4 ms·

The "port blocking" may just be a symptom of how the modem connects to the internet, rather than being a malicious act by the ISP. CGNAT is becoming a common wa

by amanzi 5y ago

The "port blocking" may just be a symptom of how the modem connects to the internet, rather than being a malicious act by the ISP. CGNAT is becoming a common way for ISPs to connect consumers to the internet, even here in NZ many ISPs use this. It basically puts a bunch of consumers behind the same NAT interface meaning that port-forwarding no longer works.

deathanatos 5y ago
Even with normal NAT, you have to set up the port-forwarding, and you have to know how to do that. Also, some routers have a bug¹ whereby even a properly port-forwarded service won't be accessible from within the network. E.g., the port-forwarded service "works", except for you, on your own network. Really frustrating since it means how you connect depends on where you are, and it's a lot of special crap needed to determine "oh, okay, I'm on the home network so use the internal IP"; almost ended up setting up a split-horizon DNS to deal with it². ¹ISPs will tell you that they "lack a feature". Yeah, okay. ²but then we moved and now we have a different monopoly for an ISP.
- AdamJacobMuller 5y ago
  1) isn't a bug, it is a lack of a feature. In order to accomplish that you need to double-NAT things because otherwise the internal service will send the reply directly to your computer instead of sending it back to the NAT gateway to reverse the NAT. The router needs to NAT the destination IP for the client and NAT the source IP for the server. The thing is, 99.9999% of these devices never even have the port forwarding feature touched and an even smaller % of the devices where people enable port forwarding care about this.
- mercora 5y ago
  > Also, some routers have a bug¹ whereby even a properly port-forwarded service won't be accessible from within the network. i think the missing feature is called hairpinning[0] [0] https://en.wikipedia.org/wiki/Hairpinning https://en.wikipedia.org/wiki/Hairpinning
rstuart4133 5y ago
He's an Australian, and so am I. His ISP (Optus) doesn't go out their way to block ports. However, he says he's using a AC800s 4G/LTE modem and backs that up by saying is using mobile data. The default mobile data service from all telco's will use CGNAT and will hand him some 10.0.0.0 address. I presume that's because mobile phones don't run servers as a rule, so no one notices and it saves them a bit of money. They don't deliberately block any particular port, but CGNAT effectively blocks all of them. He could pay a extra and get mobile data with a static IP Address if he wished. Not from Optus - they discontinued that service (which gives an indication of popular it is), but other virtual carriers based on Optus still offer it. I guess it's not worth the money to him. Everything supports IPv6 now, and IPv6 happily carries IPv4. Why the telco's are still dicking around with CGNAT and IPv4 is a bit of a mystery.
- easton 5y ago
  I seem to recall hearing somewhere on HN that some ISPs even turn CGNAT on for IPv6 connections (in fact, I'm pretty sure AT&T's LTE has it). I have no idea why, other than people being so used to packets not routing to their local box that they've disabled their firewalls. The people who made that decision probably went to the same school that told network admins to disable IPv6 on VPN connections.
- fomine3 5y ago
  Depending how v4 over v6 implemented. NAT64/DNS64 don't use CGNAT for v4/v4 (but use v4/v6 NAT, may call proxy), but 464XLAT, MAP-E, and DS-lite is still CGNAT. I prefer v4/v4 CGNAT over NAT64/DNS64 for transparency. Some CGNAT allow to forward port (but on limited range).

by amanzi 5y ago

deathanatos 5y ago

Even with normal NAT, you have to set up the port-forwarding, and you have to know how to do that. Also, some routers have a bug¹ whereby even a properly port-forwarded service won't be accessible from within the network. E.g., the port-forwarded service "works", except for you, on your own network. Really frustrating since it means how you connect depends on where you are, and it's a lot of special crap needed to determine "oh, okay, I'm on the home network so use the internal IP"; almost ended up setting up a split-horizon DNS to deal with it². ¹ISPs will tell you that they "lack a feature". Yeah, okay. ²but then we moved and now we have a different monopoly for an ISP.

AdamJacobMuller 5y ago
1) isn't a bug, it is a lack of a feature. In order to accomplish that you need to double-NAT things because otherwise the internal service will send the reply directly to your computer instead of sending it back to the NAT gateway to reverse the NAT. The router needs to NAT the destination IP for the client and NAT the source IP for the server. The thing is, 99.9999% of these devices never even have the port forwarding feature touched and an even smaller % of the devices where people enable port forwarding care about this.
mercora 5y ago
> Also, some routers have a bug¹ whereby even a properly port-forwarded service won't be accessible from within the network. i think the missing feature is called hairpinning[0] [0] https://en.wikipedia.org/wiki/Hairpinning https://en.wikipedia.org/wiki/Hairpinning

rstuart4133 5y ago

He's an Australian, and so am I. His ISP (Optus) doesn't go out their way to block ports. However, he says he's using a AC800s 4G/LTE modem and backs that up by saying is using mobile data. The default mobile data service from all telco's will use CGNAT and will hand him some 10.0.0.0 address. I presume that's because mobile phones don't run servers as a rule, so no one notices and it saves them a bit of money. They don't deliberately block any particular port, but CGNAT effectively blocks all of them. He could pay a extra and get mobile data with a static IP Address if he wished. Not from Optus - they discontinued that service (which gives an indication of popular it is), but other virtual carriers based on Optus still offer it. I guess it's not worth the money to him. Everything supports IPv6 now, and IPv6 happily carries IPv4. Why the telco's are still dicking around with CGNAT and IPv4 is a bit of a mystery.

easton 5y ago
I seem to recall hearing somewhere on HN that some ISPs even turn CGNAT on for IPv6 connections (in fact, I'm pretty sure AT&T's LTE has it). I have no idea why, other than people being so used to packets not routing to their local box that they've disabled their firewalls. The people who made that decision probably went to the same school that told network admins to disable IPv6 on VPN connections.
fomine3 5y ago
Depending how v4 over v6 implemented. NAT64/DNS64 don't use CGNAT for v4/v4 (but use v4/v6 NAT, may call proxy), but 464XLAT, MAP-E, and DS-lite is still CGNAT. I prefer v4/v4 CGNAT over NAT64/DNS64 for transparency. Some CGNAT allow to forward port (but on limited range).