Behind Carrier Group NAT?

Hi all,

I'm looking to set up a local server, but came across the term Carrier Group NAT, which may make it impossible to do.

I have a home fibre broadband connection.

Does anyone know how I can find out if I am behind a Carrier Group NAT?

Thanks

Jim

Which provider?

Running a consumer service across CGNat is not great, as may cause issues with some services.

Why do you think you are behind a GGNat, rather than just the usual NAT that the router in your home is running, and the way to resolve NAT is to use port forwarding in the router.

I'm having issues with connectivity.

With SSE who use Daisy Communications.

Connectivity to and from what?

Have you created the hole in the local router NAT (port forwarding) so the 'server' is visible from the Internet?

Sorry, yes, I am setting up a local FTP server on Windows 10 . I have configured the firewall and router to forward the port, but unable to connect to the server through the public IP.

There are 5 IPv4 routes listed on the router (not sure what this means), so I got my public IP from a web tool.

Googling solutions raised the issue that if you're behind a NAT444/CGNAT then it is not possible to configure a local server because the port forwarding would need to be done on the ISPs network?

The public IP I have never changes, even when disconnecting, so I'm hoping it is a static IP?

It's been many years since I last set up a local server.

can you see the server locally ?

If you are on a PC on your local LAN and trying ftp <YOUR PUBLIC IP> then this won't work because NAT loopback is probably not present on your router.

To test if the FTP server is running you first do fttp <ITS LAN IP ADDRESS> if that works and then you've set up the forwarding correctly then you need to use a device NOT on your own network to see if it connect.

So nothing to do with CGNAT

In reply to a post by jimasap:

I'm looking to set up a local server, but came across the term Carrier Group NAT, which may make it impossible to do.

I have a home fibre broadband connection.

Does anyone know how I can find out if I am behind a Carrier Group NAT?

Carrier *grade* NAT just means a honking big NAT box at your ISP. It's unusual for wired ISPs in the UK, but you may see it if you are on a small or new provider. It's very common for mobile.

The way to find out is to go to your router's management interface and see what IP address it has been assigned on its WAN interface. Then go to a site like whatsmyip.org which tells you what IP address it sees your incoming connection coming from. If they are the same, then you are not behind a CGN. If they are different, then you are.

If you are behind CGN, then your WAN address will have picked up some sort of private address, which the CGN NATs to a public address. In this context, "private" does include the well-known RFC1918 ranges (192.168.x.x, 172.16-31.x.x, 10.x.x.x) but there is also a block specially reserved for CGN (100.64-127.x.x). And occasionally I've seen networks just take random bits of public IP address space and treat it as if it were private.

Sadly not going to be unusual for long - with Virgin announcing they'll be going to IPV6 using DS-Lite, so native IPV6 and CGNAT for IPV4

Is your server down steam of a domestic router using NAT? If so getting FTP to work from outside your home network is difficult. Google for 'ftp Nat'.

FTP uses one TCP connection for control (such as login, changing directory, selecting the file to transfer), and another TCP connection for transferring data (including directory listings).

So there are two issues here.

1. If you cannot even establish the control connection, then there's a problem with forwarding of the ftp control port (21). This is where the CGN is one possible problem, of many.

2. If you are able to login to the FTP server, but not get a file listing, then the control port is OK but the data ports are not. It then gets more complicated because FTP has two modes, 'active' and 'passive'. 'Passive' is what you want here. The FTP server will allocate a second port from a range, and then wait for another incoming connection from the client.

You will need to configure your FTP server to use a fixed range of data ports (let's say 10000-10999) and also configure your router to port-forward all those ports. Or some routers have a concept of a "DMZ host" which forwards *all* ports to that host.

Given the complexities of FTP, it would be better if you could run an SFTP server instead of an FTP server. With SFTP you only need to forward one port (22). Plus, SFTP is encrypted so people can't sniff your password.

When choosing software, beware: SFTP is not the same as FTPS. FTPS is just normal FTP over SSL, so has the same port problems as normal FTP.

I never touch Windows, so I'm afraid I can't recommend SFTP software for Windows.

In reply to a post by jimasap:

Sorry, yes, I am setting up a local FTP server on Windows 10 . I have configured the firewall and router to forward the port, but unable to connect to the server through the public IP.

There are 5 IPv4 routes listed on the router (not sure what this means), so I got my public IP from a web tool.

Googling solutions raised the issue that if you're behind a NAT444/CGNAT then it is not possible to configure a local server because the port forwarding would need to be done on the ISPs network?

The public IP I have never changes, even when disconnecting, so I'm hoping it is a static IP?

It's been many years since I last set up a local server.

FTP is an old, antiquated protocol that struggles with NAT, and you will be using NAT on your router even without CGNAT.

To be honest, rather than trying to diagnose this, I would consider using SCP or SFTP (which is FTP over an SSH tunnel).

Both are much much much simpler and more reliable to make work.

https://www.solarwinds.com/free-tools/free-sftp-server

Edited by nemeth782 (Mon 19-Mar-18 12:09:49)

In reply to a post by philjohn:

Sadly not going to be unusual for long - with Virgin announcing they'll be going to IPV6 using DS-Lite, so native IPV6 and CGNAT for IPV4

That's the rumour. If they do I will terminate. Fast speeds are not as great when you don't have a proper connection.