Is self-hosting legal? What actually stops you

Is self-hosting legal?

Yes. Self-hosting is legal in every country you are plausibly reading this from, and running a web server, a file sync server or a mail server on hardware you own or on a VPS you rent breaks no law by the act of running it. What stops people is a contract they agreed to, or a network they do not control. Four constraints do almost all of the blocking: a residential internet service provider's terms of service, a blocked outbound port 25, CGNAT (carrier grade network address translation), and the licence on the software itself.

Renting a VPS removes the first three. It changes nothing at all about the fourth. That asymmetry is most of the reason people who start on a home broadband line end up on a rented server.

One note before the detail: this is written by people who run servers, not by lawyers, and it is not legal advice. Which rules apply to you depends on your country and on what you choose to serve.

Your ISP says "no servers", and that is a contract, not a law

Many residential broadband contracts contain a clause that forbids running servers on the connection. Breaking that clause is a contract matter between you and your ISP. The consequences are the ones a contract can produce: a warning email, a throttled upload, a push onto a business plan, or termination of the account. There is no criminal exposure in the clause itself, which is why the question "is self-hosting legal" and the question "will my ISP let me" have different answers.

The gap between the clause and what gets enforced is wide, and it is worth understanding why. An ISP does not inspect which daemon is listening on your machine. What it sees is traffic volume, abuse complaints arriving from other networks, and whatever its own scanners flag on your address. A Home Assistant instance or a photo library used by two people produces almost nothing measurable, so it sits below the line for years. Sustained upload at line rate, or one complaint about spam or scanning traffic, puts you above the line immediately. Enforcement follows the symptom, not the clause.

Two other residential facts matter more than the clause in practice. Your address is usually dynamic, so any public name has to be kept current with dynamic DNS, and every change costs you a few minutes of downtime. And a business-class plan from the same ISP normally drops the server prohibition and adds a static address, which is the clean fix where it is offered.

Why is port 25 blocked, and can I get it opened?

Port 25 is the TCP port that SMTP (simple mail transfer protocol) servers use to hand mail to each other. Outbound connections to port 25 are blocked on nearly every consumer ISP, because a compromised home machine sending spam is the most common form of network abuse there is, and blocking one port stops it at the source.

Providers block it too. As of September 2026, Google Cloud blocks connections to destination TCP 25 when the destination is outside your own VPC (virtual private cloud) network, and that block is not lifted on request. AWS throttles outbound port 25 on new EC2 accounts and expects you to ask for the limit to be raised. Many budget VPS hosts block it until an account has some payment history, which is a spam control rather than a policy about mail servers.

The direction matters. Inbound port 25 is how your server receives mail. Outbound port 25 is how it delivers mail. So a blocked outbound 25 produces a server that accepts mail perfectly and never delivers any: the queue grows, and the log fills with connection timeouts to the recipient's MX host. Submission ports 587 and 465 to a relay are usually open, so you can still send through a third party service and keep receiving on your own box. Whether the whole exercise is worth it is a separate question, and self-hosting email has costs beyond one open port.

CGNAT leaves you with no address to be reached at

CGNAT means your ISP has put hundreds of customers behind one shared public IPv4 address. Your router's WAN address comes from 100.64.0.0/10, the shared address space reserved in RFC 6598, or from an ordinary private range. Port forwarding on your own router then does nothing, because the translation that matters happens on ISP equipment you have no access to. Nothing on the internet can start a connection to you.

The test takes thirty seconds. Read the WAN address from your router's status page, then load any page that reports your public address. If they differ, or if the router shows something starting with 100.64 through 100.127, you are behind CGNAT. Inbound ports will never work, however correct your firewall rules are.

There are four ways out. Ask the ISP for a public IPv4 address, which some hand over free, some charge for, and some simply refuse. Use IPv6, if your ISP gives you a real prefix and you accept that visitors on IPv4-only networks cannot reach you. Keep the service at home and put the public listener on a VPS, reaching back over a tunnel, which is what advertising your home network from a subnet router on a VPS does. Or move the service onto the VPS and stop fighting the access problem. Those last two are different goals, and a VPS and a VPN answer different questions.

Do software licences like SSPL and BSL stop me self-hosting?

No, and this is the constraint readers misjudge most often. Several widely self-hosted projects have moved off standard open source licences since 2018. In every case the new restriction is aimed at companies offering the software to third parties as a paid service. Running an instance for yourself, your family or your own employer is the case these licences explicitly permit.

The SSPL (Server Side Public License), used by MongoDB from 2018 and by Elasticsearch from 2021, states the obligation directly in its section 13: "If you make the functionality of the Program or a modified version available to third parties as a service, you must make the Service Source Code available via network download to everyone at no charge, under the terms of this License." The trigger is offering the functionality as a service. Your own instance behind your own login is not that.

The BSL (Business Source License) version 1.1 comes from MariaDB and is used by HashiCorp's Terraform, among others. It grants non-production use outright, and each vendor adds an Additional Use Grant on top. Terraform's grant reads: "You may make production use of the Licensed Work, provided Your use does not include offering the Licensed Work to third parties on a hosted or embedded basis in order to compete with IBM Corp.'s paid version(s) of the Licensed Work." Every BSL release also carries a Change Date, at most four years after publication, when it converts to the Change License. For Terraform that is MPL 2.0, so each release becomes open source on a schedule.

n8n uses its own Sustainable Use License. It permits you to "use or modify the software only for your own internal business purposes or for non-commercial or personal use", and allows you to pass it on "only if you do so free of charge for non-commercial purposes". Automating your own company's work is inside that grant. Selling hosted n8n to other people is not. Redis is a third pattern: as of Redis 8, released in 2025, contributions are offered under a choice of RSALv2, SSPLv1 or AGPLv3, while 7.2 and earlier remain BSD 3-clause.

The AGPL deserves one line of its own, because people fear it without reading it. It asks for source only from someone who modifies the program and then offers it over a network. Run an unmodified build for yourself and you owe nobody anything.

A useful test: are you charging other people for access to this software's functionality? If the answer is no, every licence named above allows what you are doing. And a licence breach is a copyright matter between you and the vendor, settled with lawyers and money. It is not a criminal act, and no licence in this family is enforced by anything that arrives at your door.

What renting a VPS changes, and what it does not

Three of the four constraints change the moment you move onto a rented server.

• The "no servers" clause is gone, because a VPS acceptable use policy assumes you are running servers. That is the product.
• CGNAT is gone. You get a routable public IPv4 address, normally one per instance, so inbound ports work as documented.
• Port 25 becomes negotiable instead of fixed. Some hosts open it after a support request and some never do, but there is a request to make.

Licensing changes by exactly nothing. It is the same software under the same terms, and the line it draws is about who you serve rather than where the CPU lives.

Renting also adds an obligation that home hosting mostly hides from you. You become the operator of record for a public IP address, so traffic leaving it is attributed to you. When something goes wrong the notice lands at your host and then in your inbox, which is worth reading about before it happens: what an abuse complaint is and how to answer one and the operational duties you accept when you rent a server.

What a host's acceptable use policy usually restricts

Acceptable use policies differ between providers, and you should read the one you signed rather than trusting a summary of the genre. This one included. What follows is the pattern these documents share, not any single company's position.

• An open SMTP relay, meaning a mail server that accepts mail from anyone and forwards it anywhere. Spammers find one within days of it appearing, and the first consequence is your address on public blocklists.
• An open DNS resolver. A short query can produce a large answer, so an attacker who spoofs the source address turns your resolver into a way to aim traffic at someone else. That is why a recursive resolver is expected to answer only your own networks.
• Open proxies and exit nodes that you do not police. The traffic is legally yours once it leaves your IP address, so a proxy anyone can use makes you the visible source of whatever they do.
• Outbound port scanning and login brute force, whether you launched it or a compromised container did.
• Distributing material you have no right to distribute, which is the policy line that usually arrives as a copyright notice rather than as a technical complaint.

Resource rules sit in the same document and are worth a glance: shared plans often cap sustained CPU use, and some hosts prohibit cryptocurrency mining outright. Those are contract terms, not law.

Where your legal exposure actually sits

The act of running a server is not where your risk lives. Two other things are.

The first is what you serve. Copyright is the common case. A media server playing your own discs to your own household is one question, and sharing that same library with people outside it is distribution, which is a different question with a much clearer answer. Defamation, regulated content and anything requiring a licence to publish work the same way: the server is neutral, and the content is what a claim would be about.

The second is whose data you hold. Under the GDPR (general data protection regulation), Article 2(2)(c) puts purely personal or household activity outside the regulation entirely. So a Nextcloud holding your family's own files is not in the same position as a forum with two hundred registered accounts. Once you hold other people's personal data you are a controller, which brings a lawful basis for processing, the ability to answer a subject access request, and a breach notification duty measured in 72 hours. IP addresses in logs count as personal data, which is why self-hosted analytics you can configure to discard identifiers is a calmer starting position than a stack that keeps full addresses forever. Data about only your own household stays inside the exemption, so keeping your budget in a self-hosted app is a security responsibility rather than a compliance one.

There is one US-specific point worth knowing if you host content other people upload. The DMCA safe harbour in section 512(c) is available only to a service that has designated an agent with the Copyright Office. Skipping that registration does not create liability on its own. It removes a defence you would otherwise have.

Where to start now that the answer is yes

The legal question is settled, and the remaining decisions are practical: which services earn the maintenance they cost, and what the first one looks like end to end. Start with which services are actually worth self-hosting, then follow how to self-host a website on a server you control for the first deployment.

FAQ

Can my ISP cancel my internet service for running a server?

It can, because a residential contract that forbids servers makes this a contract matter and termination is one of the remedies a contract allows. In practice ISPs act on what they can measure, so sustained upload at line rate or an abuse complaint from another network prompts a warning long before anyone asks which software you are running. A small service used by a few people rarely registers. If you want the question closed, a business plan from the same ISP normally permits servers and adds a static address.

Why can my self-hosted mail server receive email but not send it?

Outbound TCP port 25 is blocked on your connection. Receiving uses inbound 25 and works fine, while delivery needs an outbound connection to port 25 on the recipient's mail exchanger, so the queue grows and the log fills with connection timeouts. Nearly all consumer ISPs block this permanently. Some providers do too: as of September 2026 Google Cloud blocks destination TCP 25 outside your own VPC network and does not lift it. Send through a relay on port 587 or 465, or host somewhere that will open 25 on request.

Does an SSPL or BSL licence stop me self-hosting the software?

No. SSPL section 13 only applies when you make the software's functionality available to third parties as a service, and a BSL 1.1 release grants non-production use outright plus whatever production use the vendor's Additional Use Grant allows. Terraform's grant permits production use unless you are offering a hosted or embedded version that competes with the paid product. n8n's Sustainable Use License permits use for your own internal business purposes or personal use. The consistent line is reselling, not running.

Do I need to think about GDPR for a server only my family uses?

Article 2(2)(c) of the GDPR excludes processing carried out for purely personal or household activity, so a photo library or file sync server used by your own household falls outside it. The moment you create accounts for people outside that circle, the exemption stops applying and you become a controller, which means a lawful basis for processing, a way to answer subject access requests, and a 72 hour breach notification duty. The practical step is to decide early which side of that line a service is on, and to keep logs and analytics configured so you are not storing identifiers you never wanted.