1. Understand the Difference Between IPs First

• Local IP (Private IP): For example, 192.168.1.100. This is only used by computers inside your office router’s network to identify each other. This IP does not exist on the public internet because millions of offices worldwide use the exact same local IPs.
• ISP’s Main IP (Shared Public IP): When you search “What is my IP” in a browser, the IP shown is your ISP’s main IP. Most ISPs use CGNAT technology to share a single main IP among hundreds of customers.
• Real IP (Dedicated Public IP): This is a unique public IP address assigned exclusively to your office router; no one else shares it.

2. Why Won’t the Server Show If You Add the Main IP to the Domain?

1. If you put the Local IP (192.168.x.x) into your domain’s DNS, the internet won’t know which building’s 5th floor you are referring to. As a result, the site won’t load at all.
2. If you put the ISP’s Main IP into the domain, a visitor’s request will successfully reach your ISP’s main gate (server). However, since there are 500 other customers under that same main IP, the ISP’s router won’t know which specific customer should receive the request. The connection will be blocked right there, and your server won’t show up.
3. Additionally, main IPs are usually Dynamic—meaning they change periodically. Once the IP changes, the domain will stop working anyway.

3. How to “Merge” a Local IP and a Public IP?

1. Get a Real IP: Contact your ISP to get a dedicated Real IP for a small additional monthly fee.
2. Connect the Domain: Go to your domain’s DNS settings and put that Real IP into the A Record.
3. Port Forwarding on the Router (Merging): Log in to your office router, go to the Port Forwarding option, and configure a rule stating— “If anyone from outside hits port 80 or 443 (web server ports) of my Real IP, forward them directly to my server’s Local IP (192.168.x.x).”

4. Is There Any Alternative Without a Real IP? (Free Solution)

• How it works: You add your domain to Cloudflare and install a small lightweight software (cloudflared) on your office server. This creates a secure, private tunnel directly from your local server to Cloudflare.
• Benefits: It requires no Real IP, eliminates the hassle of router port forwarding, and is completely free. Your server will go live on your domain even over your ISP’s shared IP.

If you want to build a complete web hosting server (using control panels like cPanel, CyberPanel, or aaPanel to host multiple websites, domains, and emails), you must obtain a Real IP (Dedicated Public Static IP) from your ISP.

1. Why is a Real IP Mandatory for a Full Hosting Server?

• Keeping Multiple Ports Open: A hosting server does not just need Ports 80 (HTTP) and 443 (HTTPS) to display websites; it also requires open ports for file uploads via FTP (Port 21), server control via SSH (Port 22), control panels (e.g., 2083 for cPanel, 8090 for CyberPanel), and Email Services (Ports 25, 465, 587).
• Custom Nameservers: If you want to create custom nameservers like ns1.yourdomain.com and ns2.yourdomain.com, you cannot register them in your domain registrar panel without a Real IP.
• Email Server: Having a Real IP and setting up rDNS (Reverse DNS / PTR Record) through your ISP is mandatory for sending and receiving emails reliably.

2. Steps to Turn Your Office Server into a Hosting Server Using a Real IP

3. Can Websites Be Hosted Without a Real IP? (Cloudflare Tunnel)

4. Practical Precautions for Running an Office Hosting Server

1. Power and Internet Backup: A hosting server must run 24/7. If the power goes out at the office or the ISP connection drops, all your websites will go offline. Therefore, having a reliable Online UPS / IPS and, if possible, two different ISP connections is highly recommended.
2. Hacking and Security: Enabling DMZ or Port Forwarding on your router exposes your server directly to the internet. You must use a strong firewall on the server (such as UFW or CSF) and set strong passwords on your router.

Basics: Local IP vs. ISP Main IP vs. Real IP

• Local IP (Private IP): Such as 192.168.1.100. This is only used by computers inside your office router’s network to identify each other. This IP does not exist on the public internet because millions of offices worldwide use the exact same local IP ranges.
• ISP’s Main IP (Shared Public IP): When you search “What is my IP” in a browser, the IP shown is your ISP’s main IP. Most ISPs use CGNAT technology to share a single main IP among hundreds of customers.
• Real IP (Dedicated Public IP): This is a public IP assigned exclusively to your office router; no one else shares it.

1. If you put the Local IP (192.168.x.x) in the domain’s DNS, the internet won’t know which building’s 5th floor it belongs to, so the site won’t load.
2. If you put the ISP’s Main IP in the domain, the visitor’s request will reach the ISP’s main gate. However, because there are 500 other customers under that same IP, the ISP’s router won’t know who should receive the request. The connection will be blocked right there.
3. Furthermore, shared main IPs are usually Dynamic—meaning they change periodically, which would break your domain connection anyway.

1. Obtain a dedicated Real IP from your ISP.
2. Point your domain’s A Record to that Real IP.
3. Configure Port Forwarding in your office router to instruct it: “Whenever someone from outside hits port 80 or 443 of my Real IP, forward them directly to my server’s Local IP (192.168.x.x).”

Complete Guide to Hosting an Office Local Server Online: Real IP, Port Forwarding, MikroTik NAT, and Cloudflare Tunnel

Part 1: Understanding IP Addresses and Why Shared IPs Fail

1. The Three Types of IP Addresses

• Local IP (Private IP): Examples include 192.168.1.100 or 192.168.88.100. This address is assigned by your office router to identify devices within your local network (LAN). It has no direct visibility on the global internet because millions of offices worldwide use the exact same local IP ranges.
• ISP Main IP (Shared Public IP / CGNAT): When searching “What is my IP” on Google, the displayed address is your ISP’s public IP. Most ISPs use CGNAT (Carrier-Grade NAT) to share a single public IP across hundreds of customers.
• Real IP (Dedicated Public Static IP): A unique public IP address assigned exclusively to your office router. No other user shares this IP, and it never changes dynamically.

2. Why Adding a Local or Shared IP to a Domain Does Not Work

1. If you point a domain to a Local IP (192.168.x.x): The global internet does not know which building that room belongs to, so the connection fails immediately.
2. If you point a domain to the ISP’s Shared Main IP: Visitor requests will reach the main gate (the ISP’s core router), but because 500 other customers share that same IP, the ISP’s router will not know which customer holds the server. The incoming request gets dropped.
3. Dynamic Changes: Shared IPs change periodically, which breaks domain DNS configurations.

Part 2: Requirements for a Full Web Hosting Server

1. Why a Real IP is Required for Full Hosting

• Multiple Open Ports: A hosting server requires more than just web ports 80 (HTTP) and 443 (HTTPS). It requires open access for FTP (21), SSH (22), Control Panels (2083 for cPanel, 8090 for CyberPanel, 8888 for aaPanel), DNS (53), and Email Services (25, 465, 587, 993).
• Custom Nameservers: Registering custom child nameservers (such as ns1.yourdomain.com and ns2.yourdomain.com) at a domain registrar requires a dedicated Real IP.
• Email Deliverability: Running a mail server requires a Real IP with rDNS (Reverse DNS / PTR Record) configured by your ISP.

2. Real IP vs. Cloudflare Tunnel Comparison

3. Hardware and Infrastructure Precautions

• Power & Internet Redundancy: Hosting servers must run 24/7. Ensure your office has a reliable Online UPS/IPS and, ideally, a secondary backup ISP connection.
• Firewall Security: Exposing a local server via Port Forwarding or DMZ opens it to external traffic. Always keep a server firewall (UFW or CSF) active and enforce strong passwords.

Part 3: Connecting Real IP and Local IP on Standard Routers

Step 1: Verify Your Real IP

1. Log in to your router admin panel (typically 192.168.0.1 or 192.168.1.1).
2. Go to the Status or WAN / Internet section and note the WAN IP Address.
3. Search What is my IP on Google.
4. Compare: If the WAN IP inside your router matches the IP shown on Google, your Real IP is active. If they differ, your connection is still behind ISP CGNAT.

Step 2: Set a Static Local IP for the Server

1. Navigate to DHCP $\rightarrow$ Address Reservation (or Static Lease).
2. Click Add New.
3. Enter your server PC’s MAC Address and assign a fixed local IP (e.g., 192.168.1.100).
4. Save and reboot the network connection.

Step 3: Configure Port Forwarding or DMZ

Option A: Port Forwarding (Recommended & Secure)

1. Go to Forwarding / NAT Forwarding $\rightarrow$ Virtual Servers or Port Forwarding.
2. Click Add New and map the required ports to your server’s local IP (192.168.1.100):

Option B: DMZ Setup (Forwards All Ports at Once)

1. Go to Forwarding or Advanced $\rightarrow$ DMZ.
2. Set DMZ Status to Enable.
3. Enter your server’s local IP (192.168.1.100) in the DMZ Host IP Address field and click Save.

Step 4: Allow Ports Through the Server OS Firewall

• Ubuntu/Linux: Run sudo ufw allow 80/tcp and sudo ufw allow 443/tcp (or let your hosting control panel manage the firewall).
• Windows Server: Open Windows Defender Firewall with Advanced Security $\rightarrow$ Inbound Rules and allow the required ports.

Step 5: Test and Connect Domain

1. Visit an open port checker tool (such as [yougetsignal.com/tools/open-ports/](https://yougetsignal.com/tools/open-ports/)), enter your Real IP and port 80, and verify that the port shows as Open.
2. Go to your domain’s DNS management panel and add an A Record pointing @ to your Real IP.

Part 4: Port Forwarding (DST-NAT) & Hairpin NAT in MikroTik Router (Winbox)

• Real IP: 103.10.20.30
• Server Local IP: 192.168.88.100
• Office LAN Subnet: 192.168.88.0/24

Step 1: Make Server Local IP Static in MikroTik

1. Open Winbox and go to IP $\rightarrow$ DHCP Server $\rightarrow$ Leases.
2. Double-click your server’s IP lease, click Make Static, and click OK.

Step 2: Configure Port Forwarding (DST-NAT) via Winbox

1. Navigate to IP $\rightarrow$ Firewall $\rightarrow$ NAT and click the + (Add) button.
2. Under the General tab:
   • Chain: dstnat
   • Dst. Address: 103.10.20.30 (Your Real IP)
   • Protocol: 6 (tcp)
   • Dst. Port: 80,443,21,22,8090 (Add all necessary ports separated by commas)
3. Under the Action tab:
   • Action: dst-nat
   • To Addresses: 192.168.88.100 (Your Server Local IP)
   • To Ports: Leave blank.
4. Click Apply and OK. (Create a second rule with Protocol 17 (udp) and Dst. Port 53,443 if you run DNS and HTTP/3).

Step 3: Configure Hairpin NAT (Access Server via Domain from Inside Office LAN)

1. In IP $\rightarrow$ Firewall $\rightarrow$ NAT, click + (Add).
2. Under the General tab:
   • Chain: srcnat
   • Src. Address: 192.168.88.0/24 (Office LAN Subnet)
   • Dst. Address: 192.168.88.100 (Server Local IP)
   • Protocol: 6 (tcp)
3. Under the Action tab:
   • Action: masquerade
4. Click Apply and OK, then drag this rule to the top of your NAT rules list.

Step 4: One-Click MikroTik Terminal Script (Alternative to Manual GUI Setup)

/ip firewall nat
# 1. TCP Port Forwarding (Web, FTP, SSH, CyberPanel/cPanel, Mail)
add chain=dstnat dst-address=103.10.20.30 protocol=tcp dst-port=80,443,21,22,25,465,587,993,8090,2083,2087 action=dst-nat to-addresses=192.168.88.100 comment="Hosting_Server_TCP"
# 2. UDP Port Forwarding (DNS & QUIC/HTTP3)
add chain=dstnat dst-address=103.10.20.30 protocol=udp dst-port=53,443 action=dst-nat to-addresses=192.168.88.100 comment="Hosting_Server_UDP"
# 3. Hairpin NAT (Access from inside Office LAN)
add chain=srcnat src-address=192.168.88.0/24 dst-address=192.168.88.100 action=masquerade comment="Hairpin_NAT"

Step 5: Disable MikroTik’s Conflicting Default Services

1. Go to IP $\rightarrow$ Services.
2. Select www (80), ftp (21), ssh (22), telnet (23), and api, then click the red X (Disable) button. Keep only winbox (8291) active.

Part 5: Hosting Without a Real IP Using Cloudflare Tunnel

Prerequisites

1. A domain name added to a free Cloudflare account (dash.cloudflare.com) with active Cloudflare nameservers.
2. A running local web server (XAMPP, Apache, Nginx, CyberPanel, or aaPanel).

Step 1: Create a Tunnel in Cloudflare Zero Trust

1. Log in to one.dash.cloudflare.com and select the $0 Free plan if prompted.
2. Navigate to Networks $\rightarrow$ Tunnels and click Create a tunnel.
3. Select Cloudflared as the connector type and click Next.
4. Name your tunnel (e.g., Office-Hosting-Server) and click Save tunnel.

Step 2: Install the Connector (cloudflared) on Your Server

• For Ubuntu / Debian (Linux):
  Bash

  curl -L --output cloudflared.deb https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb && sudo dpkg -i cloudflared.deb && sudo cloudflared service install <YOUR_SECRET_TOKEN>

• For Windows: Download and install the Windows binary, open Command Prompt as Administrator, and run:
  DOS

  cloudflared.exe service install <YOUR_SECRET_TOKEN>

Step 3: Route Your Domain to Your Local IP (Public Hostname)

1. Under the Public Hostname tab:
   • Subdomain: Leave blank for the root domain, or enter a subdomain like www or panel.
   • Domain: Select your domain from the dropdown menu.
2. Under Service:
   • Type: Select HTTP (or HTTPS if your local server uses a local SSL certificate).
   • URL: Enter localhost:80 or your server’s local IP (192.168.88.100:80).
   • (Note: If you choose HTTPS, expand Additional application settings $\rightarrow$ TLS and enable No TLS Verify to prevent SSL handshake errors).
3. Click Save tunnel. Cloudflare will automatically create the DNS records, issue a free SSL certificate, and make your local server live globally.

Step 4: Hosting Multiple Websites & Control Panels on One Tunnel

1. Open your tunnel in Cloudflare Zero Trust and go to the Public Hostname tab.
2. Click Add a public hostname for each new domain and point them all to localhost:80. Your local web server (Apache/Nginx/LiteSpeed) will automatically route visitors to the correct website folder using Virtual Hosts.
3. To access your hosting control panel remotely (e.g., CyberPanel on port 8090 or aaPanel on port 8888), create a hostname like panel.yourdomain.com and set the Service URL to https://localhost:8090 (with No TLS Verify enabled).