Public IP address and CG-NAT

[drbob]

I am now on Home Wireless Broadband where I am told port-forwarding does not work because of CG-NAT (Carrier-Grade NAT) which was designed to reduce the requirement for ISPs to have a large pool of public IP addresses to assign to customers.

Obviously whenever I go on the internet, there must be a mapping between the IP my PC is using on my internal network (eg 192.168.1.200) and the public IP I use to connect to an external host Does anyone know how this mapping works? I notice that whenever I do a speed test the speed test site displays the public IP address that I am using(120.20.n.m) and it would seem I am assigned this IP until the next reboot of the modem(I don't know yet whether there  is also a lease-time period).

Just curious.

[david64]

Hi @drbob . AussieBB have an article on how CG-NAT will affect its users.

https://www.aussiebroadband.com.au/help-centre/nbn/tech-support/cg-nat/

When an ip address is shown on the speed test, login to your router and see what ip address it has. I would expect it to be different. I would also expect the address shown on speed test to be different some time later. Use whatismyip.com to see what public address is used at that moment.

Don't know about mapping. Might be geographical. Or all 4G users are in one big DHCP pool. One ip address can support 65,000 source ports. Each browser tab on your computer is one source port.

For the other NBN technologies that get a dynamic public ip address, the address is fixed until some failure in the connection: blackout at home or router breaks, line failure, NBN network, etc. It could be unchanged for months. DDNS takes care of changeable addresses to access home networks. For 4G, there is no reason why the router's ip address should change inside the CG-NAT network.

[drbob]

Hi David,

Thanks for the link.

I have just checked: speed test site and whatismyip have the same ip 120.20.m.n. You are right, the Hub 2.0 has a different IP: 10.203.x,y. You are also correct about the IP shown by whatismyip: twice now I have observed that it has not changed through power-cycles, while on two previous power-cycles the IP did change. Next time the Hub is power-cycled I'll check if its IP address changes.

[david64]

@drbob . There are three common address ranges not routable through the internet and are used for private networks.

• Range from 10.0. 0.0 to 10.255. 255.255 — a 10.0. 0.0 network with a 255.0. ...
• Range from 172.16. 0.0 to 172.31. 255.255 — a 172.16. 0.0 network with a 255.240. ...
• A 192.168. 0.0 to 192.168. 255.255 range, which is a 192.168. ...
• A special range 100.64. 0.0 to 100.127. 255.255 with a 255.192.

You can do a     tracert www.tpg.com.au     see what devices your path goes through.

[drbob]

I am running Ubuntu 20.04(?) and it turns out that tracert is not supported but tracert6 is. However, traceroute can be installed and it works. However, I notice that the second hop does not go from the 10.203.98.27 that is assigned to the lte0 WAN interface - what am I missing?

traceroute to www.tpg.com.au (104.18.11.61), 30 hops max, 60 byte packets
1 NL1902.Home (192.168.1.1) 0.503 ms 0.864 ms 1.098 ms
2 10.252.61.38 (10.252.61.38) 182.795 ms 182.792 ms 182.891 ms
3 10.252.61.42 (10.252.61.42) 29.944 ms 10.252.61.33 (10.252.61.33) 31.818 ms 10.252.61.41 (10.252.61.41) 31.632 ms
4 10.246.228.254 (10.246.228.254) 29.628 ms 29.670 ms 29.717 ms
5 120.20.253.249 (120.20.253.249) 30.654 ms 120.20.253.250 (120.20.253.250) 30.710 ms 120.20.253.249 (120.20.253.249) 31.519 ms
6 10.247.152.118 (10.247.152.118) 43.616 ms 34.981 ms 34.904 ms
7 as13335.melbourne.megaport.com (103.26.71.38) 33.679 ms 34.811 ms 34.742 ms
8 www.tpg.com.au.cdn.cloudflare.net (104.18.11.61) 35.769 ms 43.807 ms 43.115 ms

[david64]

@drbob . Hop 2 should be the default gateway address shown in the router. It's where the router sends all packets which aren't being handled locally. This might change occasionally. From there on, it's just networking.

The lte0 interface is just the backside of the router's LAN address, so not a real destination. (Same on my FTTC connection.) You can try to ping all these addresses, then keep it all for future reference.

Your traceroute must record explicit routes along the way; multiple ips on hops 3 and 5.

[drbob]

The routing table in the Hub has 10.203.98.28 (not 10.203.98.38) as the default gateway; so, why 38 in the hop??

Destination	Gateway	Subnet Mask	Flag	Metric	Service	Interface
0.0.0.0	10.203.98.28	0.0.0.0	UG	0	3G/4G	lte0
10.203.98.24	0.0.0.0	255.255.255.248	U	0	3G/4G	lte0
120.19.253.253	10.203.98.28	255.255.255.255	UGH	64	3G/4G	lte0
120.19.253.254	10.203.98.28	255.255.255.255	UGH	64	3G/4G	lte0
192.168.1.0	0.0.0.0	255.255.255.0	U	0	br0	br0

[david64]

@drbob . Can't help. Not familiar with this. This from the internet on the routing table.

The first column shows the destination network, the second the router through which packets are forwarded. The U flag indicates that the route is up. The G flag indicates that the route is to a gateway. The H flag indicates that the destination is a fully qualified host address, rather than a network.

This looks interesting: https://www.thegeekstuff.com/2012/05/route-flags/

[drbob]

Thank you for your multiple posts. Although how everything fits together is still of a mystery, I have learnt something from this thread and corrected the misconception that the public IP revealed by whatismyip is assigned to my Hub whereas in fact it is very likely shared by multiple Hubs and upon receiving packets at the public IP, CG-NAT routes them to the correct Hub, just like the NAT in a router routes packets received at its public IP to the various devices connected to it.

Will it be fair to say then that having no public IP assigned to a Hub, the Hub is less vulnerable to being hacked by someone on the internet? It seems like unless one installs a trojan on one of the devices behind the Hub, there is no way for someone to hack the Hub or any device behind the hub?

[david64]

@drbob . A person would have to be tempted to a bad website so something could be returned in the html and infect the computer. Random probing from the internet could go to any target inconsistently. The firewalls into the 4G network should block any inbound connection requests that don't match an existing outbound request.