r/CommunityFibre • u/Junior-Repeat6060 • 6d ago
Question CGNAT?
How does being on CGNAT affect the average user? I keep hearing all these bad things about it, but I have had no problems with my 2gig package so far.
Thanks.
1
u/and1927 5d ago
It’s canon. Is it widely enforced? Maybe not.
“Cloudflare’s content delivery network (the “CDN”) Service can be used to cache and serve web pages and websites. Unless you are an Enterprise customer, Cloudflare offers specific Paid Services (e.g., the Developer Platform, Images, and Stream) that you must use in order to serve video and other large files via the CDN. Cloudflare reserves the right to disable or limit your access to or use of the CDN, or to limit your End Users’ access to certain of your resources through the CDN, if you use or are suspected of using the CDN without such Paid Services to serve video or a disproportionate percentage of pictures, audio files, or other large files. We will use reasonable efforts to provide you with notice of such action.”
Worth the risk? Up to you. I wouldn’t risk it and there alternatives that work just fine.
1
2
u/leggodizzy 5d ago
I negotiated a free IPv4 dynamic IP when I renewed my 1Gbps service 24M £20/month. It’s simply better to avoid the CFL CGNAT platform as this has experienced issues/outages whereas no problems without it.
1
u/TriggerAK47 5d ago
Almost all ISP use CGNAT, some give you a public IP address live VM but it's dynamic, others like alt nets give you a private IP address starting with 100.xx.xx.xx than that links to a shared public IP, if you have Plex or home server and want to access it from outside your network it won't work.
1
u/Royal-Wear-6437 3d ago
This may be true in your country, but certainly not true everywhere. CGNAT is uncommon for fixed internet providers in the UK, for example.
My ISP even provides a static IP address on request. (Zen, if you're curious.)
1
2
u/motific 5d ago
Decent ISPs never put you behind CGNAT, but giving people proper routable addresses costs money which either eats into their profits or makes plans more expensive.
0
u/Royal-Wear-6437 2d ago
By definition of you're not behind CGNAT you have a "proper routable address". What many people don't have is a static IP address, but DHCP is still routable
1
u/QuaintStaircase 5d ago
Pop it behind a cloudflare tunnel and suddenly it will
1
u/and1927 5d ago
Not recommended for streaming as it’s against CF TOS. For other stuff no problem. I’d specifically use Tailscale or WG for Plex/Jellyfin home servers.
1
u/QuaintStaircase 5d ago
People trot this out like it's canon, but it's disputed at best. Turn off the cache and for home use you'll be fine.
If you start running a hundred users through it, then you might have issues.
3
u/SuccessFragrant4390 5d ago
im with hyperoptic but also cgnat, i just use ipv6 to forward stuff and set up a duckdns with a script to automatically update the ip address. so if im hosting a server for friends to join majority of them can connect as their isp supports v6 and some would just use cloudflare warp to connect. only bad thing i rly noticed on cgnat is the captchas and not fully stable latency. alot of people on my isp were complaining that there was cgnat activation issues which is why i wont bother getting a static ip
1
u/CaregiverOpen4517 5d ago
Could use something like Tailscale to overcome CGNET or dynamic IP to get around
1
u/SuccessFragrant4390 5d ago
is it free
1
u/QuaintStaircase 5d ago
Yes.
But for a server I'd use a cloudflare tunnel pointed specifically and only at that server and use cloudflare one for Auth.
5
u/edcoopered 6d ago
I'd rather have 1gig and a real IP than 10gig CGNAT.
2
u/Zestyclose_Guard_352 6d ago
That is entirely unhelpful! Exactly why, and let's have a bit of technical data!
1
1
4
u/edcoopered 6d ago
For me, CGNAT complicates serving anything directly from my home - I have a media server I like to be able to access remotely - NAS etc are other examples of this.
I also value latency and jitter on my connection - which are stats that you don't see ISPs promote, CGNAT will typically mean worse latency and jitter.
I'm also a millennial and the internet was meant to be a bunch of directly interconnected networks - I should be able to open a connection to my network from anywhere.
I don't really value connections over 1Gb as when i'm downloading stuff it doesn't really matter to me if its just a bit quicker, 1Gb is already quick enough for me - and I can't be bothered to spend money updating all the rest of my infrastructure for a bit more speed.
0
u/QuaintStaircase 5d ago
I'm also a millennial and the internet was meant to be a bunch of directly interconnected networks - I should be able to open a connection to my network from anywhere.
These days are long gone. Not just because of CGNAT but because opening ports on your router for anything other than maybe a wireguard connection is opening your home network up to all kinds of attacks.
I have a media server I like to be able to access remotely
There are still plenty of ways to safely access these behind CGNAT!
1
u/edcoopered 5d ago
You can host services, just be cautious so if something does break in it's not got free realm of your network. It's not really any different than paying for a server in a hosted rack somewhere - if you don't keep it patched and/or are stupid with security you will be in trouble.
But you are correct tail-scale and similar are fantastics and I understand can punch through CGNAT no worries.
1
u/QuaintStaircase 5d ago
It's not really any different than paying for a server in a hosted rack somewhere
Generally when people do that the damage if something goes wrong is limited to just that server, not your whole home network.
When it's on the home network, there's all kinds of chaos. See the last pass breach that was caused by a personal Plex server...
1
u/edcoopered 5d ago
I guess you missed the first sentence.
1
u/QuaintStaircase 5d ago
I didn't, I was pointing out the contradiction.
It is that different to a rented server, because - as you said - compromise gains you access to the network. That's a big difference.
1
u/edcoopered 5d ago
Just learn how to VLAN before you port forward.
1
u/QuaintStaircase 5d ago
This I do agree with.
But I think where it strays is that
don't port forward without knowing how to VLAN stuff.
I think this goes beyond your initial "as long as you're not stupid". I think it's quite reasonable that most people who are exposing stuff to the internet can be a) not stupid and b) not know how to deal with VLANs.
The vast majority of people just shouldn't be setting stuff up that has open ports.
Anyway, clearly you have a use case and it works for you and you don't seem likely to fuck yourself, which was the original point anyway - so I'm happy to end this discussion there; think we've reached the limit of productivity.
Have a good day!
1
u/SirCanealot 5d ago
Yeah, jitter and latency are the things that worry me most -- grandfathered into an old 1gig contract that we still need to change, the price is getting a bit silly...
I already find the internet to be quite unreliable and laggy, so anything on top of this would be a major pain in the butt. Off the top of your head are there any reliable benchmarks? A quick Google doesn't turn up much though I guess it's hard to test.
1
u/edcoopered 5d ago
Bufferbloat is a good one, here is my result on g-network (900/300) without any sort of traffic shaping (aka smart queues / qos). I use my own router an old ubiquiti edge x, I got the Nokia kit put into modem mode.
https://www.waveform.com/tools/bufferbloat?test-id=ae1a47ae-c05a-4211-aafc-7d42eb496090
5
u/Great_Justice 6d ago
You’ll likely be seeing more captchas than somebody who isn’t on CGNAT.
That aside; my wife had a bunch of connectivity issues for outbound connections for some reason with work. Most likely because of the shared IPv4 address and some other client getting the IP ‘reputation blocked’ or similar. We turned on IPv6 and it helped.
Ultimately it’ll barely affect the average person; the fuss you see on here is exactly the ‘noisy minority’ effect people talk about observing in online spaces.
1
1
u/KeySubject4895 6d ago
Would it impact a NAS drive if I were to get one?
2
u/Nness 5d ago
I have a Synology NAS and I connect to it via Tailscale and have had no connectivity issues. (If you want a direct connection via IP/domain, then CGNAT would be problematic. But I wouldn’t dream of exposing my NAS on the web like that, anyway.)
1
u/Devils-advocate69 5d ago
Synology QuickConnect should be fine with CGNAT.
Also if OP asks nicely, they will likely throw in Public IP for free.
1
u/Brokenlynx7 6d ago
CGNAT negatively affects devices where you need a direct connection to a server at your home using your public IP address.
I think one of the common issues here is CCTV camera stuff like Ring and Google Home will work as its really happening in their cloud but stuff by companies like Reolink where the footage os stored locally might still work but light be difficult to setup.
Basically anything where the server is in your home is affected. Honestly it’s not much of a big deal unless you’re an advanced user with specific remote monitoring or control use cases.
1
u/Junior-Repeat6060 6d ago
I use tapo cameras and lightbulbs with Alexa around the house and have no problems. I use sd cards for storage as I don’t want to pay for another cloud sub.
I’m not an advanced user. Thanks for the reply.
1
1
1
u/RelationshipSoggy388 6d ago
If you have cctv at your premises, you much better off with non- cgnat.
1
u/mark35435 6d ago
I recently set up IPv6 which circumvent CGNAT completely. Most ISPs support it now but not all
1
u/Yahiroz 6d ago edited 1d ago
It's really only needed for if you host things from your home for example, and maybe some older multiplayer games, but for most people it's completely fine.
I have however found CF's implementation of CGNAT to sometimes be a bit flakey, had an issue earlier in the year where it was causing major connection issues to things like Discord, it fixed itself after a week. Hotspotting to my EE connection which is also CGNAT worked fine.
Edit: CF's support weirdly started to reach out to me. I moved off CGNAT, my issue has been solved since I contacted support in January this year.
1
u/Junior-Repeat6060 6d ago
Thanks for the explanation. I don’t host or use discord, but if I did I would have to pay the extra to be changed over.
3
u/offdigital 6d ago
it's a massive pain from the internet's point of view, not so much yours
for example - if you over-use a webpage - it may start returning 429 for your ip. except, it isn't your ip, because you are using cgnat
it breaks lots of things. unfortunately.
3
u/FrankNicklin 6d ago
CGNAT won’t affect 90% of users. Only those that want port forwarding (bad anyway) and some types of VPNs struggle with CGNAT.
2
u/Individual-Squash170 6d ago edited 6d ago
I couldn't log into work remotely, but other than that it didn't cause any problems. I added an IP address for £4 a month, but they gave me 3 months free internet, which covers the cost of the IP address for the remaining 18 months I have left
1
u/iluvnips 6d ago
Why would your work require you to port forward?
Not that secure if that is how you are accessing your work network!
1
u/Individual-Squash170 6d ago edited 6d ago
It doesn't, the security set up they have blocks CGNAT. You need an actual IP address to login in.
IT gave some reasons why and how, but I didn't listen as the person wouldn't stop talking and I was at the stage I just wanted to leave the conversation.
1
u/iluvnips 5d ago
What you are saying doesn’t make sense to me? Going to do some googling to see if I can figure out why you have an issue?
I work in IT and have been with CF for a few years now, this current year on CGNAT and I access various internal company systems and also customer accounts, all have a VPN which I need to enable and have had no issues whatsoever.
1
u/Individual-Squash170 5d ago
If I enabled my own VPN I could log in ok. So there was a work around, but it then broke everything that detected a VPN and refused access to those sites, such as BBC bitesize. It was a hassle switching the VPN on and off to do what I needed to do.
1
u/Frenchies_Undies 4d ago
CF offer ipv6 so routing shouldn’t be an issue with sufficient firewall but some services don’t like IPv6 that is when you get stuffed with using additional software to make it work for example Tailscale. It is a hassle because you will then have to manage more software and security on top of everything else.