS
sudo bash -c 'install -m 755 nwe-relay /usr/local/bin/'
sudo nwe-relay setup
sudo nwe-relay start
# Monitor
nwe-relay status
nwe-relay list- Home instance registers with relay at
relay.mearvk.us - Relay assigns a subdomain:
myserver.relay.mearvk.us - External user visits
http://myserver.relay.mearvk.us/ - In direct mode: relay DNS resolves to home's public IP (fast)
- In relay mode: nginx proxies through the SSH tunnel (works everywhere)
- UPnP mappings are time-limited (1 hour lease, auto-renewed)
- SSH tunnel uses ed25519 keys (generated per-instance)
- Relay tunnel user is restricted (
ForceCommand /bin/true, no PTY, no forwarding) - Instance secrets authenticate registrations
- All relay traffic can be TLS-wrapped (certbot on nginx)
- Gateway health-checks every 2 minutes
- CGNAT (Carrier-Grade NAT): Many ISPs put multiple homes behind one IP
- Consumer routers: Not all support port forwarding or UPnP
- Dynamic IPs: Home IPs change; the relay tracks and updates automatically
- Zero-config: The gateway figures it out — no router login needed
- Fallback: Even if everything fails locally, the relay path works
The gateway design respects the home user's network. It:
- Asks the router politely (UPnP) rather than exploiting it
- Removes port mappings cleanly on shutdown
- Never modifies router firmware or configuration files
- Falls back gracefully rather than forcing connectivity
- Uses standard, auditable protocols (SSH, HTTP, UPnP)