Port forwarding asks the internet to knock on your router's door. A tunnel removes the door problem entirely: a small program on your PC connects outward to a tunnel service and holds the line open, and your visitors reach the site through it. No open ports, no router surgery - and it works even behind CGNAT.
The video this series accompanies uses the classic route: port forwarding plus Dynamic DNS. That route is excellent - when your ISP lets the internet knock. Many connections do not: homes behind CGNAT, ISPs that block web ports, routers you are not allowed to configure. For all of those, the tunnel is not a hack or a lesser option. It is the modern default, and this guide explains it honestly, costs included.
Home internet is built for outbound connections - every page you open, every video you stream, starts as one. Firewalls, CGNAT and ISP port blocks are designed to stop inbound knocks, not outbound calls. A tunnel connector makes one outbound call to its service and simply never hangs up. The service ties your public hostname to that held-open line, so a visitor's request travels down a connection your PC started. Nothing inbound ever needs to be allowed, which is why CGNAT has no power here.
http://localhost on the port your server uses. The service hands you a public web address, and most services let you attach your own domain.A public website needs a certificate, and on the forwarding route you must arrange and renew one yourself. Tunnel services terminate HTTPS at their edge with a managed certificate for your hostname: the padlock simply works, and renewal is their problem, forever. For many home hosts this single fact justifies the tunnel on its own - an entire chore and an entire failure mode, deleted.
Nothing here is free of trade-offs, and a good guide says them out loud. Your site now depends on a third party: free tiers come with limits (bandwidth, number of sites, sometimes an address that changes if you do not attach a domain), the service sits in the path of your traffic, and if the company changes its terms, your setup feels it. Speeds also route through their network rather than straight to your door. For a first website - and for anyone locked behind CGNAT - these are fair prices. A site that grows real traffic or income eventually graduates to a VPS, where no middleman is needed.
A tunnel publishes exactly what you aim it at, so aim it like it matters:
Watch the video to master the classic forwarding route - then you will understand exactly what the tunnel replaces, and why.
▶️ Watch Full VideoDifferent, not automatically safer. It removes open ports on your router, which is a real win, and it brings managed HTTPS. But it adds a third party whose account becomes a master key to your hostname. With a strong password and two-factor authentication most home users end up safer; without them, worse.
Usually yes - most tunnel services let you connect a custom domain, and then HTTPS for that domain is handled by the service too. Free tiers sometimes reserve custom domains for paid plans, so check that one line before you build your whole setup around a free account.
You can - many people do, and it is a legitimate first choice now. The forwarding route keeps everything under your own control with no middleman and no tier limits. The tunnel wins when ports will not open, when CGNAT is in the way, or when you want zero router work. Run the CGNAT check first; it may make the decision for you.