Privacy, security and safety concerns have always negated the usefulness of having a public ip for a home connection. Especially in India's political climate. Any controversial tweet or facebook post from your home connection would have local authorities knocking at your door asking you to take down your post/tweet.
For example, under the previous state government, citizens would tweet at the power discom to notify them of an outage and it would be resolved that way. No calling or visiting the local office was necessary. But after a new government was formed, whoever was put in charge sent electrical workers to the homes of whoever tweeted to scold them about making issues public and told them to visit the local office instead. They had your address even if you did not share your connection details.
CG-NAT is often looked down upon as a cost-cutting measure by the ISP but it is a form of privacy-through-obscurity that I consider absolutely necessary. I have multiple connections, and they're power cycled randomly twice a day, so as to mimic real-world power outages or disconnects. Each time I'm assigned a different public IP.
With Tailscale and Wireguard, CG-NAT becomes a non-issue. You don't need to open or forward any ports and can have a very strict firewall put in place:
That's ~35 million packets dropped on attempts that tried to access my router from the wan interface, an average of ~300,000 per day.
The interface is Winbox, a utility to manage Mikrotik routers. All of their routers use the same app and differ only in hardware features (ports, compute power).
This firewall rule drops any new connections that do not originate from the LAN, existing connections to the internet that were initiated from the LAN will work as normal.
@AmeyaVS the essence was that tailscale is incredibly easy to implement and will suffice for most, if not all, cases where you need to access something on your home network, when you're not on your network. Then, as you learn by implementing and experimenting, you can look into virtualized firewalls/routers to get access to other devices like NVRs.
If you absolutely need a Public IP on a home connection, then it would be wise to have it on a separate connection specifically for that purpose, and not use it for personal browsing (messaging, social media).
