IP addresses and networking basics for hosting
IPv4, IPv6, public vs private, ports, NAT and what happens when you run out of addresses.
Public vs private addresses
Public — routable on the internet. What your website binds to.
Private — only valid inside a network (e.g.
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16). Used for your mesh and internal service traffic.
Services that only need to be reached by other services should bind to a private address so they are never exposed.
IPv4 vs IPv6
IPv4 is the familiar 203.0.113.10; there are not enough of them, hence IPv6. We provide both. For a website to work over IPv6, publish an AAAA record alongside the A record — see DNS records explained. A common silent failure is hosting over IPv6 but only publishing an A record: IPv6-capable clients may not find you.
Ports
A port identifies a service on a host. The ones you will meet:
| Port | Service |
|---|---|
| 22 | SSH |
| 25 / 465 / 587 | SMTP (server-to-server / implicit TLS / submission) |
| 53 | DNS |
| 80 / 443 | HTTP / HTTPS |
| 3306 / 5432 | MySQL / PostgreSQL |
| 6379 | Redis |
| 993 / 143 | IMAP over TLS / IMAP |
| 1935 | RTMP |
| 51820 | WireGuard |
A firewall rule is really "which ports are open, to whom". Default-deny, then allow only what you serve — see Firewall basics.
Binding
A program can bind to:
127.0.0.1— loopback, reachable only on the machine. Right for a database that only the local app uses.A private address — reachable across your mesh.
0.0.0.0— every interface, i.e. public. Right only for services meant to be public.
Binding a database to 0.0.0.0 because "it was easier" is one of the most common ways people get compromised.
NAT and why a service "cannot be reached"
Behind NAT, a service with no port forwarding is invisible from outside, no matter what you point DNS at. Our services get public addresses directly, so this mostly affects home networks, but it explains a lot of "I pointed DNS at my home IP and nothing happened".
Reverse DNS (PTR)
The mapping from IP back to a hostname. You cannot set it in your own DNS zone; it belongs to whoever owns the IP. It matters for mail — see Email hosting setup.
Related reading