6 ms·

Related and kinda related links: * In San Francisco, good old MonkeyBrains offers an off-the-menu, In'n'Out-style coloc deal: https://www.monkeybrains.net/colo

Related and kinda related links: * In San Francisco, good old MonkeyBrains offers an off-the-menu, In'n'Out-style coloc deal: https://www.monkeybrains.net/colocation.php https://www.monkeybrains.net/colocation.php Fun! If you're thinking of doing this, say so here, maybe we can all share an amp or two. * If you just want to play with something that isn't an Amazon instance, and are not sure you want to commit to a >$50 a month server somewhere, https://lowendbox.com/ https://lowendbox.com/ always has a few crazy deals. * Never underestimate just slinging a box under your desk at the end of a consumer internet connection. I think people sometimes overestimate how difficult it is; I honestly think everyone should do it once, if only to get that visceral feel of being a peer on the global Internet.

genewitch 2y ago
> at the end of a consumer internet connection. CGNAT needs to be routed around, which means you need at least a "$5 VPS" with a routable IP address to bastion for you. If you monitor the word "wifi" on social media it's a pretty decent proxy for where CGNAT is prevalent. Used in a sentence, "we just got wifi at the new house." I've written a couple guides on this and subjects like it; i've had to use squid in a datacenter to forward proxy my lightning detector at the house, otherwise it would never receive a heartbeat - even though it would auth and start trying to send data; i've bypassed CGNAT so i could host console "co-op" games (diablo III, for example); and i've "mirrored" my phone media sync to a colocated server as well, just to avoid trying to route around (triple?) CGNAT to my synology at home.
- fragmede 2y ago
  Tailscale funnel will let you expose a service to the world without a $5 VPS.
  - genewitch 2y ago
    ipv4 space and bandwidth cost non-zero dollars so I'd ask "who is paying and why?" I'm understand that a significant portion of HN is on fiber or whatever, but not everyone has access to fiber, cable, or even - dare i speak it - DSL. CGNAT was mentioned as being prevalent in the UK and germany almost 6 years ago (for example.) I haven't had a non-cgnat ISP the entire time i've lived in Louisiana, and not for lack of trying. (at&t, t-mobile, at&t fixed wireless (x2!), starlink) I'm not paying >$5/month to solve the problem "but what if i want to self host a public service" to switch to business or whatever, either, that's ridiculous. edit: also i have colo hardware; i write guides for people who either don't or don't know how. cool if tailscale works. wireguard does too...
    - fragmede 2y ago
      Tailscale is essentially a free-to-home-users, paid-for-enterprise very usable frontend to Wireguard. They really make it easy. The free service is paid for by the enterprise users.
    - Novosell 2y ago
      Tailscale runs over Wireguard. I'm pretty sure they just subsidise their free plan using earnings from their paid plans. Getting a foot in the door and all that. If devs use it at home, they might vouche for it at work.
    - vladvasiliu 2y ago
      I also think they mostly provide the connection setup, actual traffic should travel directly between the peers most of the time.
  - razakel 2y ago
    So they're offering a free (presumably limited) ngrok-like service?
  - PLG88 2y ago
    Plenty of alternatives exist - https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling. My issue with Funnel is that it includes no auth, exposing you to anyone in the world. I will advocate for zrok.io as I work on its parent project, OpenZiti. zrok is open source and has a free SaaS (as well as auth and hardening in general).
- toast0 2y ago
  CGNAT is a scourge, but at least around me, it doesn't seem to be the norm for residential wired internet. 5G yes; starlink, I think so?; geosynchronous satellite, I don't know, but probably. T-Mobile 5G fixed location internet does offer static IPs if you have a SMB account with an EIN, but not for home accounts or SMB with a SSN.
  - sulandor 2y ago
    > CGNAT is a scourge, but at least around me, it doesn't seem to be the norm for residential wired internet. this is highly dependent on your location. most isp's do not have enough v4-adresses for their consumer base.
  - vladvasiliu 2y ago
    > at least around me, it doesn't seem to be the norm for residential wired internet. It used to be rare in France, too, but now it seems to be spreading. AFAIK SFR, one of the major ISPs, doesn't even offer the option (paid or otherwise) to avoid it. Edit: they do provide what looks like a fixed IPv6, though.
    - consp 2y ago
      > It used to be rare in France, too, but now it seems to be spreading. AFAIK SFR, one of the major ISPs, doesn't even offer the option (paid or otherwise) to avoid it. They realised they can sell the ipv4 blocks for far more and most consumers don't know any better or care. At least I keep my ipv4 adres if I keep the connection up (dhcp lease time is ignored, it is 4 hours despite dhcp saying 24). Asking for a ipv6 adres is like shouting into the void and waiting for an echo which never comes.
    - kolp 2y ago
      SFR will switch you from cgnat to ipv4 if you contact customer support and explain that you work from home and need to open specific ports to access your work servers or VPN. I did just this a month ago. Takes less than 24 hours and you should be OK on ipv4.
- altairprime 2y ago
  Note for the unfamiliar that ISP (CG) NAT is not at all universal, nor always mandatory when initially present; my past several carriers all issued public IPv4 and public IPv6 /64 or greater that were accessible if I set the appropriate settings. Caveats apply; i.e. the AT&T BGW320 routers seem to cap at 8192 connections even when in bridging mode. Such are the tradeoffs of buying residential rather than business service. (The else-described proxies can be a cost-effective counter to this and other such concerns, i.e. dynamic IP assignments versus dyndns update intervals.)
- komali2 2y ago
  Odd, I never heard of this. So I might be sharing a public IPv4 address with a neighbor? I run a server out of my bedroom with a TON of services on it. I used to use google domains + DDNS + nginx reverse proxy to manage it, and I still use that for two services that wasn't playing nice with cloudflare (jellyfin + tubearchivist), but now mostly use cloudflare tunnels. For the two services, I just pray my IP address doesn't change. For some reason, it doesn't. But I never new I might be sharing that IP address. I've never had routing issues, does that mean I'm lucky? Is this like, a major security vulnerability I've exposed users (just friends) of my hosted services to? Maybe because I'm in Taiwan our ISPs just operate a lot differently? For example, not a single complaint at terabytes up/down every month.
  - nicoburns 2y ago
    If your servers are working fine then chances are you're ISP just isn't using this setup. Some do, some don't.
  - yuye 2y ago
    If you've got Chunghwa/HiNet, you most likely don't suffer from CG-NAT. They're the most expensive offer because they're the best offer. If you're with those shitty resellers, you 99% will get CG-NATed. You pay 50% of the CHT price, but you get 25% the quality. You see this in large apartment buildings: They take Chunghwa fiber and resell it, NAT the entire building into the 192.168.0.0/16 block to save on costs, because IPv4 is $$$. Forget about IPv6 support. The bandwidth they have is oversold, so the 400M you bought might not actually reach those speeds during peak hours, unless you're lucky enough to be living in a new building where more than half the apartments are vacant. I have some experience with the latter. Their support staff is often utterly incompetent, too.
    - consp 2y ago
      This sounds like the solution the provider offered when they commercialised my student internet connection. A building with over 1k connections had 4 ipv4 adresses and no proper cgnat. This means you get niceties like: * Everyone gets their neighbors favourite language in the search engine if you have a incognito session. * Only about 32k sessions possible per adres. And yes you can claim them all and kill everyone's internet connection. * All local ip's were interconnected and not firewalled. That was fun. * You get banned or soft throttled everywhere due to "strange behaviour". They were doing it on the cheap and fortunately got told it would void their contract if they did not provide something better and it was "fixed" after about a year. But during rush you would still end up maxing the 4gbit fiber uplink even with only a fast ethernet connection for everyone.
- Neil44 2y ago
  In these parts that's only a thing on mobile connections.
piou 2y ago
Well shoot, if you're in the East Bay and would rather colo in Oakland, use the coupon code "non-clown" to get half off the prices here: https://account.eppihost.com/order/colocation/ https://account.eppihost.com/order/colocation/ (I typically offer VPSes, but just added some colo options for my hosting services because of this thread, as you can probably tell by the package names I chose. The coupon only applies to colocation.)
- schmookeeg 2y ago
  I live in Alameda and colo in San Jose and would way prefer the shorter drive, even though I never visit my server.. but... this webpage isn't a real product offering is it? Like, you made it in response to the topic post (right?) I lol'ed regardless. Bravo, and... I may look you up if OpenColo keeps irritating me. They have been surfing that line just below "irritated enough to move". They recently rug-pulled my whole IP block and forced a bunch of reconfig on me I wasn't down for. I'm still salty. Quadranet never did that to me in ~13 years with them. AWS neither come to that.
  - piou 2y ago
    Clearly my business/branding sense and my sense of humor are off... it is a real product offering, and I'll honor the offer and the coupon if you sign up. Typically I provide website and VPS hosting, just hadn't advertised colo services publicly so threw the product page together. I'll change the product names eventually when I come up with something I like. (Standard disclaimer: while supplies last.)
- teruakohatu 2y ago
  Thanks for offering us a discount. Can I ask why your cabinet and the Mission facility mentioned in the parent comment have just a single 10Gbps fiber connection shared between colo servers. I can get a 5Gbps at home and probably 10 if I asked nicely, I thought in SF it would be straight forward to get multiples of that.
  - piou 2y ago

genewitch 2y ago

> at the end of a consumer internet connection. CGNAT needs to be routed around, which means you need at least a "$5 VPS" with a routable IP address to bastion for you. If you monitor the word "wifi" on social media it's a pretty decent proxy for where CGNAT is prevalent. Used in a sentence, "we just got wifi at the new house." I've written a couple guides on this and subjects like it; i've had to use squid in a datacenter to forward proxy my lightning detector at the house, otherwise it would never receive a heartbeat - even though it would auth and start trying to send data; i've bypassed CGNAT so i could host console "co-op" games (diablo III, for example); and i've "mirrored" my phone media sync to a colocated server as well, just to avoid trying to route around (triple?) CGNAT to my synology at home.

fragmede 2y ago
Tailscale funnel will let you expose a service to the world without a $5 VPS.
- genewitch 2y ago
  ipv4 space and bandwidth cost non-zero dollars so I'd ask "who is paying and why?" I'm understand that a significant portion of HN is on fiber or whatever, but not everyone has access to fiber, cable, or even - dare i speak it - DSL. CGNAT was mentioned as being prevalent in the UK and germany almost 6 years ago (for example.) I haven't had a non-cgnat ISP the entire time i've lived in Louisiana, and not for lack of trying. (at&t, t-mobile, at&t fixed wireless (x2!), starlink) I'm not paying >$5/month to solve the problem "but what if i want to self host a public service" to switch to business or whatever, either, that's ridiculous. edit: also i have colo hardware; i write guides for people who either don't or don't know how. cool if tailscale works. wireguard does too...
  - fragmede 2y ago
    Tailscale is essentially a free-to-home-users, paid-for-enterprise very usable frontend to Wireguard. They really make it easy. The free service is paid for by the enterprise users.
  - Novosell 2y ago
    Tailscale runs over Wireguard. I'm pretty sure they just subsidise their free plan using earnings from their paid plans. Getting a foot in the door and all that. If devs use it at home, they might vouche for it at work.
  - vladvasiliu 2y ago
    I also think they mostly provide the connection setup, actual traffic should travel directly between the peers most of the time.
- razakel 2y ago
  So they're offering a free (presumably limited) ngrok-like service?
- PLG88 2y ago
  Plenty of alternatives exist - https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling. My issue with Funnel is that it includes no auth, exposing you to anyone in the world. I will advocate for zrok.io as I work on its parent project, OpenZiti. zrok is open source and has a free SaaS (as well as auth and hardening in general).
toast0 2y ago
CGNAT is a scourge, but at least around me, it doesn't seem to be the norm for residential wired internet. 5G yes; starlink, I think so?; geosynchronous satellite, I don't know, but probably. T-Mobile 5G fixed location internet does offer static IPs if you have a SMB account with an EIN, but not for home accounts or SMB with a SSN.
- sulandor 2y ago
  > CGNAT is a scourge, but at least around me, it doesn't seem to be the norm for residential wired internet. this is highly dependent on your location. most isp's do not have enough v4-adresses for their consumer base.
- vladvasiliu 2y ago
  > at least around me, it doesn't seem to be the norm for residential wired internet. It used to be rare in France, too, but now it seems to be spreading. AFAIK SFR, one of the major ISPs, doesn't even offer the option (paid or otherwise) to avoid it. Edit: they do provide what looks like a fixed IPv6, though.
  - consp 2y ago
    > It used to be rare in France, too, but now it seems to be spreading. AFAIK SFR, one of the major ISPs, doesn't even offer the option (paid or otherwise) to avoid it. They realised they can sell the ipv4 blocks for far more and most consumers don't know any better or care. At least I keep my ipv4 adres if I keep the connection up (dhcp lease time is ignored, it is 4 hours despite dhcp saying 24). Asking for a ipv6 adres is like shouting into the void and waiting for an echo which never comes.
  - kolp 2y ago
    SFR will switch you from cgnat to ipv4 if you contact customer support and explain that you work from home and need to open specific ports to access your work servers or VPN. I did just this a month ago. Takes less than 24 hours and you should be OK on ipv4.
altairprime 2y ago
Note for the unfamiliar that ISP (CG) NAT is not at all universal, nor always mandatory when initially present; my past several carriers all issued public IPv4 and public IPv6 /64 or greater that were accessible if I set the appropriate settings. Caveats apply; i.e. the AT&T BGW320 routers seem to cap at 8192 connections even when in bridging mode. Such are the tradeoffs of buying residential rather than business service. (The else-described proxies can be a cost-effective counter to this and other such concerns, i.e. dynamic IP assignments versus dyndns update intervals.)
komali2 2y ago
Odd, I never heard of this. So I might be sharing a public IPv4 address with a neighbor? I run a server out of my bedroom with a TON of services on it. I used to use google domains + DDNS + nginx reverse proxy to manage it, and I still use that for two services that wasn't playing nice with cloudflare (jellyfin + tubearchivist), but now mostly use cloudflare tunnels. For the two services, I just pray my IP address doesn't change. For some reason, it doesn't. But I never new I might be sharing that IP address. I've never had routing issues, does that mean I'm lucky? Is this like, a major security vulnerability I've exposed users (just friends) of my hosted services to? Maybe because I'm in Taiwan our ISPs just operate a lot differently? For example, not a single complaint at terabytes up/down every month.
- nicoburns 2y ago
  If your servers are working fine then chances are you're ISP just isn't using this setup. Some do, some don't.
- yuye 2y ago
  If you've got Chunghwa/HiNet, you most likely don't suffer from CG-NAT. They're the most expensive offer because they're the best offer. If you're with those shitty resellers, you 99% will get CG-NATed. You pay 50% of the CHT price, but you get 25% the quality. You see this in large apartment buildings: They take Chunghwa fiber and resell it, NAT the entire building into the 192.168.0.0/16 block to save on costs, because IPv4 is $$$. Forget about IPv6 support. The bandwidth they have is oversold, so the 400M you bought might not actually reach those speeds during peak hours, unless you're lucky enough to be living in a new building where more than half the apartments are vacant. I have some experience with the latter. Their support staff is often utterly incompetent, too.
  - consp 2y ago
    This sounds like the solution the provider offered when they commercialised my student internet connection. A building with over 1k connections had 4 ipv4 adresses and no proper cgnat. This means you get niceties like: * Everyone gets their neighbors favourite language in the search engine if you have a incognito session. * Only about 32k sessions possible per adres. And yes you can claim them all and kill everyone's internet connection. * All local ip's were interconnected and not firewalled. That was fun. * You get banned or soft throttled everywhere due to "strange behaviour". They were doing it on the cheap and fortunately got told it would void their contract if they did not provide something better and it was "fixed" after about a year. But during rush you would still end up maxing the 4gbit fiber uplink even with only a fast ethernet connection for everyone.
Neil44 2y ago
In these parts that's only a thing on mobile connections.

piou 2y ago

Well shoot, if you're in the East Bay and would rather colo in Oakland, use the coupon code "non-clown" to get half off the prices here: https://account.eppihost.com/order/colocation/ https://account.eppihost.com/order/colocation/ (I typically offer VPSes, but just added some colo options for my hosting services because of this thread, as you can probably tell by the package names I chose. The coupon only applies to colocation.)

schmookeeg 2y ago
I live in Alameda and colo in San Jose and would way prefer the shorter drive, even though I never visit my server.. but... this webpage isn't a real product offering is it? Like, you made it in response to the topic post (right?) I lol'ed regardless. Bravo, and... I may look you up if OpenColo keeps irritating me. They have been surfing that line just below "irritated enough to move". They recently rug-pulled my whole IP block and forced a bunch of reconfig on me I wasn't down for. I'm still salty. Quadranet never did that to me in ~13 years with them. AWS neither come to that.
- piou 2y ago
  Clearly my business/branding sense and my sense of humor are off... it is a real product offering, and I'll honor the offer and the coupon if you sign up. Typically I provide website and VPS hosting, just hadn't advertised colo services publicly so threw the product page together. I'll change the product names eventually when I come up with something I like. (Standard disclaimer: while supplies last.)
teruakohatu 2y ago
Thanks for offering us a discount. Can I ask why your cabinet and the Mission facility mentioned in the parent comment have just a single 10Gbps fiber connection shared between colo servers. I can get a 5Gbps at home and probably 10 if I asked nicely, I thought in SF it would be straight forward to get multiples of that.
- piou 2y ago