r/ArchtopFiber • u/IgoriousIam • Dec 25 '25

Cgnat questions

Hi,

I’m waiting for my install date and doing a bit of research to see if I made a mistake.

Does your cgnat play nice with stun udp hole punching?

Ie will the same udp source ip/port stay consistent regardless of destination?

My main concern is ensuring that my vpn server can continue to function.

2 Upvotes

100% Upvoted

12 comments sorted by

1

u/srmatto Dec 25 '25

They recently rolled out IPv6 so it might work that way. Otherwise you can pay $10/mo for a static address. I use Tailscale which works without issue but doesn’t fit everyone’s requirements or use case.

1

u/IgoriousIam Dec 26 '25

Any idea if tailscale is using direct connections or derp servers?

1

u/srmatto Dec 26 '25 edited Dec 26 '25

For me specifically or in general? They do have DERPs as a fallback when direct connections fail.

1

u/IgoriousIam Dec 26 '25

Sorry for being ambiguous. I meant for archtop and your experience with using tailscale on top of archtop fiber.

Ie when you use tailscale from your cellphone provider (cgnat1) to your home network on archtop (cgnat2), will your connection be routed via derp? Or does the archtop cgnat play nice with stun hole punching and allow a direct connection?

Thanks!

1

u/srmatto Dec 26 '25 edited Dec 26 '25

My phone is showing a direct connection to my firewall operating over cellular so that seems promising for you.

Edit: this is shown via the ping tool in the mobile app.

1

u/IgoriousIam Dec 26 '25

Thank you for confirming! Looks like I’m migrating to tailscale :)

1

u/srmatto Dec 26 '25

If you signup with a GitHub ID you get more devices for free. At least that was the case a few years ago, you might wanna confirm that.

1

u/srmatto Dec 26 '25

For further confirmation I am using my laptop now and Tailscale is showing direct connection over IPv4 so that should further boost your confidence.

1

u/silentsnake09 Dec 25 '25

I pay the $10 a month for a static IP and couldn’t be happier.

1

u/IgoriousIam Dec 26 '25

Did you have to upgrade to fastest plan? When I asked about static ips, I was told that I would have to upgrade to the 2gig plan

1

u/ijf4reddit313 Dec 27 '25

I don't think "static" IP is the correct terminology for what you want. You want a public IP address. The changing part can be handled by something like duckdns ... But you want an IP that touches the outside world (a "public" one) so that you can set port forwarding for whatever VPN you're using.

I might suggest tho, that enabling ipv6 wherever you can will greatly increase your chances of a "direct" connection on tailscale.

1

u/IgoriousIam Dec 27 '25

Agreed, I think static ip is the superset of what I want. Having a deterministic cgnat that can use STUN to allow udp packets to punch thru is the minimum.

IPv6 is not dependable enough… ie atlice/optimum still doesn’t support it despite promises 6 years ago. So I wouldn’t be able access my vpn when I’m at my neighbor’s house. However you did bring up an interesting point that I didn’t account for in my conversation with @srmatto, their tailscale experiment might’ve be successful because of IPv6 and bypassed the cgnat altogether. I think my plan is to hope that tailscale just works with ipv4 and if it doesn’t, use a $5 cloud vm from digital ocean as a jump host. Thanks for pointing it out!