Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.

aw



238 posts

Master Geek
+1 received by user: 2

Subscriber

Topic # 106147 18-Jul-2012 16:51 Send private message

Hi,

I'm trying to configure a 3G modem as a backup internet connection (using Netcomm's 3G "Travel" router and a pfSense box as well as DynDNS). I'm implementing this by way of a script that implements failover routing, meaning under normal circumstances, nothing will listen on the 3G data connection unless my primary ADSL connection is down. This will avoid any data blowouts. For testing, I'm having some services listen on PCs configured to use the 3G router as their default route even though my ADSL is still up.
Yes I know the risks of having listening services and those risks are managed and mitigated (fail2ban etc).

Outbound works fine, inbound doesn't work at all over 3G.

I've noticed using Wireshark that when attempting a remote inbound TCP connection, I always get TCP connections appear from the POV of the client end to open and then just about immediately reset (in order, SYN, SYN-ACK, ACK as expected, but then an immediate RST ACK). This is when attempting to connect from a PC on my ADSL connection to any port on the public IP (118.148.x.x and 118.149.x.x) of the 3G connection, whether that be to the 3G router or directly plugged in to my laptop for testing.

I also notice I get the same RST behaviour when trying to connect to an IP address allocated to the 3G connection even *after* yanking the stick out of the router or laptop's USB socket - so it's not the router or test laptop sending the SYN-ACKs and RSTs.
The behaviour I'm expecting instead would of course be connection timeouts instead of immediate resets, given the modem/test laptop is then physically incapable of receiving or responding to the incoming connection once unplugged.


Amusingly, if I point my laptop via the 3G modem to GRC's "Shields Up" firewall tester and get it to scan all service ports, this behaviour of the ports seeming to initially open means that test declares that nearly ALL ports that it scans are "open" except for a few filtered Windows networking ones (139 etc). Other firewall testers yield similar results.

So I was wondering, despite finding mentions on GZ that 2Degrees don't firewall or filter internet traffic except out-of-state stuff, has this changed for inbound traffic? I can only find mention of one APN for 2D for data, being "internet", so this is the only APN I've tried (I know as a comparison Vodafone offer filtered vs unfiltered APNs).

Does anyone else here successfully use listening services over a 2D mobile data connection from time to time?

View this topic in a long page with up to 500 replies per page Create new topic
 1 | 2
16132 posts

Uber Geek
+1 received by user: 1171

Trusted
Vodafone NZ

  Reply # 657828 18-Jul-2012 17:00 Send private message

Inbound connections I am sure are blocked Salty will be able to confirm this

John




19267 posts

Uber Geek
+1 received by user: 1140

Moderator
Trusted
Biddle Corp
Subscriber

  Reply # 657840 18-Jul-2012 17:14 Send private message

My default carriers typically always block inbound initiated traffic to stop things like a DDOS attack on a phone. You will need to establish if 2d offer an APN that allows uninitiated traffic, and if they don't you will need to use Telecom or Vodafone who do.


16132 posts

Uber Geek
+1 received by user: 1171

Trusted
Vodafone NZ

  Reply # 657845 18-Jul-2012 17:19 Send private message

By default Vodafone block these connections




aw



238 posts

Master Geek
+1 received by user: 2

Subscriber

  Reply # 658394 19-Jul-2012 13:09 Send private message

Makes sense and that's a good reason to do it.

I've since found that inbound connections work when both ends are on 2D 3G data - which must be entirely inside that firewall- which works for me as I'd only be accessing it like this from my tethered iPhone which is also on 2D, and then only if the ADSL connection has failed for whatever reason.

3 posts

Wannabe Geek


  Reply # 684391 11-Sep-2012 14:23 Send private message

I was going to ask if anyone managed to find out how to set up a modem to allow inbound IP connections. But I managed to find the answer. You need to change you APN from "internet" which is firewalled to "direct" which allows all incomming IP traffic to hit your device TCP stack. The down side is you will need to make sure that you have adequate defenses in place such as an SPI firewall and only open ports you want to accept inbound connections too. 

3550 posts

Uber Geek
+1 received by user: 857

Trusted

  Reply # 684598 11-Sep-2012 20:45 Send private message

TelecomDirect APN achieves this, sounds like the 'direct' apn on 2degrees does the same thing if the above post is correct.

195 posts

Master Geek
+1 received by user: 2


  Reply # 684659 11-Sep-2012 23:20 Send private message

eXDee: TelecomDirect APN achieves this, sounds like the 'direct' apn on 2degrees does the same thing if the above post is correct.


It would be news to me if 2deg have a direct (non-firewalled) APN at all.

2942 posts

Uber Geek
+1 received by user: 154

Trusted
Subscriber

  Reply # 684673 12-Sep-2012 00:14 Send private message

Ah that is very good to know. Is direct a "standard" ie if I go anywhere the "internet" APN always seems to work on any carrier, same for direct?





BDFL
49171 posts

Uber Geek
+1 received by user: 4162

Administrator
Trusted
Geekzone
Subscriber

  Reply # 684693 12-Sep-2012 05:44 Send private message

This is not standard.




2759 posts

Uber Geek
+1 received by user: 410

Trusted
Subscriber

  Reply # 684700 12-Sep-2012 07:06 Send private message

It was inevitable that we would have to do this - APNIC has been out of IPs for some time now, so as we approached the end of the IP address space that we had, something had to be done. If we have 100,000 customers with simultaneous data sessions using public IPs, then we need 100,000 public IPs. If we do a 10:1 NAT then we can support 1,000,000 simultaneous connections with 100,000 IPs.

One day IPv6 will be an option - but not at the moment. Not enough devices support it. In the meantime we have turned to carrier-grade NAT to conserve IPv4 addresses. But yes, if you need a full two-way unfiltered public IP you can get it with the 'direct' APN. That will remain the medium term plan, where 'medium term' is defined as 'until IPv6 is actually useful'.




iPad Air + iPhone 5S + 2degrees 4tw!

These comments are my own and do not represent the opinions of 2degrees.

195 posts

Master Geek
+1 received by user: 2


  Reply # 684757 12-Sep-2012 09:31 Send private message

Interesting, thanks for that info SaltyNZ.
I wasn't aware that 2d also had a direct apn but never tried it myself.
I could be wrong but I believe that this would be the first report of a nz ISP using carrier grade NAT.

19267 posts

Uber Geek
+1 received by user: 1140

Moderator
Trusted
Biddle Corp
Subscriber

  Reply # 684759 12-Sep-2012 09:35 Send private message

Publius: Interesting, thanks for that info SaltyNZ.
I wasn't aware that 2d also had a direct apn but never tried it myself.
I could be wrong but I believe that this would be the first report of a nz ISP using carrier grade NAT.


Both Telecom and Vodafone have used or use NAT for some APN's for many years.

2759 posts

Uber Geek
+1 received by user: 410

Trusted
Subscriber

  Reply # 684808 12-Sep-2012 10:45 Send private message

sbiddle: 

Both Telecom and Vodafone have used or use NAT for some APN's for many years.


Nearly from day 1 for Vodafone... AFAICR the www.vodafone.net.nz APN was always NAT.




iPad Air + iPhone 5S + 2degrees 4tw!

These comments are my own and do not represent the opinions of 2degrees.

BDFL
49171 posts

Uber Geek
+1 received by user: 4162

Administrator
Trusted
Geekzone
Subscriber

  Reply # 684815 12-Sep-2012 10:49 Send private message

Also note that direct APNs make YOU responsible for any unsolicited traffic, including port scanning, etc - and that happens a lot on the Internet, you know...




2942 posts

Uber Geek
+1 received by user: 154

Trusted
Subscriber

  Reply # 684841 12-Sep-2012 11:30 Send private message

SaltyNZ: It was inevitable that we would have to do this - APNIC has been out of IPs for some time now, so as we approached the end of the IP address space that we had, something had to be done. If we have 100,000 customers with simultaneous data sessions using public IPs, then we need 100,000 public IPs. If we do a 10:1 NAT then we can support 1,000,000 simultaneous connections with 100,000 IPs.

One day IPv6 will be an option - but not at the moment. Not enough devices support it. In the meantime we have turned to carrier-grade NAT to conserve IPv4 addresses. But yes, if you need a full two-way unfiltered public IP you can get it with the 'direct' APN. That will remain the medium term plan, where 'medium term' is defined as 'until IPv6 is actually useful'.


Lots of devices support IPv6. My last 2 Androids have and I can go onto this website via my Galaxy Nexus and IPv6 over Wifi now. The carriers need to show initiative here and get IPv6 rollout underway. Nearly all have been really slack in this regard.





 1 | 2
View this topic in a long page with up to 500 replies per page Create new topic




Twitter »
Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:




News »

Trending now »
Hot discussions in our forums right now:

2 x PS4s to give away. Geekzone members only.
Created by BigPipeNZ, last reply by jurax04 on 29-Jul-2014 23:10 (54 replies)
Pages... 2 3 4


Logitech K400r HTPC Cordless Keyboard Half Price
Created by Dynamic, last reply by Blanch on 28-Jul-2014 22:16 (25 replies)
Pages... 2


VF, why you lie to me?
Created by kenkeniff, last reply by kenkeniff on 29-Jul-2014 14:35 (46 replies)
Pages... 2 3 4


2010 Honda Jazz, Suzuki Swift - which has higher maintenance cost?
Created by joker97, last reply by jonathan18 on 30-Jul-2014 09:26 (63 replies)
Pages... 3 4 5


Dick Smith in Continual Sale Mode
Created by Dynamic, last reply by eXDee on 29-Jul-2014 19:23 (65 replies)
Pages... 3 4 5


Checking UHF aerial is working
Created by OnceBitten, last reply by B1GGLZ on 28-Jul-2014 21:49 (21 replies)
Pages... 2


Hierarchy of a mistake: Gerry Brownlee
Created by joker97, last reply by DonGould on 29-Jul-2014 21:57 (93 replies)
Pages... 5 6 7


Is chorus going to deliberately slow adsl internet down
Created by rugrat, last reply by juha on 26-Jul-2014 14:25 (54 replies)
Pages... 2 3 4



Geekzone Live »
Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.

Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.