Hacker News Reader

Comment by xupybd | Hacker News Reader

It's really crappy that US ISPs block ports. I'm in little New Zealand and have a static IP that allows me to host anything I want.

View on HN

The "port blocking" may just be a symptom of how the modem connects to the internet, rather than being a malicious act by the ISP. CGNAT is becoming a common way for ISPs to connect consumers to the internet, even here in NZ many ISPs use this. It basically puts a bunch of consumers behind the same NAT interface meaning that port-forwarding no longer works.

Even with normal NAT, you have to set up the port-forwarding, and you have to know how to do that.

Also, some routers have a bug¹ whereby even a properly port-forwarded service won't be accessible from within the network. E.g., the port-forwarded service "works", except for you, on your own network. Really frustrating since it means how you connect depends on where you are, and it's a lot of special crap needed to determine "oh, okay, I'm on the home network so use the internal IP"; almost ended up setting up a split-horizon DNS to deal with it².

¹ISPs will tell you that they "lack a feature". Yeah, okay.

²but then we moved and now we have a different monopoly for an ISP.

1) isn't a bug, it is a lack of a feature.

In order to accomplish that you need to double-NAT things because otherwise the internal service will send the reply directly to your computer instead of sending it back to the NAT gateway to reverse the NAT. The router needs to NAT the destination IP for the client and NAT the source IP for the server.

The thing is, 99.9999% of these devices never even have the port forwarding feature touched and an even smaller % of the devices where people enable port forwarding care about this.

> Also, some routers have a bug¹ whereby even a properly port-forwarded service won't be accessible from within the network.

i think the missing feature is called hairpinning[0]

[0] https://en.wikipedia.org/wiki/Hairpinning

He's an Australian, and so am I. His ISP (Optus) doesn't go out their way to block ports.

However, he says he's using a AC800s 4G/LTE modem and backs that up by saying is using mobile data. The default mobile data service from all telco's will use CGNAT and will hand him some 10.0.0.0 address. I presume that's because mobile phones don't run servers as a rule, so no one notices and it saves them a bit of money. They don't deliberately block any particular port, but CGNAT effectively blocks all of them.

He could pay a extra and get mobile data with a static IP Address if he wished. Not from Optus - they discontinued that service (which gives an indication of popular it is), but other virtual carriers based on Optus still offer it. I guess it's not worth the money to him.

Everything supports IPv6 now, and IPv6 happily carries IPv4. Why the telco's are still dicking around with CGNAT and IPv4 is a bit of a mystery.

I seem to recall hearing somewhere on HN that some ISPs even turn CGNAT on for IPv6 connections (in fact, I'm pretty sure AT&T's LTE has it). I have no idea why, other than people being so used to packets not routing to their local box that they've disabled their firewalls.

The people who made that decision probably went to the same school that told network admins to disable IPv6 on VPN connections.

Depending how v4 over v6 implemented. NAT64/DNS64 don't use CGNAT for v4/v4 (but use v4/v6 NAT, may call proxy), but 464XLAT, MAP-E, and DS-lite is still CGNAT. I prefer v4/v4 CGNAT over NAT64/DNS64 for transparency. Some CGNAT allow to forward port (but on limited range).

Author is in rural Australia, but your point is still valid.

My bad. I tend to assume most of what I read here is from the US.

Reply on news.ycombinator.com