Hacker News Reader

Comment by RealityVoid | Hacker News Reader

If I'm reading this right, just the fact you have a static IP does not mean you're not behind a CGNAT. It could be static at the carrier level only, right?

How could I reliably tell if I'm behind a CGNAT or not? If I poll one of those "what is my IP" websites, and the IP my router has assigned from the wan matches the what is my IP then I'm fine, I'm not behind one, right?

And if you can access the services using a dydns kind of thing, then you're safe, you're not behind a CGNAT as well. Only catch where you could be wrong is if you try to access from the same CGNAT network (is this how you call it?) But since the dydns is probably swing your wide internet IP that should still not work?

View on HN

> If I poll one of those "what is my IP" websites

You'll get your public IP, it won't signal whether you are behind CGNAT or not.

Check your WAN, if it's in a private range then you're behind CGNAT, likely going to be 10.0.0.0/8 for most ISP's but all the other private ranges count too. Otherwise it will show a public address that matches your "whats my IP" website.

CGNAT should be using 100.64.0.0/10 per RFC 6598.

> How could I reliably tell if I'm behind a CGNAT or not? If I poll one of those "what is my IP" websites, and the IP my router has assigned from the wan matches the what is my IP then I'm fine, I'm not behind one, right?

My layman understanding is that the WAN IP on your router will match the "what is my ip" website, but the problem is that it will also match many other people's routers.

Basically imagine your home router and NAT has been moved into the ISP and is serving thousands of end users as well as you... you can't just configure the ISP's CGNAT to forward port 80 to you alone.

I'm not sure if there is a definitive way to know if you are behind CGNAT, however its definitely the case on all mobile networks.

> the WAN IP on your router will match the "what is my ip" website, but the problem is that it will also match many other people's routers

That's interesting. So the ISP is directing packets at the various customer routers using some other identifier than the WAN IP the router sees? MAC address or something?

I don't specifically know, but typical NAT can use stateful flow information, i.e. "a UDP packet originated from inside the NAT to external IP/port X, packets from that external IP/port should be routed to the originating NAT/customer" (see https://en.m.wikipedia.org/wiki/UDP_hole_punching)

Some ISPs use MAC address filtering.

HFC (Hybrid Fiber Coaxial) and FttN (Fiber to the Node) are such examples. The rest of them if you don't have a static IP or an internet routable address, use NAT (Network Address Translation) and in some even more exotic environments they use Port Address Translating (PAT), but it's been many years since I've seen PAT in any way at commercial, residential or enterprise setups in ISP space.

But PAT is quite common in the reverse and forward proxy space.

Reply on news.ycombinator.com