5 ms·

Now, dynamic DNS is not something to worry about but CGNAT

KronisLV 3y ago
> Now, dynamic DNS is not something to worry about but CGNAT Thankfully, there are some pretty cheap VPS options out there. I actually have my homelab behind some, with the nodes running WireGuard to bypass CGNAT. There's also a few proxy services mentioned in other comments that basically do the same. Of course, you can also just run things "in the cloud" because the non-enterprise VPS providers come at many different price points, but at the same time it's also just really nice to put your own devices to a good use and have the data be on your own drives (hopefully with adequate backups)
timcobb 3y ago
Thanks for sharing, I'd never heard of that. That would be transparent for me as a subscriber, though? I imagine the packets are routed to my cable modem based on some other identified like a MAC?
- mcfedr 3y ago
  CGNAT means you don't have an internet routable IP, so you have no way of hosting something anyone can access without some external proxy, such as cloudflare or tailscale
  - timcobb 3y ago
    Oh so it’s just like home NAT, and they won’t let me port for ward
    - foresto 3y ago
      It's more complicated than that. https://tailscale.com/blog/how-nat-traversal-works#concerning-cgnats https://tailscale.com/blog/how-nat-traversal-works#concernin...
      - RealityVoid 3y ago
        If I'm reading this right, just the fact you have a static IP does not mean you're not behind a CGNAT. It could be static at the carrier level only, right? How could I reliably tell if I'm behind a CGNAT or not? If I poll one of those "what is my IP" websites, and the IP my router has assigned from the wan matches the what is my IP then I'm fine, I'm not behind one, right? And if you can access the services using a dydns kind of thing, then you're safe, you're not behind a CGNAT as well. Only catch where you could be wrong is if you try to access from the same CGNAT network (is this how you call it?) But since the dydns is probably swing your wide internet IP that should still not work?
        tomxor 3y ago
        > How could I reliably tell if I'm behind a CGNAT or not? If I poll one of those "what is my IP" websites, and the IP my router has assigned from the wan matches the what is my IP then I'm fine, I'm not behind one, right? My layman understanding is that the WAN IP on your router will match the "what is my ip" website, but the problem is that it will also match many other people's routers. Basically imagine your home router and NAT has been moved into the ISP and is serving thousands of end users as well as you... you can't just configure the ISP's CGNAT to forward port 80 to you alone. I'm not sure if there is a definitive way to know if you are behind CGNAT, however its definitely the case on all mobile networks.
        deleted 3y ago
        [deleted]
        hunter2_ 3y ago
        > the WAN IP on your router will match the "what is my ip" website, but the problem is that it will also match many other people's routers That's interesting. So the ISP is directing packets at the various customer routers using some other identifier than the WAN IP the router sees? MAC address or something?
        dwattttt 3y ago
    - cookiengineer 3y ago
      It's a little different because all the ipv4 tunneling protocols were invented either for or to counter that. NAT64 is usually done at the ISP's gateway and the public IPv4 (at least) is shared with thousands of other customers. (With such internet connections you are always classified as a bot/spam with captcha services that don't understand IPv6 btw) As a customer, you cannot influence the IPs and neither the ports that get routed through, so you have to connect to a server that you host somewhere else, just for the purpose of tunneling the traffic. So the server at home is actually a client that reconnects to the reverse proxy as there's no other way to have the open connection. I saw a big chance for WebRTC data channels to fix exactly that, but I've given up because Google and Mozilla both put a lot of restrictions in the protocol to make it unfeasible for this use case. And this kinda applies for most cable internet providers in Europe because RIPE ran out of IPs a long time ago. On one hand we got Daimler blocking a whole /8 subnet, and on the other hand we have ISPs that have less than 16 IPv4s. Doesn't make sense to me how this is handled tbh. [1] https://en.wikipedia.org/wiki/NAT64 https://en.wikipedia.org/wiki/NAT64
      - lostmsu 3y ago
        Can you describe the WebRTC restrictions you mentioned?
  - deleted 3y ago
    [deleted]

> Now, dynamic DNS is not something to worry about but CGNAT Thankfully, there are some pretty cheap VPS options out there. I actually have my homelab behind some, with the nodes running WireGuard to bypass CGNAT. There's also a few proxy services mentioned in other comments that basically do the same. Of course, you can also just run things "in the cloud" because the non-enterprise VPS providers come at many different price points, but at the same time it's also just really nice to put your own devices to a good use and have the data be on your own drives (hopefully with adequate backups)

timcobb 3y ago

Thanks for sharing, I'd never heard of that. That would be transparent for me as a subscriber, though? I imagine the packets are routed to my cable modem based on some other identified like a MAC?

mcfedr 3y ago
CGNAT means you don't have an internet routable IP, so you have no way of hosting something anyone can access without some external proxy, such as cloudflare or tailscale
- timcobb 3y ago
  Oh so it’s just like home NAT, and they won’t let me port for ward
  - foresto 3y ago
    It's more complicated than that. https://tailscale.com/blog/how-nat-traversal-works#concerning-cgnats https://tailscale.com/blog/how-nat-traversal-works#concernin...
    - RealityVoid 3y ago
      If I'm reading this right, just the fact you have a static IP does not mean you're not behind a CGNAT. It could be static at the carrier level only, right? How could I reliably tell if I'm behind a CGNAT or not? If I poll one of those "what is my IP" websites, and the IP my router has assigned from the wan matches the what is my IP then I'm fine, I'm not behind one, right? And if you can access the services using a dydns kind of thing, then you're safe, you're not behind a CGNAT as well. Only catch where you could be wrong is if you try to access from the same CGNAT network (is this how you call it?) But since the dydns is probably swing your wide internet IP that should still not work?
      - tomxor 3y ago
        > How could I reliably tell if I'm behind a CGNAT or not? If I poll one of those "what is my IP" websites, and the IP my router has assigned from the wan matches the what is my IP then I'm fine, I'm not behind one, right? My layman understanding is that the WAN IP on your router will match the "what is my ip" website, but the problem is that it will also match many other people's routers. Basically imagine your home router and NAT has been moved into the ISP and is serving thousands of end users as well as you... you can't just configure the ISP's CGNAT to forward port 80 to you alone. I'm not sure if there is a definitive way to know if you are behind CGNAT, however its definitely the case on all mobile networks.
        deleted 3y ago
        [deleted]
        hunter2_ 3y ago
        > the WAN IP on your router will match the "what is my ip" website, but the problem is that it will also match many other people's routers That's interesting. So the ISP is directing packets at the various customer routers using some other identifier than the WAN IP the router sees? MAC address or something?
        dwattttt 3y ago
  - cookiengineer 3y ago
    It's a little different because all the ipv4 tunneling protocols were invented either for or to counter that. NAT64 is usually done at the ISP's gateway and the public IPv4 (at least) is shared with thousands of other customers. (With such internet connections you are always classified as a bot/spam with captcha services that don't understand IPv6 btw) As a customer, you cannot influence the IPs and neither the ports that get routed through, so you have to connect to a server that you host somewhere else, just for the purpose of tunneling the traffic. So the server at home is actually a client that reconnects to the reverse proxy as there's no other way to have the open connection. I saw a big chance for WebRTC data channels to fix exactly that, but I've given up because Google and Mozilla both put a lot of restrictions in the protocol to make it unfeasible for this use case. And this kinda applies for most cable internet providers in Europe because RIPE ran out of IPs a long time ago. On one hand we got Daimler blocking a whole /8 subnet, and on the other hand we have ISPs that have less than 16 IPv4s. Doesn't make sense to me how this is handled tbh. [1] https://en.wikipedia.org/wiki/NAT64 https://en.wikipedia.org/wiki/NAT64
    - lostmsu 3y ago
      Can you describe the WebRTC restrictions you mentioned?
- deleted 3y ago
  [deleted]