Spark wireless broadband and home /lan access: CGNAT limitations

Forums › Spark New Zealand (including Skinny and BigPipe) › Spark wireless broadband and home /lan access: CGNAT limitations

yokkem

9 posts

Wannabe Geek

#206056 8-Dec-2016 09:02

Perhaps I'm wrong but after many long phone calls/waits to check it appears that Spark customers enjoying Sparks wireless broadband via the 4g network have no way to access devices in their lan.

It seems that the limitations of CGNAT prevent inbound traffic.

Can anyone help me out here and confirm this is so?

Is this only Sparks network or does it include other providers as well (Vodafone/2degrees...)?

Can anyone also help with anyway to allow access to devices at a residence. Examples may include security systems, aircon units etc etc...

I'm thinking a vpn to an onsite pc and then out to the local devices...

Look forward to a reply,

1 | 2

6434 posts

Uber Geek

#1684435 8-Dec-2016 09:09

Almost all Mobile networks around the world use CGNAT - including sparks

yokkem

9 posts

Wannabe Geek

#1684438 8-Dec-2016 09:13

Thanks, and so do the limitations of CGNAT prevent inbound traffic?

sbiddle

30853 posts

Uber Geek

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#1684441 8-Dec-2016 09:19

yokkem:

Thanks, and so do the limitations of CGNAT prevent inbound traffic?

Yes.

The Spark wireless solution is not suitable for your requirements if you need port forwards.

One should point out however that any port forwards to devices such as alarms etc is incredibly bad from a security perspective and should be avoided at all costs unless access is fully locked down by means of VPN or reverse proxy. You however will not be able to establish an inbound VPN connection to a VPN server behind CG-NAT.

There are a number of options from the mobile providers along with other resellers of networks that can offer a public IP and inbound uninitiated traffic. Just don't expect to necessarily pay the same price as a cheap residential wireless connection.

yokkem

9 posts

Wannabe Geek

#1684444 8-Dec-2016 09:24

Thanks again, and yes I understand about the security risks with port forwards.

PaulBags

809 posts

Ultimate Geek
Inactive user

#1684451 8-Dec-2016 09:33

[Edit] ignore me

yokkem

9 posts

Wannabe Geek

#1684453 8-Dec-2016 09:38

And for this:

"There are a number of options from the mobile providers along with other resellers of networks that can offer a public IP and inbound uninitiated traffic. Just don't expect to necessarily pay the same price as a cheap residential wireless connection"

Would you know if Spark offer it? Their front door is difficult to get any definitive information or help from.

sbiddle

30853 posts

Uber Geek

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#1684539 8-Dec-2016 11:59

yokkem:

And for this:

"There are a number of options from the mobile providers along with other resellers of networks that can offer a public IP and inbound uninitiated traffic. Just don't expect to necessarily pay the same price as a cheap residential wireless connection"

Would you know if Spark offer it? Their front door is difficult to get any definitive information or help from.

Spark offer a APN that gives a public IP and doesn't block inbound uninitiated traffic. Anybody can use this, but obviously not on a Spark wireless device that's locked down.

Sharesies

Trade NZ and US shares and funds with Sharesies (affiliate link).

shk292

2855 posts

Uber Geek

Lifetime subscriber

#1684557 8-Dec-2016 12:10

Presumably, running something like Teamview on a PC on the LAN would allow access

yokkem

9 posts

Wannabe Geek

#1684559 8-Dec-2016 12:14

Spark offer a APN that gives a public IP and doesn't block inbound uninitiated traffic. Anybody can use this, but obviously not on a Spark wireless device that's locked down.

Right, so that explains why the Spark/Huawei B315s config'd with that APN still won't pass traffic inward... I guess. Could a different router/modem with Spark SIM work? Appreciate your feedback & time with this...

yokkem

9 posts

Wannabe Geek

#1684571 8-Dec-2016 12:26

shk292:

Presumably, running something like Teamview on a PC on the LAN would allow access

yes, quite probably but not what I'm after...

sbiddle

30853 posts

Uber Geek

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#1684572 8-Dec-2016 12:31

yokkem:

Right, so that explains why the Spark/Huawei B315s config'd with that APN still won't pass traffic inward... I guess. Could a different router/modem with Spark SIM work? Appreciate your feedback & time with this...

Yes, but obviously not a Spark home wireless SIM since those are tied to the router.

yokkem

9 posts

Wannabe Geek

#1684574 8-Dec-2016 12:37

sbiddle:

yokkem:

Right, so that explains why the Spark/Huawei B315s config'd with that APN still won't pass traffic inward... I guess. Could a different router/modem with Spark SIM work? Appreciate your feedback & time with this...

Yes, but obviously not a Spark home wireless SIM since those are tied to the router.

So maybe a Spark mobile SIM in the Spark/Huawei device, would that work?

sbiddle

30853 posts

Uber Geek

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#1684576 8-Dec-2016 12:40

yokkem:

sbiddle:

yokkem:

Right, so that explains why the Spark/Huawei B315s config'd with that APN still won't pass traffic inward... I guess. Could a different router/modem with Spark SIM work? Appreciate your feedback & time with this...

Yes, but obviously not a Spark home wireless SIM since those are tied to the router.

So maybe a Spark mobile SIM in the Spark/Huawei device, would that work?

shk292

2855 posts

Uber Geek

Lifetime subscriber

#1684588 8-Dec-2016 12:49

yokkem:

shk292:

Presumably, running something like Teamview on a PC on the LAN would allow access

yes, quite probably but not what I'm after...

But, once you've TeamViewed into the PC, that is equivalent to VPNing in (as in your first post) and you then have access to your whole LAN. Or did I miss something?

yokkem

9 posts

Wannabe Geek

#1684605 8-Dec-2016 13:03

shk292:

yokkem:

shk292:

Presumably, running something like Teamview on a PC on the LAN would allow access

yes, quite probably but not what I'm after...

But, once you've TeamViewed into the PC, that is equivalent to VPNing in (as in your first post) and you then have access to your whole LAN. Or did I miss something?

For the sake of brevity I have not outlined the complete situation so... In this case not a PC. Micron security system on IP: 192.168.X.X portXXXX. Works going out to a server and can check status but need inward via iphone/android app to turn system on/off. Yes, teamviewer would let one get to a PC and yes one could go from that to a local IP/web interface and yes it would also be horrible. PC would need to be on all the time. This is a holiday house so... Also cust needs/wants access for home automation devices... Aircon/lights/whatever. There must be a way of asking a Telco/ISP for provision of services to allow this (insecure-ish) customer requirement. Any ideas which telco (Spark has a wireless broadband service there at present) and how one might go about asking... the 0800 mobile wifi team are marvelously helpful but locked in to strict "we don't do that" loops for non standard requirements. sbiddle suggests it is possible (with money) but finding out how/who to contact is difficult. Local Spark but has been called, wifi broadband and up have been called along with 30+ minute wait times... it's been fun so far. Not limited to this customer either. I have other reports where people want access for the same reasons so time spent detailing what to ask for and where to go could be helpful. Now, who can help?

1 | 2