Me vs my ISP

So I was looking into getting port forwarding set up and I realized just how closed-off the internet has gotten since the early days. It’s concerning. It used to be you would buy your own router and connect it to the internet, and that router would control port-forwarding and what-have-you.

Now, your ISP provides your router, which runs their firmware, which (in my case) doesn’t even have the option to enable port forwarding.

It gets worse - because ISPs are choosing NATs over IPv6, so even if you install a custom firmware on your router without it getting blacklisted by your ISP, you still can’t expose your server to the internet because the NAT refuses to forward traffic your way. They even devise special NAT schemes like symmetric NAT to thwart hole punching.

Basically this all means that I have to purchase my web hosting separately. Or relay all the traffic through an unnecessary third party, introducing a point of failure.

It’s frustrating.

I like to control my stuff. I don’t like to depend on other people or be in a position where I have to trust someone not to fuck with my shit. Like, if the only thing outside my apartment that mattered to my website was a DNS record, I’d be really happy with that.

Edit: TIL ISPs in the US don’t have NATs

Edit 2: OMG so much advice. My knowledge about computers is SO clearly outdated, I have a lot of things to read up on.

Edit 3: There’s definitely a CGNAT involved since the WAN ip in the router config is not the same as the one I get when I use a website that echos my IP address. Far as I can tell my devices don’t get unique IPv6 addresses either. (funnily enough, if I check my IP address on my phone using roaming data, there’s no IPv6 address at all). It’s a router/modem combo, at least I think since there’s only one device in my apartment (maybe there’s a modem managing the whole complex or something?). And it doesn’t have a bridge mode, except for OTT. Might try plugging my own router into it, but it feels like a waste of time and money from what I’m seeing. Probably best to just host services over a VPN or smth.

Edit 4: Devices do get unique IPv6 addresses, but it’s moot since I can’t do anything but ping them. I guess it wouldn’t be port forwarding but something else that I would have to do that my router doesn’t support

LemmyIsFantastic,

Lolol bro is screaming and riling the troops over his insane ISP using NAT lol

theblueredditrefugee,

It doesn’t materially affect anything. I can even still host websites using things like serveo.net or localhost.run. It just violates something in my sense of efficiency to have a server out there that I’m using literally for the only purpose of proxying connections back to me because my ISP blocks all incoming connections

Gooey0210,

It would be better to have a cheap vps for the same purpose

It’s like the same cloudflare, but with more control

gornius,

If you’re trying to self-host http service, you can use cloudflare tunnels.

theblueredditrefugee, (edited )

I’ve thought about using AWS for hobbyist web applications, but I worry about difficult-to-predict costs

That said, after a cursory glance, HOLY SHIT IT’S FREE

Obviously still not a great solution if DMCA is a concern

Chreutz,

Hetzner is affordable and way more transparent than AWS, btw

gornius,

If you’re lucky enough to successfully create an account on Oracle Cloud, you can also try Oracle Cloud Free Tier. You can have free ARM64 x4 CPU and 24 GiB RAM totally free of charge. There might be problems with availability during VM registration, but there are scripts that automate spamming for checking every 80 seconds.

I’ve been using it for 2 years and it’s great. However be aware that your VM might get erased if you have a free account. That too can be remedied if you update to a premium subscription (You still get Free Tier resources without a charge). Nobody has reported an erased VM on a premium plan yet.

Still, I am pretty sure they can erase it if you do illegal stuff with it. I’ve been using it only to host Minecraft Server, as well as other services using Docker. So far so good.

UnRelatedBurner,

wait, all I got from this is Oracle gives out free 24GiB 4core VPSs? Free cake and I can eat it too? Please fill me in on more details, or links

gornius, (edited )

www.oracle.com/cloud/free/

There are tutorials on youtube on how to create a VM and set up a firewall for external access.

UnRelatedBurner,

Where’s the catch? Seems to good to be true? On that power I can host everything I ever wanted and more

unclemac59,

docs.oracle.com/…/freetier_topic-Always_Free_Reso…

Reclamation of vms as others have mentioned and the service limitations as to what qualifies for the free tier are really the only catch, but not a problem if you’re willing to give them your credit card info for a paygo acct. More details are in this link to the docs. It’s honestly a really good deal and I find it way more transparent and easier to use than AWS.

UnRelatedBurner, (edited )

I give them an empty online card, and install some random bloatware so it uses cpu and ram. Now I have a server for free forever? How do they profit from this, it’s hard to believe that it’s truly free?

theblueredditrefugee,

Awesome, thanks for the trick!

sparky,
@sparky@lemmy.federate.cc avatar

Cloudflare tunnels are definitely the way, letting you expose a service to the open internet regardless of what your ISP thinks. I’m not sure how they would handle DMCA complaints but given they are just a DNS provider, I’m not sure they would do much given it’s the server owner’s responsibility for the content. Which in this case is you.

WarmApplePieShrek,

Tunnelling isn’t a DNS provider

evranch,

For free tier, Google Cloud is more transparent about what you get than AWS IMO.

The only catch is to make sure your persistent disk is “standard” to make it totally free as it defaults to SSD.

However if you do mess up the disk you’ll still only be paying $1-2/mo. Been using GC for years, and recently they finally started offering dual stack so you can do your own 6to4 tunneling or translation if you want, depends on your usage case.

AirVPN also are legit and will let you forward ports to expose your local services if you’re worried about DMCA type issues.

I finally got IPv6 here through Starlink, it’s nice to have full access to the internet again after a decade behind CGNAT

bruhduh,
@bruhduh@lemmy.world avatar

Cheapest vps plus “sshuttle” may work, host everything on your home server but have dedicated ip of your vps

WindowsEnjoyer,

First time hearing about sshuttle, thanks! What I did some time ago is to order small VPS in Linode, hosted wireguard server and let my router connect to it. Since connection is established - I’ve port-forwarded all ports (except 22) from VPS to my router via established wireguard connection.

Then all I have to do is to manage port forwarding on my router, but if I want to connect to my router from outside - I must use VPS IP.

Worked great, except the fact that I used to have mobile internet and as a rule of thumb - upload speed of mobile internet suck ass…

bruhduh,
@bruhduh@lemmy.world avatar

Check this out github.com/MHSanaei/3x-ui

circuscritic,

Standard IPv4 NAT or CGNAT?

Are you using their modem AND router? Or just their modem? If it’s a modem router combo, can you place it in bridge/passthrough mode?

Even if it’s CGNAT and no bridge mode, their are solutions available.

Are you looking to host private services like NextCloud? Or public services like a website?

theblueredditrefugee,

Far as I can tell there’s no bridge mode, and there’s only one device in the space that connects me to the internet. Pretty sure it’s a CGNAT, and I wanna host a website

bayank,

Might not be ideal but perhaps simpler, do you have the ability to upgrade your service to business class? Usually the business tiers allow such things and they will support self hosting and open up the ports for you if you ask. It will likely cost more for the same speed you currently have. Another option to consider

BradleyUffner,

Just a bit of a warning if you do this. Business class service usually requires full year contacts, and breaking the contract can mean THOUSANDS of dollars in termination fees depending on the timing.

WarmApplePieShrek,

Asking is free

DivisionResult,

Use cloudflare tunnel.

lemmyvore,

Are you trying to offer a port for peer sharing (XDCC/BT)? I’ve never tried using it like this but I think Tailscale Funnel could work.

It’s a sort of reverse VPN, I guess you could call it. Tailscale maintains the public IP and when someone connects to your advertised port they tunnel it to you through (encrypted) WireGuard. It passes through NAT because connections are outgoing to their servers.

The catch is that wireguard is easily detectable through deep packet inspection so if your ISP is a real asshole they can kill the connections, but if they go that far then NAT traversal is the least of your worries.

MayonnaiseArch,
@MayonnaiseArch@beehaw.org avatar

It’s really shitty. My isp offers a static ip plan but it costs a lot more, so I try using tailscale and it works ok. It’s a shame though

BearOfaTime, (edited )

On the flip side, direct open ports to your home network isn’t really a great idea anyway.

At one time it wasn’t as bad, but today I’d be hesitant because of the number and capability of bad actors and I’m not a network security expert (though I have a lot of training in networks, just shy of that kind of expertise).

In a way, these restrictions have promoted the use of even more secure approaches, like using Cloudflare tunnels, VPS’s with VPN connections to your network, or things like Wireguard/Tailscale, which provide a virtual (encrypted) network layered on top of the public (untrusted) network.

All of these can provide an externally controlled (secured and encrypted) access to specific resources within your own network. As mentioned, VPS with VPN, Cloudflare tunnels, or Tailscale Funnel or Share.

Shinji_Ikari,
@Shinji_Ikari@hexbear.net avatar

Is your service fiber? Is your router a combined ONT and router? If its not and you have an ONT serving ethernet to the router, you can just plug your own router in.

You said it’s through china mobile so is it a cell modem/router?

theblueredditrefugee,

Just checked, it looks like it’s fiber. Definitely has something plugged into the wall anyway - I’m kinda afraid of unplugging it and ruining my internet access.

Shinji_Ikari,
@Shinji_Ikari@hexbear.net avatar

Idk how it works in china, is the wire coming from the wall a thin sorta stiff wire? or is it a thicker wire(5-10mm across) that is bendy?

If the latter, you can just plug that ethernet cable into your own router.

If its a fiber cable then I dont know if you can have your own ONT.

ulkesh,
@ulkesh@beehaw.org avatar

I don’t know what you mean by ISPs in the US don’t have NATs. They most certainly do NAT at the gateway device. But they also typically provide a way to DMZ to your own router instead. I don’t have to deal with double NAT simply because I effectively have my ISP gateway in bridge mode (forwarding all traffic to a specific device, in this case, my personal router).

Note: I have gigabit FTTH from AT&T. I left cable internet the moment fiber service was made available.

filister, (edited )

There are plenty of solutions out there like Tailscale, Cloudflared tunnel, Nebula, ZeroTier, etc. Yes, ISPs still prefer IPv4 and impose CGNAT, but it is mostly because IPv6 isn’t as ubiquitous as IPv4 and the world long went out of public IPv4 addresses.

Plus where I live I can do with my IPv6 whatever I please.

theblueredditrefugee,

Plus where I live I can do with my IPv6 whatever I please.

Sounds nice

onlinepersona,

Can’t switch ISPs? I’d tell them exactly why I’m switching.

BlackSkinnedJew,

What do you need to do, why do you need a public IP?

theblueredditrefugee, (edited )

Well, I don’t need it, not really. It’s just I’m finally in a position where I’m not stressed about things like rent and healthcare, and I’m realizing I wanna fuck around with hosting my own websites. Possibly a lemmy instance, I was toying with the idea of developing a P2P social networking protocol that federates with lemmy. But also the idea of building my own websites so I’m not dependent on others for my income, or just making it easier for people to download stuff that I’m the only seeder of.

Definitely not a need. My rent is paid, my food is healthy, healthcare is cheap. So now I can worry about stuff like this that ultimately doesn’t matter

WarmApplePieShrek,

You can rent a server in a data center. Hetzner is pretty good… unless it thinks you’re a “risky customer” and bans you.

narc0tic_bird,

Here in Germany I get a “real” (non-shared) IPv4 address and a /48 IPv6 subnet I think. With Telekom at least. Vodafone is another story. I think the user must be able to use their own router because of some EU law.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • piracy@lemmy.dbzer0.com
  • localhost
  • All magazines
    •
    Loading…
    Loading the web debug toolbar…
    Attempt #