Give up cause it's totally CGNAT! (jk) reddit / selfhosted ---------------------------------------------------------------------- spazonator · 2023-10-10 13:26 \[figured this belonged as it's own post instead of a comment\] I cringe when people offer up CGNAT as the probable answer. Mini ramble: \-If you live in North America or Europe and use a wireline internet service, than you most likely are assigned a publicly routable IP. (CGNAT is certainly more prevalent elsewhere though) \-Just call it NAT. CGNAT is a specific implementation of NAT. Not all NAT implementations are CG but all CGNATs are NATs. Unless you're an engineer familiar with that specific ISP network's makeup, just reference the concept of Network Address Translation. \-Just don't act definitive. Most of us here are technically inclined in one way or another, be realistic and offer NAT up as a possibility not a "Oh the IPv4 addresses are exhausted so no more IPv4 for anyone" like.... that's a load crap. Do the countries that were the first and widest adopters of the internet have more addresses? Si. Could that make it more difficult to attain an IP in certain regions? Totally. But don't run with assumptions and fun talking points.. This isn't Fox news. I have a buddy working in the carrier space and they recently purchased a /24. I'm well aware that doesn't translate so well to residential connections but that's no reason to propagate a false narrative. I'm just as eager for IPv6 adoption and just an frustrated with the pace of it as any systems engineer can be. But dammit... again I just cringe when I see soo many definitive sounding answers.. "Oh, it's CGNAT. You're fucked. Blame the man." Makes me wonder how many of those whom are less technically inclined have been led down rabbit holes when a fix may've been much simpler. Not trying to rage here and wouldn't put this over at [r/HomeNetworking](https://www.reddit.com/r/HomeNetworking/) but this is [r/selfhosted](https://www.reddit.com/r/selfhosted/). Let's be a little more discerning over here, everyone. I know I know... It's Reddit but yeah... Thanks for reading. ---------------------------------------------------------------------- AnnualOasis · 2023-10-10 13:33 (1) Most people don’t know if they’re on CG-NAT or a publicly routable IP. It makes sense to ask to rule it out so time isn’t wasted troubleshooting something that won’t make a difference. (2) CG-NAT, because it’s a specific implementation, is more specific than simply “NAT” and helps clarify more specifically what we’re talking about. This is important always, but is especially crucial in a text-only public forum like Reddit. (3) I have no idea what this is supposed to mean. ---------------------------------------------------------------------- hdddanbrown · 2023-10-10 13:36 *Sir, this is a Wendys!* ---------------------------------------------------------------------- clintkev251 · 2023-10-10 13:48 >Just call it NAT. CGNAT is a specific implementation of NAT. Not all NAT implementations are CG but all CGNATs are NATs. Strongly disagree. If I'm trying to help someone on Reddit, I'm going to use terminology that's easy to google. If I just say NAT when I really suspect CGNAT, that's not going to be a very helpful google search result where it tells them to forward ports etc. where that may not be possible. CGNAT is the term that will most quickly lead to the solution if they are in fact double natted by their ISP (which is also easy to confirm, and obviously we should be providing instructions on how to confirm) ---------------------------------------------------------------------- thekrautboy · 2023-10-10 14:07 Is the WAN IP in the block of `100.64.0.0/10`? Run `curl ifconfig.co` If yes, then its CGNAT. ---------------------------------------------------------------------- RedFive1976 · 2023-10-10 14:09 > "Oh the IPv4 addresses are exhausted so no more IPv4 for anyone" like.... that's a load crap. Sorta right, and sorta wrong. Wrong, in the sense that yes, all of the IPv4 addresses have been exhausted, and there are no more -- for ISPs to acquire. On the other hand, right in that the ISPs still have a lot of IPv4 addresses that they can give out. > Just call it NAT. CGNAT is a specific implementation of NAT. Not all NAT implementations are CG but all CGNATs are NATs. I would argue that "CGNAT" is being used in many contexts not to say that CGNAT is literally being used, but to indicate that it's *some* form of NAT being used at the ISP level, and there's little that an individual user can do to get around that without tricks like reverse proxies or buying a static IP. So you're right in that "CGNAT" is probably being over-used and that the individual may not be behind a literal instance of CGNAT, but the term is being used as a shortcut (like calling all facial tissue Kleenex, cotton swabs Q-Tips, or self- adhesive bandages BandAids; the brand becomes the generic term) and is therefore still valid, if imprecise. ---------------------------------------------------------------------- coltrain423 · 2023-10-10 14:23 CGNAT is being used as a stand-in for double-NAT. Home network behind both home router NAT and ISP NAT. Simply saying “NAT” loses that meaning. You’re right, I just wanted to rephrase to emphasize the double-nat part more. ---------------------------------------------------------------------- GrumpyCat79 · 2023-10-10 14:29 The result of `curl ifconfig.co` should always return a publicly routable IP and not necessarily your WAN IP ---------------------------------------------------------------------- spazonator · 2023-10-10 14:45 Ya'll don't have a dresscode here do ya? Caaauuussse this is happenin'. Could I get a frosty while I'm here? ---------------------------------------------------------------------- lilolalu · 2023-10-10 14:47 I don't understand the rant, a cgnat is a nat, but a very specific one and thus needs very specific solutions. Mainly because the network level and routes it is applied at are not under our control. Since this subreddits is about selfhosting and shit, that complicates things. Unlike your own nat at home. So chill OP. ---------------------------------------------------------------------- lilolalu · 2023-10-10 14:49 That's not too hard to figure out though http://ip.bieringer.net/cgn-test.html ---------------------------------------------------------------------- spazonator · 2023-10-10 14:50 Ok, that's a good point. I was on a bit of a roll while getting my nuts some fresh air and the CGNAT vs NAT is admittedly a nitpicky minor eye twitch for me. I appreciate this point of view. ---------------------------------------------------------------------- AnnualOasis · 2023-10-10 14:57 I didn’t say it was. ---------------------------------------------------------------------- spazonator · 2023-10-10 15:17 Forsure. Tylonol or Acetaminophen. Someone else made the great point that from a user googling it up, CGNAT helps distinguish between their end or carrier end. The exhaustion point: I say a "load of crap" to the insinuation that the IP address market is dried up and CGNAT is a response to this. Here to as with my "load of crap" over simplification that's not entirely true. Is NATing used to fit more devices within the \~4billion address limitation? Totally. Often though you've got some hobbyists here who phrase their response in such a way that someone none-the-wiser would take away that any new ISP out there is gonna put you behind a NAT because IP space is exhausted. That's specifically what I say phooey to. I mean there's even a couple on here that don't seem to quite get what I'm all about. And like... I do this professionally so I'm not trying to be **too** much here as I understand this is more of a hobbyist forum... I just feel I see CGNAT used as some of the first responses to many posts. It has that feeling of a standard response that is a kneejerk, comfortable answer to give. Within the context of many posts I've lurked on, CGNAT wouldn't be the first thing I'd go into. In some cases from the getgo CGNAT was offered as an possible explanation when in no way did the OP give evidence that would lead an experienced person to say so. It just has the feel of a poorly educated answer you'd expect from teens working at a local computer shop. I'm all aired out and fresh though. Grazie everyone. I do appreciate most of the responses on here. ---------------------------------------------------------------------- spazonator · 2023-10-10 15:19 Thanks. It's a morning where I just woke up all "why you doin' this??" ---------------------------------------------------------------------- certuna · 2023-10-10 15:20 CG-NAT in the general vernacular is equivalent to “NAT you do not control yourself”. Whether NAT happens at your provider or at the router of the apartment building you don’t have admin rights to, the result is the same. If you live in the US or Europe, you’re more likely than not to have IPv6, so neither NAT nor CG-NAT is an issue anymore, but we’re not at 100% yet and it’s still annoying if your ISP is one of the holdouts. So people vent and get annoyed, it’s the internet. ---------------------------------------------------------------------- spazonator · 2023-10-10 15:40 Ahhhhhh I should sign out. But, insinuations like this about the probability of already having an IPv6 address. This is an example of the catalyst that lead me to posting this. They're certainly out there and in use amongst the average public but "more likely than not"? And that IPv6 rollout has squelched use of CGNAT, why do you say that? ---------------------------------------------------------------------- certuna · 2023-10-10 15:45 In US+Europe, IPv6 coverage for consumers is over 50% now so yes most have it. But that also still means that almost 50% don’t have it, so it’s definitely not all happy days for everyone. Once you have IPv6, it doesn’t really matter if your IPv4 is behind CG-NAT or not. ---------------------------------------------------------------------- PaulEngineer-89 · 2023-10-10 16:53 I absolutely disagree about IPv4 space. Sure it’s hoarded and wasted. But just looking at my own situation I have at least my family’s cell phones (4 devices) plus the home router (1 device) which aren’t always in one place so that’s 5 IP addresses. Between home and phone and businesses I’ll bet most people in the US would average 3 IP addresses each on average or about a billion IPs if they were uniformly distributed. If we extend this to the roughly 7 billion people on the planet that’s 14 billion IPs. There are only 4 billion IPv4 IPs so it was inevitable that we would run out. IPv4 was a good idea back when there were perhaps a few million devices. As far as NAT goes it’s one thing if your router is assigned a temporary IP. The complication is various reasons why you can’t map an incoming packet to the intended destination because of local setup issues, the so-called double NAT problem. It is easy to deal with though with DDNS. If you can contact a known IP on the internet it can detect your home IP and then by updating a dynamic DNS or any other way to register to a database subsequently you can service local traffic The next step down is CGNAT…NAT at the ISP level not just for your entire router but port by port. This makes it impossible to use unmodified software that expects to offer a service because your can’t just locate your IP and then map services with a DDNS. The STUN method makes it possible to map ports but requires extra software support, or tunneling. Tailscale and many gaming software and Torrent packages use STUN. Fortunately the workload for a server is only slightly more than DDNS. Tunneling can still be used for arbitrary protocols but direct peer to peer tunnels can be used. The ultimate “NAT” would be where ports are assigned by IP/port pairs. This disables STUN because connections can only be made by active involvement of a third party 100% of the time with a tunnel in one host or both if both are NATted both ways. Fortunately this condition is relatively rare. ---------------------------------------------------------------------- lucky_my_ass · 2023-10-10 17:04 In so many countries, most consumer ISPs offer only CGNAT, Atleast for ipv4. And everyone knows that exclusively ipv6 isn't a real solution. I'm baffled when people think only in terms of "America" in these subs. You know there's an existent world out there right? ---------------------------------------------------------------------- Jdibs77 · 2023-10-10 17:36 I do not dispute any of the technical definitions here, and understand them. But colloquially, when I hear "CGNAT" and "Double-NAT", I think of two different things. To me, "CGNAT" implies that it's ISP-level NAT, and there's nothing the end user can do about it. When I hear "Double-NAT", I think of the end user installing a router (that is performing L3 routing functions) behind the ISP's provided modem/router, which is also routing and doing NAT. In the latter case, the end user could generally resolve it by either sticking with the ISP router, or putting the ISP router into "bridge mode", "IP Passthrough mode" or whatever their name for it is. This could all just be my personal experiences though ---------------------------------------------------------------------- thekrautboy · 2023-10-10 17:47 Hmm interesting, thanks for letting me know! ---------------------------------------------------------------------- coltrain423 · 2023-10-10 17:51 That’s what I meant: CGNAT is a stand-in for ISP-imposed double-NAT. When I hear Double-NAT, I think the same as you described. When I hear CGNAT, I think ISP-based Double-NAT. I don’t care if it’s specifically Carrier Grade NAT or basic NAT, I just understand it as the ISP translating your network address before your home router does the same again. ---------------------------------------------------------------------- angelflames1337 · 2023-10-10 17:54 Yup my country is one of them. ---------------------------------------------------------------------- GrumpyCat79 · 2023-10-10 18:11 I prefer to share the information instead of downvoting someone that tried to help! We have a really helpfull community and we try to help even if we don't have all answers or all the knowledge, but it's done with good will so it's not worth a downvote, it's worth sharing our knowledge :) ---------------------------------------------------------------------- thekrautboy · 2023-10-10 18:17 I dont mind downvotes and i accept when i make a mistake, so i dont run off and delete my comments instead i edit them to clearly show i was wrong. ---------------------------------------------------------------------- spazonator · 2023-10-10 18:44 So if 50% of the population have it, that means 50% don't? I can see clearly now. (I'm just razzin' you) I'm not gonna argue statistics on reddit cause I'm sure we both know that can get hairy quick. I also can't speak for Europe other than what I'd find on the googles. I can tell you though that in the US the only major adopters rolling out both stacks have been the cell companies. Niche ISPs will also openly deploy IPv6 but the dirty little secret here is that even though the IPv6 stack has been rolled out across IP exchanges, headends and circuits... the majority of endpoints are not bound to any IPv6 addresses. Why? Combination of reasons... ISPs don't want to be the guy to tell their customers using their own routers that they've gotta upgrade their equipment and the fact that for a population of 350mil (?) the US ASNs account for over one billion of the registered IPv4 addresses out there. I'm not gonna speak for Europe but from first had experience spanning multiple ASNs I can tell you that in the US most ISP infrastructures are capable (most network cores have been for the last decade) but the statement "you're more likely than not to have IPv6" is a misnomer at best and invalidates "so neither NAT nor CG-NAT is an issue anymore". CGNat isn't an issue because the ARIN and RIPE are sitting on over 50% of the available IPv4 addresses. CGNAT in these regions is typically only used in WISPs and cell carriers. Rolling out the stack, any company can do. Using it is a whole other thing. OpEX budgets would be crucified by the increase in call center man hours for a couple quarters or more. No one in the rich world is racing to roll this out. It looks good to put out a statement saying your infrastructure is ready for it but in practice that doesn't mean a whole lot and frankly much of the infrastructure has been for years. I wouldn't equate that to having IPv6. I guess technically you can call it IPv6 "coverage" but if the endpoints aren't using it that's kind of a hollow statement. ---------------------------------------------------------------------- agent_kater · 2023-10-10 20:53 I'm not sure what you want to tell us. That people should plan their home labs under the assumption that they will have a public IPv4 address indefinitely and just continue with crappy dyndns instead of setting up proper IPv6 and reverse proxies? ---------------------------------------------------------------------- agent_kater · 2023-10-10 20:55 I went exclusively IPv6 for almost everything. My home network, my internet connection, my servers. For the rare case I need IPv4 connectivity (looking at you Docker Hub) I use https://nat64.net/. ---------------------------------------------------------------------- GrumpyCat79 · 2023-10-10 21:17 It's fine to do mistakes, I just find it sad when everyone just downvote without saying a thing xD ---------------------------------------------------------------------- thekrautboy · 2023-10-10 21:30 True. But thats just reddit, i got used to that after so many years. Its not how it supposed to be done, but people are people. ---------------------------------------------------------------------- Beautiful_Facet · 2023-10-10 21:35 I still don't get why anyone wants/deploys IPv6. It's not the right path and we could have put all that work towards something a lot better. The government wants IPv6. Not the people. ---------------------------------------------------------------------- Beautiful_Facet · 2023-10-10 21:37 Why? What purpose, other than self-education, does going IPv6 serve you? It's terrible to work with and doesn't obey routing rules a lot. It's doubly awful for home usage. ---------------------------------------------------------------------- certuna · 2023-10-10 21:46 That’s not the case anymore. You don’t have to take my word, you can see for yourself which ISPs have IPv6: https://stats.labs.apnic.net/ipv6/US (similar lists for various European countries). Bear in mind that these stats are undercounting: even if a network has 100% IPv6, you’ll never see 100% usage in these stats since a significant percentage of users isn’t using IPv6 (old routers, misconfigured networks or clients, etc) - Google Fiber is a good example of that. But all these users can use IPv6 if they want to. In some countries the mobile operators are leading, in other countries the wireline ISPs are ahead. ---------------------------------------------------------------------- AmateursPls · 2023-10-11 02:30 You're very wrong, but look like you had fun ranting away so all the power to you. ---------------------------------------------------------------------- ShleemThePlumbus · 2023-10-11 04:52 This \^. People should just say double-nat because they almost always mean double-nat. ---------------------------------------------------------------------- abjedhowiz · 2023-10-11 05:31 Yup ---------------------------------------------------------------------- Kazer67 · 2023-10-11 06:42 Well, it's true there's no more IPv4 PUBLICLY available in Europe, since years now (end of 2018 if I recall?), all because a shitload of company / ISP have very big and unused range they needlessly keet (or use as an investment to resell them for a profit in the grey market). So yeah, a lot of unused address and those who could have use for those can't get them (or at an outrageous price). It's bad enough that some newer ISP actually do split IPv4 (instead of doing CGNAT), meaning they give the same IPv4 to 4 different customers with each 1/4 of the port (which was actually a perk for piracy in my country until recently when they fixed the law). ---------------------------------------------------------------------- coltrain423 · 2023-10-11 11:42 Really? The context that it’s ISP-side and not local (2 routers at home, a question I see posted often) isn’t relevant? Nah, use CGNAT. ---------------------------------------------------------------------- EinIntegrator · 2023-10-12 00:06 Curious what your stack looks like. I have yet to see a residential or commercial buildout that’s mostly ipv6. Hell even at the hosting level most hosting providers still run exclusively ipv4 as their supported tech ---------------------------------------------------------------------- agent_kater · 2023-10-12 11:47 It looks the same as with IPv4, just with IPv6. I get some "support" by the ISPs. My home ISP only gives me an IPv6 address and a tunnel server (AFTR) for IPv4 (RFC 6333, DS Lite). And when I order VPSs I just don't order an IPv4 which often (with SSLNodes for example) even saves some cost. I then just set the NAT64 mentioned above as DNS servers. I then just use IPv6 addresses in cinfig files (like reverse proxies) instead of IPv4 addresses. Occasionally I have to update a tool to support IPv6, for exactly the rinetd that comes with Ubuntu. For a couple of services that I absolutely need access even when I use a public Wifi without IPv6 support I have a single host with a reverse proxy that listens on an IPv4 address.