"Direct" APN problems

Forums › 2degrees (including Slingshot, Orcon, Flip, Stuff Fibre, MyRepublic, 2talk and Vocus) › "Direct" APN problems

colinuu

246 posts

Master Geek

#195232 11-Apr-2016 21:01

Is there a 2D rep here?

We have a few remote sites operating around the country, connecting with 2degrees 3G, using APN "direct". This has been working fine until recently (2-3 weeks ago). The site gets a public IP address, and we were able to connect as normal using a variety of TCP ports to do maintenance activities and collect data files.

But now the TCP traffic is not getting through. Site still gets public IP, and replies to ping requests. However it appears all TCP ports are now blocked.

Has there been a change to "direct" services? Intentional or accidental? Can you help restore our previous service?

Regards,
Colin

michaelmurfy

meow
13275 posts

Uber Geek

Moderator

ID Verified

Trusted

Lifetime subscriber

#1530280 11-Apr-2016 21:44

Hmm I wouldn't recommend personally using the direct APN - is there a chance of setting up something like an OpenVPN connection to your sites? It would be better for you and far more secure.

Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.

lokeynz

105 posts

Master Geek

#1530287 11-Apr-2016 22:00

Same problem here with a site on a remote mountain top.
I thought the router was on the fritz and had been making arrangements to go to site and reboot it.

Would be great if it could be resolved.

The last data collect from ssh/web ports was 14:30 on the 6th.
Interestingly a weather station listening on a higher port (22222) was still accessible until 01:35 on the 7th.

colinuu

246 posts

Master Geek

#1530309 11-Apr-2016 22:17

@ michaelmurfy:

Thanks for the suggestion, we will look into this.

In the meantime, we need to re-establish our existing connections....

sbiddle

30853 posts

Uber Geek

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#1530394 12-Apr-2016 07:28

I know Spark have a public APN allowing uninitiated traffic but I'm pretty sure Vodafone now don't. Due to the risks of DDoS or simply bots probing the system if you have ports open I'd never ever allow open ports on a mobile data connection if I was deploying hardware. Best practice is to have all traffic initiated from the mobile end and tunnel traffic if you need full access.

lokeynz

105 posts

Master Geek

#1530437 12-Apr-2016 08:43

In our case the data is collected by 3 servers in different locations so tunneling isn't straight forward.
The ports are firewalled to those specific IPs.

I'll look at the options for making this work without direct access but in the meantime our equipment is marooned and I'd rather not lug a laptop into the backcountry if this was an inadvertent change or fault that can be resolved on 2degrees end.