Me vs my ISP

So I was looking into getting port forwarding set up and I realized just how closed-off the internet has gotten since the early days. It’s concerning. It used to be you would buy your own router and connect it to the internet, and that router would control port-forwarding and what-have-you.

Now, your ISP provides your router, which runs their firmware, which (in my case) doesn’t even have the option to enable port forwarding.

It gets worse - because ISPs are choosing NATs over IPv6, so even if you install a custom firmware on your router without it getting blacklisted by your ISP, you still can’t expose your server to the internet because the NAT refuses to forward traffic your way. They even devise special NAT schemes like symmetric NAT to thwart hole punching.

Basically this all means that I have to purchase my web hosting separately. Or relay all the traffic through an unnecessary third party, introducing a point of failure.

It’s frustrating.

I like to control my stuff. I don’t like to depend on other people or be in a position where I have to trust someone not to fuck with my shit. Like, if the only thing outside my apartment that mattered to my website was a DNS record, I’d be really happy with that.

Edit: TIL ISPs in the US don’t have NATs

Edit 2: OMG so much advice. My knowledge about computers is SO clearly outdated, I have a lot of things to read up on.

Edit 3: There’s definitely a CGNAT involved since the WAN ip in the router config is not the same as the one I get when I use a website that echos my IP address. Far as I can tell my devices don’t get unique IPv6 addresses either. (funnily enough, if I check my IP address on my phone using roaming data, there’s no IPv6 address at all). It’s a router/modem combo, at least I think since there’s only one device in my apartment (maybe there’s a modem managing the whole complex or something?). And it doesn’t have a bridge mode, except for OTT. Might try plugging my own router into it, but it feels like a waste of time and money from what I’m seeing. Probably best to just host services over a VPN or smth.

Edit 4: Devices do get unique IPv6 addresses, but it’s moot since I can’t do anything but ping them. I guess it wouldn’t be port forwarding but something else that I would have to do that my router doesn’t support

Rognaut,

In the US and I use my own personal modem and router. Renting their equipment is optional.

NateNate60,

Same here. I get $10 off for using my own router. That’s $120 off per year. A cheap router bought from a supermarket cost me $60. It works fine, the signal quality is only okay but my flat’s pretty small anyway. Getting your own router is just a financially sensible option.

BloodSlut,

buying my own upper-midrange router still cost me less than renting from the ISP over a three year period

TunaLobster,

Not really with ATT fiber anymore. The fiber goes straight into their router to authenticate. There is no option for me to purchase an equivalent piece of equipment. I am forced to pay to use their equipment. Fuck ATT.

nevalem,

You can totally bypass ATT Fiber now with your own SFP+ xgs-pon, fiber terminated to your device, without needing to exfil certs or do anything other than clone the identifying info of the att router’s label depending on the technology they’re using in your area.

docs.google.com/document/d/…/edit#heading=h.f8l0u…

Appoxo,
@Appoxo@lemmy.dbzer0.com avatar

Love that random google docs link instead of something like a tech blog.
Only a pastebin link could make it better.

nevalem, (edited )

I think the originator of it was on dslreports but I couldn’t find the link on mobile. I’m sure if you can search on Google you could find a secondary source for some tech blog or medium about it if that makes you feel better. There’s also a discord that covers most xgs-pon bypass methods that I could share too. They keep turning it to private at times for whatever reason.

Other links and info of you are being serious and not passive aggressive. ATT is quick with DMCA takedowns so that’s probably why the info can be fleetingly available at times but dslreports seems to be pretty reliable/resistant to them.

dslreports.com/…/r33665048-AT-T-Fiber-XGS-PON-SFP…

hackaday.io/…/193110-bypassing-the-bgw-320-using-…

forum.netgate.com/topic/99190/…/440

simeononsecurity.com/…/bypassing-the-bgw320-att-f…

Appoxo,
@Appoxo@lemmy.dbzer0.com avatar

Other links and info of you are being serious and not passive aggressive

Thjs was just meant as a lighthearted joke. It’s all fine :)

aStonedSanta,

So I did something before and had to set it back up every week or so. Would this be a permanent solution? If so ima fuck around heavy with this today lol

nevalem,

Yeah the previous bypass used a certificate that you’d have to authenticate periodically via 802.1x. This new method does not have that requirement. Just need the specialized hardware for it, like that Azores d20 box or one of the SFP+ xgs-pon modules that you can program.

I’ve been using it without any intervention for a little over a 8 months now. Even have my /29 static IP block allocated on it, while still being able to also use the DHCP address they give out. You get to use the whole /29 too without the att box stealing one of them as well.

Enk1,

Nice, I’ll have to try this soon. Last time I checked the process was way more complicated.

WarmApplePieShrek,

Check if it has a passthru or bridge mode

dsemy,

Can you recommend a good router that isn’t extremely expensive?

I did some research about a year ago and started using a router recommended by both random users and reviewers (TP-Link Archer AX-3000 I think) only to quickly find out it had a bad QoS implementation which broke applications sending IP packets with certain DSCP values (SSH by default, Mumble, VoWiFi on an iPhone, WhatsApp calls) so I switched back to an ISP provided router unfortunately. When I talked to TP-Link support they sent me firmware which would have allowed them to connect to my router using telent (absolutely insane IMO, especially since other users also complained about this issue).

Further research showed that many consumer-level routers have these kinds of issues, so I’m reluctant to try this again.

aniki,

Roll your own

BobGnarley,

Not for Spectrum it isnt, unfortunately. You can use your own router but you have to use their modem

slazer2au,

Yes CGNAT is used quite a lot, but consider 95% of customers don’t care what their public address is and that “saves” the carrier address space.

We are the 5% that do care and if you call your ISP they likely have an option to exclude you from cgn and get an actual public IP.

Rambomst,

This. I have been with multiple ISPs that use CGNAT and all had a solution to allow you to self host, just need to contact them.

theblueredditrefugee,

Yeah, it’s looking like I have to make a phone call. Rough time, there’s a language barrier

Aradia,
@Aradia@lemmy.ml avatar

I am into tech/programming/devops, I make my own servers, but I would still prefer to be under CGNAT as I feel more safe. I wouldn’t open any port or tunnel to my local home network, I wouldn’t feel that safe. So for me, a CGNAT is perfect.

MigratingtoLemmy,

Yup. I’ll open a port in a cheap VPS and tunnel my traffic over that rather than directly open ports on my router. If people here can trust Cloudflare they can use their tunnels too

Aradia,
@Aradia@lemmy.ml avatar

Yeah, I would do that before exposing my router to public and opening ports, but for the tunnel I would use something like WireGuard into a virtual network at my home just to improve security. I’m not a fan of Cloudflare.

MigratingtoLemmy,

Whatever works. I prefer OpenVPN/Softether for their SSL VPN implementations, and am too lazy to be arsed to deal with stunnel and Wireguard. But if you’re not as paranoid then Wireguard works perfectly fine

FMT99,

I have ports open (to receive backups from my other servers) but only to connections from specific ip addresses and only port 22 using a pub key (no password) I’d be hesitant to open port 80 to the public though.

Then again I’ve run a small public web server for well over a decade and never had any issues with hackers.

Aradia, (edited )
@Aradia@lemmy.ml avatar

I’ve run a small public web server for well over a decade and never had any issues with hackers.

It’s never late to get hacked or an attack or a problem with your ISP router firmware. I don’t think that’s an excuse.

receive backups from my other servers

You can simply do cronjob and scp user@server:/path/to/backup . to get things from server to your local network, I don’t see the need to expose your router to the public. For a web server, there are cheap VPS providers for less than 5 dollars a month, and you save up energy, hardware, and improve safety at home.

lud,

Why use your ISPs router then? Just buy your own.

And a webserver is probably the safest thing to put online.

You can also put the server in a DMZ and or use reverse proxy’s and a bunch of other stuff.

Aradia,
@Aradia@lemmy.ml avatar

I already have my own router, even if a web server is safer, you are still exposing your IP which is what I don’t want to do. DMZ doesn’t solve anything, is just worse than setting up a port forward as you are opening all the ports to the server at home, your server at home has access to all your network so once infected by any 0-day exploit, you are fucked up.

I just hire online servers and I have my own Ansible playbooks to manage those servers, this way I don’t provide my real IP (my home) to anyone.

slazer2au,

And there is nothing wrong with that. Both systems work for different people. I am on the I like a public address on my place camp, but I have worked where we did cgn for an apartment building and out of the 150 residences none asked for a public address. Saving us a /25 which we could sell to business customers for $5/m per /29

CriticalMiss,

This is a friendly reminder that NAT is not a firewall and should not be treated as such.

Thank you.

Aradia,
@Aradia@lemmy.ml avatar

Why are you saying that? I know it’s not a firewall, I’m just saying it doesn’t expose your router directly to internet, most of the routers also have firewall, and you can DMZ or port forward that you normally turn them on once you expose your router to public so bots or people can make direct requests to your router.

kawa,
@kawa@reddeet.com avatar

In France, with Free, you can get a real “full stack” IPv4 for free which is cool, I even cancelled my NO-IP subscription.

mateomaui,

I bought my own cable modem and router for less than what my ISP would charge to rent them to me. They control nothing on my end.

glitch1985, (edited )

deleted_by_author

    •
    mateomaui, (edited )

    I can do whatever I need to.

    edit: if it wasn’t clear, I didn’t buy them from my ISP, so my ISP had nothing to do with the firmware on it.

    herrvogel,

    ? How would that even work? Does openwrt have a feature where it can hack into the ISP’s infrastructure and modify their QoS settings?

    ccdfa,

    That’s not what modems or routers do. Your ISP sets your speed somewhere else, not at the modem/router level.

    Rodneyck,

    Same, never use their equipment if possible, cheaper and you are in control.

    BlackSkinnedJew,

    What do you need to do, why do you need a public IP?

    theblueredditrefugee, (edited )

    Well, I don’t need it, not really. It’s just I’m finally in a position where I’m not stressed about things like rent and healthcare, and I’m realizing I wanna fuck around with hosting my own websites. Possibly a lemmy instance, I was toying with the idea of developing a P2P social networking protocol that federates with lemmy. But also the idea of building my own websites so I’m not dependent on others for my income, or just making it easier for people to download stuff that I’m the only seeder of.

    Definitely not a need. My rent is paid, my food is healthy, healthcare is cheap. So now I can worry about stuff like this that ultimately doesn’t matter

    WarmApplePieShrek,

    You can rent a server in a data center. Hetzner is pretty good… unless it thinks you’re a “risky customer” and bans you.

    gornius,

    If you’re trying to self-host http service, you can use cloudflare tunnels.

    theblueredditrefugee, (edited )

    I’ve thought about using AWS for hobbyist web applications, but I worry about difficult-to-predict costs

    That said, after a cursory glance, HOLY SHIT IT’S FREE

    Obviously still not a great solution if DMCA is a concern

    Chreutz,

    Hetzner is affordable and way more transparent than AWS, btw

    gornius,

    If you’re lucky enough to successfully create an account on Oracle Cloud, you can also try Oracle Cloud Free Tier. You can have free ARM64 x4 CPU and 24 GiB RAM totally free of charge. There might be problems with availability during VM registration, but there are scripts that automate spamming for checking every 80 seconds.

    I’ve been using it for 2 years and it’s great. However be aware that your VM might get erased if you have a free account. That too can be remedied if you update to a premium subscription (You still get Free Tier resources without a charge). Nobody has reported an erased VM on a premium plan yet.

    Still, I am pretty sure they can erase it if you do illegal stuff with it. I’ve been using it only to host Minecraft Server, as well as other services using Docker. So far so good.

    UnRelatedBurner,

    wait, all I got from this is Oracle gives out free 24GiB 4core VPSs? Free cake and I can eat it too? Please fill me in on more details, or links

    gornius, (edited )

    www.oracle.com/cloud/free/

    There are tutorials on youtube on how to create a VM and set up a firewall for external access.

    UnRelatedBurner,

    Where’s the catch? Seems to good to be true? On that power I can host everything I ever wanted and more

    unclemac59,

    docs.oracle.com/…/freetier_topic-Always_Free_Reso…

    Reclamation of vms as others have mentioned and the service limitations as to what qualifies for the free tier are really the only catch, but not a problem if you’re willing to give them your credit card info for a paygo acct. More details are in this link to the docs. It’s honestly a really good deal and I find it way more transparent and easier to use than AWS.

    UnRelatedBurner, (edited )

    I give them an empty online card, and install some random bloatware so it uses cpu and ram. Now I have a server for free forever? How do they profit from this, it’s hard to believe that it’s truly free?

    theblueredditrefugee,

    Awesome, thanks for the trick!

    sparky,
    @sparky@lemmy.federate.cc avatar

    Cloudflare tunnels are definitely the way, letting you expose a service to the open internet regardless of what your ISP thinks. I’m not sure how they would handle DMCA complaints but given they are just a DNS provider, I’m not sure they would do much given it’s the server owner’s responsibility for the content. Which in this case is you.

    WarmApplePieShrek,

    Tunnelling isn’t a DNS provider

    evranch,

    For free tier, Google Cloud is more transparent about what you get than AWS IMO.

    The only catch is to make sure your persistent disk is “standard” to make it totally free as it defaults to SSD.

    However if you do mess up the disk you’ll still only be paying $1-2/mo. Been using GC for years, and recently they finally started offering dual stack so you can do your own 6to4 tunneling or translation if you want, depends on your usage case.

    AirVPN also are legit and will let you forward ports to expose your local services if you’re worried about DMCA type issues.

    I finally got IPv6 here through Starlink, it’s nice to have full access to the internet again after a decade behind CGNAT

    bayank,

    Might not be ideal but perhaps simpler, do you have the ability to upgrade your service to business class? Usually the business tiers allow such things and they will support self hosting and open up the ports for you if you ask. It will likely cost more for the same speed you currently have. Another option to consider

    BradleyUffner,

    Just a bit of a warning if you do this. Business class service usually requires full year contacts, and breaking the contract can mean THOUSANDS of dollars in termination fees depending on the timing.

    WarmApplePieShrek,

    Asking is free

    r00ty,
    @r00ty@kbin.life avatar

    And this is why I'm unlikely to change isp. I have a /29 ipv4 block and /48 ipv6 block. No extra charge. Grandfathered features from over a decade ago.

    theblueredditrefugee,

    HOLY SHIT YOU HAVE A /29 IPV4 BLOCK???

    That’s like having a change jar with copper pennies or something, nice

    r00ty,
    @r00ty@kbin.life avatar

    Yep. The ISP doesn't offer it any more. They stopped, I think when RIPE officially "ran out" of new net blocks. But I've moved address twice so far and have kept the allocation. Well, on the last move they messed up and gave new a new single IP. I complained, and they asked why it matters so much to have my old IP. I pointed out I had a netblock, and they fixed it up pretty quickly.

    Pretty soon, full fibre will be in my area and available on the same ISP. So, hoping for a smooth transition to keep it for a bit longer.

    WarmApplePieShrek, (edited )

    How does it feel hoarding IPs from 7 other people who want one?

    atkion,

    That’s fucking awesome.

    Shinji_Ikari,
    @Shinji_Ikari@hexbear.net avatar

    Is your service fiber? Is your router a combined ONT and router? If its not and you have an ONT serving ethernet to the router, you can just plug your own router in.

    You said it’s through china mobile so is it a cell modem/router?

    theblueredditrefugee,

    Just checked, it looks like it’s fiber. Definitely has something plugged into the wall anyway - I’m kinda afraid of unplugging it and ruining my internet access.

    Shinji_Ikari,
    @Shinji_Ikari@hexbear.net avatar

    Idk how it works in china, is the wire coming from the wall a thin sorta stiff wire? or is it a thicker wire(5-10mm across) that is bendy?

    If the latter, you can just plug that ethernet cable into your own router.

    If its a fiber cable then I dont know if you can have your own ONT.

    bruhduh,
    @bruhduh@lemmy.world avatar

    Cheapest vps plus “sshuttle” may work, host everything on your home server but have dedicated ip of your vps

    WindowsEnjoyer,

    First time hearing about sshuttle, thanks! What I did some time ago is to order small VPS in Linode, hosted wireguard server and let my router connect to it. Since connection is established - I’ve port-forwarded all ports (except 22) from VPS to my router via established wireguard connection.

    Then all I have to do is to manage port forwarding on my router, but if I want to connect to my router from outside - I must use VPS IP.

    Worked great, except the fact that I used to have mobile internet and as a rule of thumb - upload speed of mobile internet suck ass…

    bruhduh,
    @bruhduh@lemmy.world avatar

    Check this out github.com/MHSanaei/3x-ui

    heyitsmikey128,

    What ISP do you have and what country are you in? I have Comcast in the US and do not have this issue even though they are a big and shitty ISP (I even use their modem, but I do have my own router which I HIGHLY suggest).

    redcalcium,

    The US and other western countries don’t really feel the pressure of IPv4 scarcity yet. ISPs in other countries typically uses CGNAT or IPv6. Some even give you a routable IPv4 but may randomly replaced it with an ip behind their CGNAT when the lease is expired, giving you false sense of hope.

    NateNate60,

    IPv4 address depletion isn’t really the ISP’s fault. It’s a shitty solution to a shitty situation, to be sure, but it’s either that or employing rationing strategies to stretch the remaining supply of IPv4 addresses.

    theblueredditrefugee,

    Or just use IPv6…

    Chreutz,

    Many ISPs in Denmark actually charge you 30-40 DKK (4-7 USD) extra for the ‘luxury’ of IPv6, which is the same that they charge for publicly routable IPv4 (of course). I found that quite infuriating, so I searched around and found one that had public IPv4 and IPv6 included in the price. A little more expensive all in all, but I just hated the concept of IPv6 being an “extra” in 2023.

    theblueredditrefugee,

    Holy fuck, IPv6 is specifically designed to be non scarce and they have the gall to charge extra for it. Gross

    Chreutz,

    Exactly! I wrote the same thing to them when that became clear.

    ChuckEffingNorris,

    The older and shittier the ISP the more blocks of IPV4 addresses they have. They have blocks from when they were given out willy nilly.

    New ISPs, the ones that compete and bring the prices down have to buy addresses and that costs money and is a cost bigger and older ISPs do not have.

    This is a case for regulation - either mandating a move to V6 or mandating the release of stockpiled v4 addresses. ISPs will not do that on their own, the addresses can currently be sold for lots of money.

    LemmyIsFantastic,

    Lolol bro is screaming and riling the troops over his insane ISP using NAT lol

    theblueredditrefugee,

    It doesn’t materially affect anything. I can even still host websites using things like serveo.net or localhost.run. It just violates something in my sense of efficiency to have a server out there that I’m using literally for the only purpose of proxying connections back to me because my ISP blocks all incoming connections

    Gooey0210,

    It would be better to have a cheap vps for the same purpose

    It’s like the same cloudflare, but with more control

    circuscritic,

    Standard IPv4 NAT or CGNAT?

    Are you using their modem AND router? Or just their modem? If it’s a modem router combo, can you place it in bridge/passthrough mode?

    Even if it’s CGNAT and no bridge mode, their are solutions available.

    Are you looking to host private services like NextCloud? Or public services like a website?

    theblueredditrefugee,

    Far as I can tell there’s no bridge mode, and there’s only one device in the space that connects me to the internet. Pretty sure it’s a CGNAT, and I wanna host a website

    Corgana,
    @Corgana@startrek.website avatar

    Apologies if you’ve answered this elsewhere but I’m assuming there’s a reason you haven’t bought your own router?

    averyminya,

    Is that possible with something like T-Mobile Home Internet?

    Corgana,
    @Corgana@startrek.website avatar

    idk that’s why I asked

    MomoTimeToDie,

    You can’t get your own router?

    Kbin_space_program,

    You can. But it then has to route through their modem+router single piece unit.

    E.g. I have my own router which handles everything I need. But I switched ISPs recently to save 70$ per month, and the new company router has parts of its functionality, like turning off the wifi, built into their smartphone app and disabled in the admin panel.

    Also the username and password for the unit is, by default, admin/admin. In 2023.

    MomoTimeToDie,

    Sounds like a (somehow even more) shit isp. I just tapped the “bring my own” when I signed up, and bought myself a modem/router combo at best buy.

    qqq, (edited )

    Don’t know you exact situation, but you should be able to bring your own modem (or modem/router combo) or put their provided unit into bridge mode

    SpeakinTelnet,

    Bridge mode still means you go through their hardware. I had issues with my ISP modem because even if it was in bridge mode I was basically ddos-ing it with my usage.

    In the end I got an sfp module that mimick being the modem and plugged the ISP fiber right into my opnsense box where the CPU was plenty.

    qqq,

    Yes, but if you can’t get your own modem it’ll at least stop you from having your traffic slowed down by the router side of their hardware

    SpeakinTelnet,

    Even in bridge mode you can still be slowed down by the modem if its CPU can’t handle your traffic. That’s unless the isp modem offer a complete passthrough. That’s what was happening to me even in bridge mode where I was getting my own IP through pppoe. The modem couldn’t be made into full passthrough and was hitting 100% CPU.

    nutsack, (edited )

    i repeatedly petitioned our landlord (once a year) to allow an alternative isp to hook up to the building, and he eventually was so pissed from my requests that he threatened to press charges against me personally if the electrical box were ever opened

    henfredemars,

    Ouch. You know some landlords get kickbacks for exclusivity? It’s pretty corrupt where I live.

    theblueredditrefugee,

    My internet is included in rent. Which is convenient for day-to-day use but gives me less capacity for customization. Like, I admit it, the system works really well for normal people, I’m just a weirdo who likes tinkering with technology, hosting websites, and whatnot

    luthis,

    “My food is included in rent. Which is convenient for day-to-day eating but gives me less capacity for cooking my own meals. Like, I admit it, the system works really well for normal people, I’m just a weirdo who likes tinkering with recipes, hosting dinner parties, and whatnot”

    There, I highlighted the absurdity even more for you. You’re not a wierdo, you’re a tech-chef.

    theblueredditrefugee,

    lmao I like this.

    Honestly I feel like people should have a better understanding of how their technology works. Like if we just all lived in a post-scarcity society where all code was available on github and any time a program stops working for you you can just go in, fork the repo, make the change that fixes your problem. Blammo, your problem is solved as soon as you can write the code, and if anyone else has the problem they can use your change.

    One can dream

    luthis,

    Well, people have been forking recipes forever. I’m sure we will get closer to that reality eventually

    UnRelatedBurner,

    using more salt, or leaving out ingredients that one’s allergic to isn’t as hard as learning c++, understanding the codebase, knowing the external packages used, knowing your specific problem, knowing where to fix it, knowing how to fix it.

    Outtatime,
    @Outtatime@sh.itjust.works avatar

    I would have moved

    nutsack,

    i threatened to do this in my petitions, as my calls with work were dropping due to jitter

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • piracy@lemmy.dbzer0.com
  • localhost
  • All magazines
    •
    Loading…
    Loading the web debug toolbar…
    Attempt #

    Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 20480 bytes) in /var/www/kbin/kbin/vendor/symfony/http-kernel/Profiler/FileProfilerStorage.php on line 171

    Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 73728 bytes) in /var/www/kbin/kbin/vendor/symfony/error-handler/ErrorRenderer/HtmlErrorRenderer.php on line 249