So I was looking into getting port forwarding set up and I realized just how closed-off the internet has gotten since the early days. It’s concerning. It used to be you would buy your own router and connect it to the internet, and that router would control port-forwarding and what-have-you.

Now, your ISP provides your router, which runs their firmware, which (in my case) doesn’t even have the option to enable port forwarding.

It gets worse - because ISPs are choosing NATs over IPv6, so even if you install a custom firmware on your router without it getting blacklisted by your ISP, you still can’t expose your server to the internet because the NAT refuses to forward traffic your way. They even devise special NAT schemes like symmetric NAT to thwart hole punching.

Basically this all means that I have to purchase my web hosting separately. Or relay all the traffic through an unnecessary third party, introducing a point of failure.

It’s frustrating.

I like to control my stuff. I don’t like to depend on other people or be in a position where I have to trust someone not to fuck with my shit. Like, if the only thing outside my apartment that mattered to my website was a DNS record, I’d be really happy with that.

Edit: TIL ISPs in the US don’t have NATs

Edit 2: OMG so much advice. My knowledge about computers is SO clearly outdated, I have a lot of things to read up on.

Edit 3: There’s definitely a CGNAT involved since the WAN ip in the router config is not the same as the one I get when I use a website that echos my IP address. Far as I can tell my devices don’t get unique IPv6 addresses either. (funnily enough, if I check my IP address on my phone using roaming data, there’s no IPv6 address at all). It’s a router/modem combo, at least I think since there’s only one device in my apartment (maybe there’s a modem managing the whole complex or something?). And it doesn’t have a bridge mode, except for OTT. Might try plugging my own router into it, but it feels like a waste of time and money from what I’m seeing. Probably best to just host services over a VPN or smth.

Edit 4: Devices do get unique IPv6 addresses, but it’s moot since I can’t do anything but ping them. I guess it wouldn’t be port forwarding but something else that I would have to do that my router doesn’t support

  • Rognaut@lemmy.world
    link
    fedilink
    English
    arrow-up
    163
    ·
    11 months ago

    In the US and I use my own personal modem and router. Renting their equipment is optional.

    • NateNate60@lemmy.world
      link
      fedilink
      English
      arrow-up
      41
      ·
      11 months ago

      Same here. I get $10 off for using my own router. That’s $120 off per year. A cheap router bought from a supermarket cost me $60. It works fine, the signal quality is only okay but my flat’s pretty small anyway. Getting your own router is just a financially sensible option.

      • BloodSlut@lemmy.world
        link
        fedilink
        English
        arrow-up
        5
        ·
        11 months ago

        buying my own upper-midrange router still cost me less than renting from the ISP over a three year period

    • TunaLobster@lemmy.world
      link
      fedilink
      English
      arrow-up
      19
      arrow-down
      3
      ·
      11 months ago

      Not really with ATT fiber anymore. The fiber goes straight into their router to authenticate. There is no option for me to purchase an equivalent piece of equipment. I am forced to pay to use their equipment. Fuck ATT.

    • PHLAK@lemmy.world
      link
      fedilink
      English
      arrow-up
      12
      arrow-down
      1
      ·
      11 months ago

      Yeah, as soon as I read the second paragraph my thought was “buy your own router”. Problem solved.

    • BobGnarley@lemm.ee
      link
      fedilink
      English
      arrow-up
      2
      ·
      11 months ago

      Not for Spectrum it isnt, unfortunately. You can use your own router but you have to use their modem

    • dsemy@lemm.ee
      link
      fedilink
      English
      arrow-up
      3
      arrow-down
      1
      ·
      11 months ago

      Can you recommend a good router that isn’t extremely expensive?

      I did some research about a year ago and started using a router recommended by both random users and reviewers (TP-Link Archer AX-3000 I think) only to quickly find out it had a bad QoS implementation which broke applications sending IP packets with certain DSCP values (SSH by default, Mumble, VoWiFi on an iPhone, WhatsApp calls) so I switched back to an ISP provided router unfortunately. When I talked to TP-Link support they sent me firmware which would have allowed them to connect to my router using telent (absolutely insane IMO, especially since other users also complained about this issue).

      Further research showed that many consumer-level routers have these kinds of issues, so I’m reluctant to try this again.

  • slazer2au@lemmy.world
    link
    fedilink
    English
    arrow-up
    94
    ·
    11 months ago

    Yes CGNAT is used quite a lot, but consider 95% of customers don’t care what their public address is and that “saves” the carrier address space.

    We are the 5% that do care and if you call your ISP they likely have an option to exclude you from cgn and get an actual public IP.

    • Rambomst@lemmy.world
      link
      fedilink
      English
      arrow-up
      39
      ·
      11 months ago

      This. I have been with multiple ISPs that use CGNAT and all had a solution to allow you to self host, just need to contact them.

    • Kawawete@reddeet.com
      link
      fedilink
      English
      arrow-up
      8
      ·
      11 months ago

      In France, with Free, you can get a real “full stack” IPv4 for free which is cool, I even cancelled my NO-IP subscription.

    • ⲇⲅⲇ@lemmy.ml
      link
      fedilink
      English
      arrow-up
      8
      arrow-down
      4
      ·
      11 months ago

      I am into tech/programming/devops, I make my own servers, but I would still prefer to be under CGNAT as I feel more safe. I wouldn’t open any port or tunnel to my local home network, I wouldn’t feel that safe. So for me, a CGNAT is perfect.

      • MigratingtoLemmy@lemmy.world
        link
        fedilink
        English
        arrow-up
        9
        ·
        11 months ago

        Yup. I’ll open a port in a cheap VPS and tunnel my traffic over that rather than directly open ports on my router. If people here can trust Cloudflare they can use their tunnels too

        • ⲇⲅⲇ@lemmy.ml
          link
          fedilink
          English
          arrow-up
          1
          ·
          11 months ago

          Yeah, I would do that before exposing my router to public and opening ports, but for the tunnel I would use something like WireGuard into a virtual network at my home just to improve security. I’m not a fan of Cloudflare.

          • MigratingtoLemmy@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            ·
            11 months ago

            Whatever works. I prefer OpenVPN/Softether for their SSL VPN implementations, and am too lazy to be arsed to deal with stunnel and Wireguard. But if you’re not as paranoid then Wireguard works perfectly fine

      • CriticalMiss@lemmy.world
        link
        fedilink
        English
        arrow-up
        7
        ·
        11 months ago

        This is a friendly reminder that NAT is not a firewall and should not be treated as such.

        Thank you.

        • ⲇⲅⲇ@lemmy.ml
          link
          fedilink
          English
          arrow-up
          1
          ·
          11 months ago

          Why are you saying that? I know it’s not a firewall, I’m just saying it doesn’t expose your router directly to internet, most of the routers also have firewall, and you can DMZ or port forward that you normally turn them on once you expose your router to public so bots or people can make direct requests to your router.

      • slazer2au@lemmy.world
        link
        fedilink
        English
        arrow-up
        4
        ·
        11 months ago

        And there is nothing wrong with that. Both systems work for different people. I am on the I like a public address on my place camp, but I have worked where we did cgn for an apartment building and out of the 150 residences none asked for a public address. Saving us a /25 which we could sell to business customers for $5/m per /29

      • FMT99@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        ·
        11 months ago

        I have ports open (to receive backups from my other servers) but only to connections from specific ip addresses and only port 22 using a pub key (no password) I’d be hesitant to open port 80 to the public though.

        Then again I’ve run a small public web server for well over a decade and never had any issues with hackers.

        • ⲇⲅⲇ@lemmy.ml
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          2
          ·
          edit-2
          11 months ago

          I’ve run a small public web server for well over a decade and never had any issues with hackers.

          It’s never late to get hacked or an attack or a problem with your ISP router firmware. I don’t think that’s an excuse.

          receive backups from my other servers

          You can simply do cronjob and scp user@server:/path/to/backup . to get things from server to your local network, I don’t see the need to expose your router to the public. For a web server, there are cheap VPS providers for less than 5 dollars a month, and you save up energy, hardware, and improve safety at home.

          • lud@lemm.ee
            link
            fedilink
            English
            arrow-up
            1
            ·
            11 months ago

            Why use your ISPs router then? Just buy your own.

            And a webserver is probably the safest thing to put online.

            You can also put the server in a DMZ and or use reverse proxy’s and a bunch of other stuff.

            • ⲇⲅⲇ@lemmy.ml
              link
              fedilink
              English
              arrow-up
              1
              ·
              11 months ago

              I already have my own router, even if a web server is safer, you are still exposing your IP which is what I don’t want to do. DMZ doesn’t solve anything, is just worse than setting up a port forward as you are opening all the ports to the server at home, your server at home has access to all your network so once infected by any 0-day exploit, you are fucked up.

              I just hire online servers and I have my own Ansible playbooks to manage those servers, this way I don’t provide my real IP (my home) to anyone.

              • lud@lemm.ee
                link
                fedilink
                English
                arrow-up
                1
                ·
                edit-2
                11 months ago

                as you are opening all the ports to the server at home, your server at home has access to all your network so once infected by any 0-day exploit, you are fucked up.

                No, the entire point of a DMZ is to insulate a device from the rest of the network and you can (should) configure which ports that are forwarded to the DMZ, don’t just forward everything. You can (should) also configure a bunch of other normal firewall rules for the DMZ.

                Personally I don’t consider “exposing” your home IP to be a big deal. It’s just an IP.

                • ⲇⲅⲇ@lemmy.ml
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  edit-2
                  11 months ago

                  https://en.wikipedia.org/wiki/DMZ_(computing)#DMZ_host -> By definition, this is not a true DMZ (demilitarized zone), since the router alone does not separate the host from the internal network.


                  Home routers aren’t firewalls or something similar, they have some minimal logic that can act like a firewall, but they aren’t. There is no need to expose your IP, there are many alternatives to do stuff without exposing it.

  • heyitsmikey128@lemmy.world
    link
    fedilink
    English
    arrow-up
    48
    ·
    11 months ago

    What ISP do you have and what country are you in? I have Comcast in the US and do not have this issue even though they are a big and shitty ISP (I even use their modem, but I do have my own router which I HIGHLY suggest).

    • ChuckEffingNorris@lemmy.ml
      link
      fedilink
      English
      arrow-up
      18
      ·
      11 months ago

      The older and shittier the ISP the more blocks of IPV4 addresses they have. They have blocks from when they were given out willy nilly.

      New ISPs, the ones that compete and bring the prices down have to buy addresses and that costs money and is a cost bigger and older ISPs do not have.

      This is a case for regulation - either mandating a move to V6 or mandating the release of stockpiled v4 addresses. ISPs will not do that on their own, the addresses can currently be sold for lots of money.

    • redcalcium@lemmy.institute
      link
      fedilink
      English
      arrow-up
      17
      ·
      11 months ago

      The US and other western countries don’t really feel the pressure of IPv4 scarcity yet. ISPs in other countries typically uses CGNAT or IPv6. Some even give you a routable IPv4 but may randomly replaced it with an ip behind their CGNAT when the lease is expired, giving you false sense of hope.

      • NateNate60@lemmy.world
        link
        fedilink
        English
        arrow-up
        8
        ·
        11 months ago

        IPv4 address depletion isn’t really the ISP’s fault. It’s a shitty solution to a shitty situation, to be sure, but it’s either that or employing rationing strategies to stretch the remaining supply of IPv4 addresses.

          • Chreutz@lemmy.world
            link
            fedilink
            English
            arrow-up
            10
            ·
            11 months ago

            Many ISPs in Denmark actually charge you 30-40 DKK (4-7 USD) extra for the ‘luxury’ of IPv6, which is the same that they charge for publicly routable IPv4 (of course). I found that quite infuriating, so I searched around and found one that had public IPv4 and IPv6 included in the price. A little more expensive all in all, but I just hated the concept of IPv6 being an “extra” in 2023.

  • nutsack@lemmy.world
    link
    fedilink
    English
    arrow-up
    48
    arrow-down
    1
    ·
    edit-2
    11 months ago

    i repeatedly petitioned our landlord (once a year) to allow an alternative isp to hook up to the building, and he eventually was so pissed from my requests that he threatened to press charges against me personally if the electrical box were ever opened

    • henfredemars@infosec.pub
      link
      fedilink
      English
      arrow-up
      46
      arrow-down
      2
      ·
      11 months ago

      Ouch. You know some landlords get kickbacks for exclusivity? It’s pretty corrupt where I live.

    • theblueredditrefugee@lemmy.dbzer0.comOP
      link
      fedilink
      English
      arrow-up
      26
      arrow-down
      2
      ·
      11 months ago

      My internet is included in rent. Which is convenient for day-to-day use but gives me less capacity for customization. Like, I admit it, the system works really well for normal people, I’m just a weirdo who likes tinkering with technology, hosting websites, and whatnot

      • ∟⊔⊤∦∣≶@lemmy.nz
        link
        fedilink
        English
        arrow-up
        51
        arrow-down
        5
        ·
        11 months ago

        “My food is included in rent. Which is convenient for day-to-day eating but gives me less capacity for cooking my own meals. Like, I admit it, the system works really well for normal people, I’m just a weirdo who likes tinkering with recipes, hosting dinner parties, and whatnot”

        There, I highlighted the absurdity even more for you. You’re not a wierdo, you’re a tech-chef.

        • theblueredditrefugee@lemmy.dbzer0.comOP
          link
          fedilink
          English
          arrow-up
          22
          arrow-down
          1
          ·
          11 months ago

          lmao I like this.

          Honestly I feel like people should have a better understanding of how their technology works. Like if we just all lived in a post-scarcity society where all code was available on github and any time a program stops working for you you can just go in, fork the repo, make the change that fixes your problem. Blammo, your problem is solved as soon as you can write the code, and if anyone else has the problem they can use your change.

          One can dream

            • UnRelatedBurner@sh.itjust.works
              link
              fedilink
              English
              arrow-up
              3
              ·
              11 months ago

              using more salt, or leaving out ingredients that one’s allergic to isn’t as hard as learning c++, understanding the codebase, knowing the external packages used, knowing your specific problem, knowing where to fix it, knowing how to fix it.

      • nutsack@lemmy.world
        link
        fedilink
        English
        arrow-up
        4
        ·
        11 months ago

        i threatened to do this in my petitions, as my calls with work were dropping due to jitter

  • mateomaui@reddthat.com
    link
    fedilink
    English
    arrow-up
    33
    arrow-down
    1
    ·
    11 months ago

    I bought my own cable modem and router for less than what my ISP would charge to rent them to me. They control nothing on my end.