5 ms·

> at the end of a consumer internet connection. CGNAT needs to be routed around, which means you need at least a "$5 VPS" with a routable IP address to bastion

> at the end of a consumer internet connection. CGNAT needs to be routed around, which means you need at least a "$5 VPS" with a routable IP address to bastion for you. If you monitor the word "wifi" on social media it's a pretty decent proxy for where CGNAT is prevalent. Used in a sentence, "we just got wifi at the new house." I've written a couple guides on this and subjects like it; i've had to use squid in a datacenter to forward proxy my lightning detector at the house, otherwise it would never receive a heartbeat - even though it would auth and start trying to send data; i've bypassed CGNAT so i could host console "co-op" games (diablo III, for example); and i've "mirrored" my phone media sync to a colocated server as well, just to avoid trying to route around (triple?) CGNAT to my synology at home.

fragmede 2y ago
Tailscale funnel will let you expose a service to the world without a $5 VPS.
- genewitch 2y ago
  ipv4 space and bandwidth cost non-zero dollars so I'd ask "who is paying and why?" I'm understand that a significant portion of HN is on fiber or whatever, but not everyone has access to fiber, cable, or even - dare i speak it - DSL. CGNAT was mentioned as being prevalent in the UK and germany almost 6 years ago (for example.) I haven't had a non-cgnat ISP the entire time i've lived in Louisiana, and not for lack of trying. (at&t, t-mobile, at&t fixed wireless (x2!), starlink) I'm not paying >$5/month to solve the problem "but what if i want to self host a public service" to switch to business or whatever, either, that's ridiculous. edit: also i have colo hardware; i write guides for people who either don't or don't know how. cool if tailscale works. wireguard does too...
  - fragmede 2y ago
    Tailscale is essentially a free-to-home-users, paid-for-enterprise very usable frontend to Wireguard. They really make it easy. The free service is paid for by the enterprise users.
  - Novosell 2y ago
    Tailscale runs over Wireguard. I'm pretty sure they just subsidise their free plan using earnings from their paid plans. Getting a foot in the door and all that. If devs use it at home, they might vouche for it at work.
  - vladvasiliu 2y ago
    I also think they mostly provide the connection setup, actual traffic should travel directly between the peers most of the time.
- razakel 2y ago
  So they're offering a free (presumably limited) ngrok-like service?
- PLG88 2y ago
  Plenty of alternatives exist - https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling. My issue with Funnel is that it includes no auth, exposing you to anyone in the world. I will advocate for zrok.io as I work on its parent project, OpenZiti. zrok is open source and has a free SaaS (as well as auth and hardening in general).
toast0 2y ago
CGNAT is a scourge, but at least around me, it doesn't seem to be the norm for residential wired internet. 5G yes; starlink, I think so?; geosynchronous satellite, I don't know, but probably. T-Mobile 5G fixed location internet does offer static IPs if you have a SMB account with an EIN, but not for home accounts or SMB with a SSN.
- sulandor 2y ago
  > CGNAT is a scourge, but at least around me, it doesn't seem to be the norm for residential wired internet. this is highly dependent on your location. most isp's do not have enough v4-adresses for their consumer base.
- vladvasiliu 2y ago
  > at least around me, it doesn't seem to be the norm for residential wired internet. It used to be rare in France, too, but now it seems to be spreading. AFAIK SFR, one of the major ISPs, doesn't even offer the option (paid or otherwise) to avoid it. Edit: they do provide what looks like a fixed IPv6, though.
  - consp 2y ago
    > It used to be rare in France, too, but now it seems to be spreading. AFAIK SFR, one of the major ISPs, doesn't even offer the option (paid or otherwise) to avoid it. They realised they can sell the ipv4 blocks for far more and most consumers don't know any better or care. At least I keep my ipv4 adres if I keep the connection up (dhcp lease time is ignored, it is 4 hours despite dhcp saying 24). Asking for a ipv6 adres is like shouting into the void and waiting for an echo which never comes.
  - kolp 2y ago
    SFR will switch you from cgnat to ipv4 if you contact customer support and explain that you work from home and need to open specific ports to access your work servers or VPN. I did just this a month ago. Takes less than 24 hours and you should be OK on ipv4.
altairprime 2y ago
Note for the unfamiliar that ISP (CG) NAT is not at all universal, nor always mandatory when initially present; my past several carriers all issued public IPv4 and public IPv6 /64 or greater that were accessible if I set the appropriate settings. Caveats apply; i.e. the AT&T BGW320 routers seem to cap at 8192 connections even when in bridging mode. Such are the tradeoffs of buying residential rather than business service. (The else-described proxies can be a cost-effective counter to this and other such concerns, i.e. dynamic IP assignments versus dyndns update intervals.)
komali2 2y ago
Odd, I never heard of this. So I might be sharing a public IPv4 address with a neighbor? I run a server out of my bedroom with a TON of services on it. I used to use google domains + DDNS + nginx reverse proxy to manage it, and I still use that for two services that wasn't playing nice with cloudflare (jellyfin + tubearchivist), but now mostly use cloudflare tunnels. For the two services, I just pray my IP address doesn't change. For some reason, it doesn't. But I never new I might be sharing that IP address. I've never had routing issues, does that mean I'm lucky? Is this like, a major security vulnerability I've exposed users (just friends) of my hosted services to? Maybe because I'm in Taiwan our ISPs just operate a lot differently? For example, not a single complaint at terabytes up/down every month.
- nicoburns 2y ago
  If your servers are working fine then chances are you're ISP just isn't using this setup. Some do, some don't.
- yuye 2y ago
  If you've got Chunghwa/HiNet, you most likely don't suffer from CG-NAT. They're the most expensive offer because they're the best offer. If you're with those shitty resellers, you 99% will get CG-NATed. You pay 50% of the CHT price, but you get 25% the quality. You see this in large apartment buildings: They take Chunghwa fiber and resell it, NAT the entire building into the 192.168.0.0/16 block to save on costs, because IPv4 is $$$. Forget about IPv6 support. The bandwidth they have is oversold, so the 400M you bought might not actually reach those speeds during peak hours, unless you're lucky enough to be living in a new building where more than half the apartments are vacant. I have some experience with the latter. Their support staff is often utterly incompetent, too.
  - consp 2y ago
    This sounds like the solution the provider offered when they commercialised my student internet connection. A building with over 1k connections had 4 ipv4 adresses and no proper cgnat. This means you get niceties like: * Everyone gets their neighbors favourite language in the search engine if you have a incognito session. * Only about 32k sessions possible per adres. And yes you can claim them all and kill everyone's internet connection. * All local ip's were interconnected and not firewalled. That was fun. * You get banned or soft throttled everywhere due to "strange behaviour". They were doing it on the cheap and fortunately got told it would void their contract if they did not provide something better and it was "fixed" after about a year. But during rush you would still end up maxing the 4gbit fiber uplink even with only a fast ethernet connection for everyone.
Neil44 2y ago
In these parts that's only a thing on mobile connections.

fragmede 2y ago

Tailscale funnel will let you expose a service to the world without a $5 VPS.

genewitch 2y ago
ipv4 space and bandwidth cost non-zero dollars so I'd ask "who is paying and why?" I'm understand that a significant portion of HN is on fiber or whatever, but not everyone has access to fiber, cable, or even - dare i speak it - DSL. CGNAT was mentioned as being prevalent in the UK and germany almost 6 years ago (for example.) I haven't had a non-cgnat ISP the entire time i've lived in Louisiana, and not for lack of trying. (at&t, t-mobile, at&t fixed wireless (x2!), starlink) I'm not paying >$5/month to solve the problem "but what if i want to self host a public service" to switch to business or whatever, either, that's ridiculous. edit: also i have colo hardware; i write guides for people who either don't or don't know how. cool if tailscale works. wireguard does too...
- fragmede 2y ago
  Tailscale is essentially a free-to-home-users, paid-for-enterprise very usable frontend to Wireguard. They really make it easy. The free service is paid for by the enterprise users.
- Novosell 2y ago
  Tailscale runs over Wireguard. I'm pretty sure they just subsidise their free plan using earnings from their paid plans. Getting a foot in the door and all that. If devs use it at home, they might vouche for it at work.
- vladvasiliu 2y ago
  I also think they mostly provide the connection setup, actual traffic should travel directly between the peers most of the time.
razakel 2y ago
So they're offering a free (presumably limited) ngrok-like service?
PLG88 2y ago
Plenty of alternatives exist - https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling. My issue with Funnel is that it includes no auth, exposing you to anyone in the world. I will advocate for zrok.io as I work on its parent project, OpenZiti. zrok is open source and has a free SaaS (as well as auth and hardening in general).

toast0 2y ago

CGNAT is a scourge, but at least around me, it doesn't seem to be the norm for residential wired internet. 5G yes; starlink, I think so?; geosynchronous satellite, I don't know, but probably. T-Mobile 5G fixed location internet does offer static IPs if you have a SMB account with an EIN, but not for home accounts or SMB with a SSN.

sulandor 2y ago
> CGNAT is a scourge, but at least around me, it doesn't seem to be the norm for residential wired internet. this is highly dependent on your location. most isp's do not have enough v4-adresses for their consumer base.
vladvasiliu 2y ago
> at least around me, it doesn't seem to be the norm for residential wired internet. It used to be rare in France, too, but now it seems to be spreading. AFAIK SFR, one of the major ISPs, doesn't even offer the option (paid or otherwise) to avoid it. Edit: they do provide what looks like a fixed IPv6, though.
- consp 2y ago
  > It used to be rare in France, too, but now it seems to be spreading. AFAIK SFR, one of the major ISPs, doesn't even offer the option (paid or otherwise) to avoid it. They realised they can sell the ipv4 blocks for far more and most consumers don't know any better or care. At least I keep my ipv4 adres if I keep the connection up (dhcp lease time is ignored, it is 4 hours despite dhcp saying 24). Asking for a ipv6 adres is like shouting into the void and waiting for an echo which never comes.
- kolp 2y ago
  SFR will switch you from cgnat to ipv4 if you contact customer support and explain that you work from home and need to open specific ports to access your work servers or VPN. I did just this a month ago. Takes less than 24 hours and you should be OK on ipv4.

altairprime 2y ago

Note for the unfamiliar that ISP (CG) NAT is not at all universal, nor always mandatory when initially present; my past several carriers all issued public IPv4 and public IPv6 /64 or greater that were accessible if I set the appropriate settings. Caveats apply; i.e. the AT&T BGW320 routers seem to cap at 8192 connections even when in bridging mode. Such are the tradeoffs of buying residential rather than business service. (The else-described proxies can be a cost-effective counter to this and other such concerns, i.e. dynamic IP assignments versus dyndns update intervals.)

komali2 2y ago

Odd, I never heard of this. So I might be sharing a public IPv4 address with a neighbor? I run a server out of my bedroom with a TON of services on it. I used to use google domains + DDNS + nginx reverse proxy to manage it, and I still use that for two services that wasn't playing nice with cloudflare (jellyfin + tubearchivist), but now mostly use cloudflare tunnels. For the two services, I just pray my IP address doesn't change. For some reason, it doesn't. But I never new I might be sharing that IP address. I've never had routing issues, does that mean I'm lucky? Is this like, a major security vulnerability I've exposed users (just friends) of my hosted services to? Maybe because I'm in Taiwan our ISPs just operate a lot differently? For example, not a single complaint at terabytes up/down every month.

nicoburns 2y ago
If your servers are working fine then chances are you're ISP just isn't using this setup. Some do, some don't.
yuye 2y ago
If you've got Chunghwa/HiNet, you most likely don't suffer from CG-NAT. They're the most expensive offer because they're the best offer. If you're with those shitty resellers, you 99% will get CG-NATed. You pay 50% of the CHT price, but you get 25% the quality. You see this in large apartment buildings: They take Chunghwa fiber and resell it, NAT the entire building into the 192.168.0.0/16 block to save on costs, because IPv4 is $$$. Forget about IPv6 support. The bandwidth they have is oversold, so the 400M you bought might not actually reach those speeds during peak hours, unless you're lucky enough to be living in a new building where more than half the apartments are vacant. I have some experience with the latter. Their support staff is often utterly incompetent, too.
- consp 2y ago
  This sounds like the solution the provider offered when they commercialised my student internet connection. A building with over 1k connections had 4 ipv4 adresses and no proper cgnat. This means you get niceties like: * Everyone gets their neighbors favourite language in the search engine if you have a incognito session. * Only about 32k sessions possible per adres. And yes you can claim them all and kill everyone's internet connection. * All local ip's were interconnected and not firewalled. That was fun. * You get banned or soft throttled everywhere due to "strange behaviour". They were doing it on the cheap and fortunately got told it would void their contract if they did not provide something better and it was "fixed" after about a year. But during rush you would still end up maxing the 4gbit fiber uplink even with only a fast ethernet connection for everyone.

Neil44 2y ago

In these parts that's only a thing on mobile connections.