2degrees: Changes to IP Addresses (CGNAT)

Forums › 2degrees (including Slingshot, Orcon, Flip, Stuff Fibre, MyRepublic, 2talk and Vocus) › 2degrees: Changes to IP Addresses (CGNAT)

1 | ... | 27 | 28 | 29 | 30 | 31 | 32

c0ld

234 posts

Master Geek
+1 received by user: 69

#2662422 25-Feb-2021 06:42

sorceror:
c0ld: 2degrees offer this as part of a private apn product on one of their corporate plans designed for a minimum of a couple of hundred users. Think $thousands for initial setup then ongoing costs for the apn as well as the individual plan costs. Never heard of it being offered to smaller business / residential. The amount of work that goes into initial setup would make it too prohibitive for smaller user numbers on a private apn.

yes if you're building new or complex APNs, but i would be very surprised if 2degrees don't already have an APN created that could just deliver a static public IP address to a subscriber.

not that it matters anyway, they still aren't going to offer it to joe public.

They told me they don't, even as a business customer (I asked that very question ref if they have an existing APN designed for that purpose). This was very recent. They also said they're not aware of it being on any current roadmap. My guess is it's a request they get asked less than you'd expect.

jol

56 posts

Master Geek
+1 received by user: 12

#2667595 4-Mar-2021 08:55

If I host an IPv6 service (such as a VPN server) on my home 2degrees broadband connection, can I connect to it from a 2degrees mobile connection? Does any mobile provider support IPv6 in New Zealand?

About to move into my first home, and want to know whether 2degrees would be suitable for me, given the limitations of being behind CGNAT. Hosting services isn't something I plan to do immediately, but I want to have the option. I know you can buy a static IP for $10 a month, but want to know what is possible without that.

Benoire

2878 posts

Uber Geek
+1 received by user: 681

#2667597 4-Mar-2021 08:58

I know that both vodafone and 2degrees mobile are not IPv6 enabled (work and partners personal mobile).... there is a thread about how to enable a direct connection from a 2degrees mobile to the internet rather than via CGnat etc. but not sure if that enables IPv6 at all.

You could use cloudflare to 'translate' and tunnel your IPv6 home connection which should allow ipv4 connections to it... cloudflare is free for these things.

jol

56 posts

Master Geek
+1 received by user: 12

#2667626 4-Mar-2021 10:42

Benoire:

I know that both vodafone and 2degrees mobile are not IPv6 enabled (work and partners personal mobile).... there is a thread about how to enable a direct connection from a 2degrees mobile to the internet rather than via CGnat etc. but not sure if that enables IPv6 at all.

You could use cloudflare to 'translate' and tunnel your IPv6 home connection which should allow ipv4 connections to it... cloudflare is free for these things.

Thanks, I'll look into Cloudflare.

It does seem odd to me that 2degrees are really big on IPv6 support on fixed broadband, but not on mobile. I know 2degrees inherited it's fixed broadband business from Snap in 2015, but I would have thought the two offerings would be better integrated by now. It seems to me that greater adoption of IPv6 ought to be the proper solution to the shortage of public IPv4 addresses, rather than relying on CGNAT in perpetuity. But I guess with the world moving towards cloud services, maybe having an abundance of available public IP addresses isn't seen as important anymore.

sorceror

163 posts

Master Geek
+1 received by user: 47

#2667990 4-Mar-2021 23:48

c0ld:

They told me they don't, even as a business customer (I asked that very question ref if they have an existing APN designed for that purpose). This was very recent. They also said they're not aware of it being on any current roadmap. My guess is it's a request they get asked less than you'd expect.

their business people likely don't even know - i imagine you'd have to be in the corporate/enterprise space for something like that.

fe31nz

1295 posts

Uber Geek
+1 received by user: 423

#2667993 5-Mar-2021 00:10

One way to do IPv6 from a mobile on an IPv4 only network is to get a free Hurricane Electric account (which will give you an IPv6 address block) and then set up an IPv6 over IPv4 tunnel to connect to the HE network. The downside of that is that the traffic will have to go the the HE servers (probably in the USA) and then back to NZ again. It really would be much better if mobile networks (and in fact all networks) did native IPv6.

Another way that works is if you have full IPv6 support on your home network. Then you can set up an IPv4 only OpenVPN server on your home network, configured in bridging (TAP) mode. Then when you make an IPv4 OpenVPN connection from outside your network, all the IPv6 broadcast packets that set up IPv6 routing will be seen over the OpenVPN connection and your external device will (if allowed) get an IPv6 address as though it was on your home network. I do this with my laptop in Windows and Linux and it works well. Unfortunately, the only OpenVPN clients I have found for Android that will do TAP mode are payware, so I have never tried this with my mobile or tablet. Using TAP mode for OpenVPN will also use a little more of your mobile data, due to the broadcast packets all being transmitted. It is also possible to set up OpenVPN with specific IPv6 support, which might work in TUN mode, but I have never tried that.

Dell

Shop now for Dell laptops and other devices (affiliate link).

DjShadow

4222 posts

Uber Geek
+1 received by user: 1322

ID Verified

Trusted

Subscriber

#2673640 13-Mar-2021 09:33

Thing I've noticed in the past few days is the external facing IP (CGNAT) seems to change every 60-90 mins, difficulty there is when you are on a RDP session and the connection keeps dropping.

I've hit 2D up on social media and they were quick to suggest a Static IP for $10/month. If they could make their IPs stick for at least a day then it wouldn't be a problem.

richms

29104 posts

Uber Geek
+1 received by user: 10222

Trusted

Lifetime subscriber

#2673653 13-Mar-2021 10:46

If its dropping established connections to change the IP that its using, then it is defective and they shouldnt be charging you to resolve it. New connections may get a new IP address but to close open in use ones is a failure.

Richard rich.ms

fe31nz

1295 posts

Uber Geek
+1 received by user: 423

#2674049 14-Mar-2021 01:55

DjShadow:

Thing I've noticed in the past few days is the external facing IP (CGNAT) seems to change every 60-90 mins, difficulty there is when you are on a RDP session and the connection keeps dropping.

I've hit 2D up on social media and they were quick to suggest a Static IP for $10/month. If they could make their IPs stick for at least a day then it wouldn't be a problem.

You do not seem to understand how CGNAT actually works. You no longer get any specific external IP address - instead you share use of a small set of external IP addresses. Each time you open a connection to the Internet, the CGNAT router assigns that connection to a free port on one of those IP addresses. So, for example, if you open a web page and it has lots of pictures on it that need downloading, the web browser may open many different connections to the same web server to do that. But the web server may well see connections from several different external IP addresses that belong to the CGNAT router.

So your actual problem with RDP sessions is something different. The way a CGNAT router works, when you open a connection, it will add that connection to its table of open connections. The table entry will have your router's external IP address (in the CGNAT block 100.64.0.0/10) and the source port used by the connection, and the destination IP address and port, along with the external IP address it assigned and the source port on that IP address.

As long as the CGNAT router thinks your connection is still up, it will keep that table entry and your traffic will flow back and forth over the connection. But once the connection is closed, by either end, the CGNAT router will see the packets that close the connection and delete the table entry.

After that, if any packets try to use the table entry they will be dropped by the CGNAT router. A new connection will need to be opened instead. Since packets can get lost or mangled in transit, there is the possibility that the packets that close a connection may never be seen by the CGNAT router. Then the table entry would hang around forever, and eventually the CGNAT router table would overflow and it would die.

To prevent that, each table entry will also have a timer, saying when it was last used to route a packet. If that timer times out due to no traffic, the CGNAT router will then delete the table entry and any packets that come along expecting to use that table entry will be dropped. That is what is likely happening to your RDP connections.

The easy solution to this problem is just to make sure there is regular traffic to keep the connection alive. Some software has an option to set a "keep alive" timer setting where it will send a null packet if that timer times out before another real packet is sent. So look for something like that and set it to a lower value. If there is no such option, you may like to ask 2D specifically about what the timeout they have on the CGNAT table entries is and whether it is big enough for the RDP protocol as used by your software.

I have not ever actually worked on a CGNAT router, so I do not know if they check what protocol is being used on a connection and set the timeout accordingly, or whether they just use a generic timeout setting. Note that the timeouts used need to be calculated on the basis that some packets can get lost in transit, so if the CGNAT router needs to see a packet every 2 minutes to keep the table entry, you want your software to send a keep alive packet several times in that 2 minutes so that one or two keep alive packets can be lost and the connection will still stay up.

[Mod edit (MF): added paragraph breaks to make it easier to read]

danfaulknor

974 posts

Ultimate Geek
+1 received by user: 533

Trusted

Prodigi

Subscriber

#2674051 14-Mar-2021 02:14

c0ld:
sorceror:

yes if you're building new or complex APNs, but i would be very surprised if 2degrees don't already have an APN created that could just deliver a static public IP address to a subscriber.

not that it matters anyway, they still aren't going to offer it to joe public.

They told me they don't, even as a business customer (I asked that very question ref if they have an existing APN designed for that purpose). This was very recent. They also said they're not aware of it being on any current roadmap. My guess is it's a request they get asked less than you'd expect.

We can do small scale static IPv4/IPv6 (though v6 is untested presently) over 3G/4G for $not-much on the monthly subscription, but data is very expensive on private APN products and from our shopping around 2degrees (who we are using) are the cheapest by quite a lot.

they/them

Prodigi - Optimised IT Solutions
WebOps/DevOps, Managed IT, Hosting and Internet/WAN.

1 | ... | 27 | 28 | 29 | 30 | 31 | 32