Me vs my ISP

So I was looking into getting port forwarding set up and I realized just how closed-off the internet has gotten since the early days. It's concerning. It used to be you would buy your own router and connect it to the internet, and that router would control port-forwarding and what-have-you.

Now, your ISP provides your router, which runs their firmware, which (in my case) doesn't even have the option to enable port forwarding.

It gets worse - because ISPs are choosing NATs over IPv6, so even if you install a custom firmware on your router without it getting blacklisted by your ISP, you still can't expose your server to the internet because the NAT refuses to forward traffic your way. They even devise special NAT schemes like symmetric NAT to thwart hole punching.

Basically this all means that I have to purchase my web hosting separately. Or relay all the traffic through an unnecessary third party, introducing a point of failure.

It's frustrating.

I like to control my stuff. I don't like to depend on other people or be in a position where I have to trust someone not to fuck with my shit. Like, if the only thing outside my apartment that mattered to my website was a DNS record, I'd be really happy with that.

Edit: TIL ISPs in the US don't have NATs

Edit 2: OMG so much advice. My knowledge about computers is SO clearly outdated, I have a lot of things to read up on.

Edit 3: There's definitely a CGNAT involved since the WAN ip in the router config is not the same as the one I get when I use a website that echos my IP address. Far as I can tell ~~my devices don't get unique IPv6 addresses either~~. (funnily enough, if I check my IP address on my phone using roaming data, there's no IPv6 address at all). It's a router/modem combo, at least I think since there's only one device in my apartment (maybe there's a modem managing the whole complex or something?). And it doesn't have a bridge mode, except for OTT. Might try plugging my own router into it, but it feels like a waste of time and money from what I'm seeing. Probably best to just host services over a VPN or smth.

Edit 4: Devices do get unique IPv6 addresses, but it's moot since I can't do anything but ping them. I guess it wouldn't be port forwarding but something else that I would have to do that my router doesn't support

138

138 comments

In the US and I use my own personal modem and router. Renting their equipment is optional.

162
Yes CGNAT is used quite a lot, but consider 95% of customers don't care what their public address is and that "saves" the carrier address space.

We are the 5% that do care and if you call your ISP they likely have an option to exclude you from cgn and get an actual public IP.

94
i repeatedly petitioned our landlord (once a year) to allow an alternative isp to hook up to the building, and he eventually was so pissed from my requests that he threatened to press charges against me personally if the electrical box were ever opened

47
What ISP do you have and what country are you in? I have Comcast in the US and do not have this issue even though they are a big and shitty ISP (I even use their modem, but I do have my own router which I HIGHLY suggest).

47
I bought my own cable modem and router for less than what my ISP would charge to rent them to me. They control nothing on my end.

32
Apologies if you've answered this elsewhere but I'm assuming there's a reason you haven't bought your own router?

30
And this is why I'm unlikely to change isp. I have a /29 ipv4 block and /48 ipv6 block. No extra charge. Grandfathered features from over a decade ago.

23
It gets worse - because ISPs are choosing NATs over IPv6,

Yes, because they're mostly pieces of shit, technically inept and unable to properly deploy IPv6 at a large scale.

Either way IPv6 doesn't fix everything as you'll still need a real IPv4 to access a large part of the internet or some translation (MAP-T/MAP-E). Even if your ISP provided dual stack with a real public IPv6 + CGNAT / MAP-T IPv4 it would still be annoying as you wouldn't be able to do port forwarding on the IPv4 and won't be able to access your self-hosted services from a LOT of networks that are IPv4 only.

There are two versions of MAP – translated (MAP-T) and encapsulated (MAP-E). In MAP-E IPv4 traffic is encapsulated into IPv6 using a v6 header before it is sent over the v6 network. At the network operator’s boundary router, the IPv6 header is then stripped, and the IPv4 traffic is forwarded to the v4 Internet. In MAP-T, the IPv4 packet header is mapped to the IPv6 header and back. The difference between the two options is evident in their names. MAP-E uses IPv6 to encapsulate and de-encapsulate IPv4 traffic, whereas MAP-T uses NAT64 to translate IPv4 to IPv6 and back.

23
Yep, the US reserved most of the ipv4 for them so they have no need for CGNAT, I had to change my ISP to host a terraria server for my friends because of it, but if you don't live in a big city you have no options.

I read that you can say to your ISP that you need port forwarding to use a remote camera system and they will make an exception for you, but I just switched since I even got a better speed deal.

13
I had a fun little issue a while back where my isp replaced our fiber modem to one that didn't allow for port forwarding. The settings were missing but when I set up dmz host on that to allow our equipment to work again, I noticed it was behind some nat in their system. I found out I could call them to get functionality restored for a fee, but instead I plugged in the old box and still keep an external ip with port forwarding enabled and no nat. To be honest the old one has been a lot less stubborn as it doesn't drop every 10th packet on the network. I switched back about 6 months ago, and I've not had any issues, so we'll see when they call demanding me to plug in the new one. Their explanation for switching systems was that their old one wasn't powerful enough for gigabit speeds, even though both have interfaces for gigabit sfp. After some testing, the old one was more capable and stable at those speeds. I assume they wanted to switch systems due to some licensing thing, or to get more money from the .5% of people who care about these features.

11
I'd advice to look into ipv6 tunnels and try to get that working. Abandon ipv4 when your isp refuses to ipv6.

10
You can't get your own router?

7
In my country, the ISP rents you a modem and router. I told them I had my own modem and router during setup and my monthly cost is slightly less than their advertised price.

I am fortunate that my ISP gives me a routable address, but it is still only dynamic and may change a couple times a year. I would have to pay for a commercial plan if I want a static IP. Some other local ISPs use carrier grade NAT, but you can still request a publicly routable static IP with a business plan. Maybe you can ask your ISP for that?

6
This is primarily geographic

6
If you're trying to self-host http service, you can use cloudflare tunnels.

6
In my country we just buy a router and ask the ISP to set the modem/router in bridge mode

6
Standard IPv4 NAT or CGNAT?

Are you using their modem AND router? Or just their modem? If it's a modem router combo, can you place it in bridge/passthrough mode?

Even if it's CGNAT and no bridge mode, their are solutions available.

Are you looking to host private services like NextCloud? Or public services like a website?

5
Cheapest vps plus "sshuttle" may work, host everything on your home server but have dedicated ip of your vps

5
Might not be ideal but perhaps simpler, do you have the ability to upgrade your service to business class? Usually the business tiers allow such things and they will support self hosting and open up the ports for you if you ask. It will likely cost more for the same speed you currently have. Another option to consider

5
why not bridge the router and use your own?

the router doesn't have one?

which ISP is it?

4
Use cloudflare tunnel.

3
It's really shitty. My isp offers a static ip plan but it costs a lot more, so I try using tailscale and it works ok. It's a shame though

3
On the flip side, direct open ports to your home network isn't really a great idea anyway.

At one time it wasn't as bad, but today I'd be hesitant because of the number and capability of bad actors and I'm not a network security expert (though I have a lot of training in networks, just shy of that kind of expertise).

In a way, these restrictions have promoted the use of even more secure approaches, like using Cloudflare tunnels, VPS's with VPN connections to your network, or things like Wireguard/Tailscale, which provide a virtual (encrypted) network layered on top of the public (untrusted) network.

All of these can provide an externally controlled (secured and encrypted) access to specific resources within your own network. As mentioned, VPS with VPN, Cloudflare tunnels, or Tailscale Funnel or Share.

3
Are you trying to offer a port for peer sharing (XDCC/BT)? I've never tried using it like this but I think Tailscale Funnel could work.

It's a sort of reverse VPN, I guess you could call it. Tailscale maintains the public IP and when someone connects to your advertised port they tunnel it to you through (encrypted) WireGuard. It passes through NAT because connections are outgoing to their servers.

The catch is that wireguard is easily detectable through deep packet inspection so if your ISP is a real asshole they can kill the connections, but if they go that far then NAT traversal is the least of your worries.

3
I don’t know what you mean by ISPs in the US don’t have NATs. They most certainly do NAT at the gateway device. But they also typically provide a way to DMZ to your own router instead. I don’t have to deal with double NAT simply because I effectively have my ISP gateway in bridge mode (forwarding all traffic to a specific device, in this case, my personal router).

Note: I have gigabit FTTH from AT&T. I left cable internet the moment fiber service was made available.

2
You can pass through the Internet to your own router on the ISP provided boxes. That's what I do.

2
Permanently Deleted

1
There are plenty of solutions out there like Tailscale, Cloudflared tunnel, Nebula, ZeroTier, etc. Yes, ISPs still prefer IPv4 and impose CGNAT, but it is mostly because IPv6 isn't as ubiquitous as IPv4 and the world long went out of public IPv4 addresses.

Plus where I live I can do with my IPv6 whatever I please.

1
Did you contact your ISP about this? Most of them can adjust a setting for you to remove the NAT part, the feature is usually called dual-stack. If you are in the EU, you even have a fundamental right to use your own router, you just have to register your MAC with them.

1
Can't switch ISPs? I'd tell them exactly why I'm switching.

1
Here in Germany I get a "real" (non-shared) IPv4 address and a /48 IPv6 subnet I think. With Telekom at least. Vodafone is another story. I think the user must be able to use their own router because of some EU law.

1
Is your service fiber? Is your router a combined ONT and router? If its not and you have an ONT serving ethernet to the router, you can just plug your own router in.

You said it's through china mobile so is it a cell modem/router?

0
Lolol bro is screaming and riling the troops over his insane ISP using NAT lol

-4
What do you need to do, why do you need a public IP?

-5

You've viewed 138 comments.