So I was looking into getting port forwarding set up and I realized just how closed-off the internet has gotten since the early days. It's concerning. It used to be you would buy your own router and connect it to the internet, and that router would control port-forwarding and what-have-you.
Now, your ISP provides your router, which runs their firmware, which (in my case) doesn't even have the option to enable port forwarding.
It gets worse - because ISPs are choosing NATs over IPv6, so even if you install a custom firmware on your router without it getting blacklisted by your ISP, you still can't expose your server to the internet because the NAT refuses to forward traffic your way. They even devise special NAT schemes like symmetric NAT to thwart hole punching.
Basically this all means that I have to purchase my web hosting separately. Or relay all the traffic through an unnecessary third party, introducing a point of failure.
It's frustrating.
I like to control my stuff. I don't like to depend on other people or be in a position where I have to trust someone not to fuck with my shit. Like, if the only thing outside my apartment that mattered to my website was a DNS record, I'd be really happy with that.
Edit: TIL ISPs in the US don't have NATs
Edit 2: OMG so much advice. My knowledge about computers is SO clearly outdated, I have a lot of things to read up on.
Edit 3: There's definitely a CGNAT involved since the WAN ip in the router config is not the same as the one I get when I use a website that echos my IP address. Far as I can tell my devices don't get unique IPv6 addresses either. (funnily enough, if I check my IP address on my phone using roaming data, there's no IPv6 address at all). It's a router/modem combo, at least I think since there's only one device in my apartment (maybe there's a modem managing the whole complex or something?). And it doesn't have a bridge mode, except for OTT. Might try plugging my own router into it, but it feels like a waste of time and money from what I'm seeing. Probably best to just host services over a VPN or smth.
Edit 4: Devices do get unique IPv6 addresses, but it's moot since I can't do anything but ping them. I guess it wouldn't be port forwarding but something else that I would have to do that my router doesn't support
Apologies if you've answered this elsewhere but I'm assuming there's a reason you haven't bought your own router?
why not bridge the router and use your own?
the router doesn't have one?
which ISP is it?
No matter how much you think you know, there's always something everyone knows that you've never heard of...
That said, if bridge mode is something that you can enable in the config (going to 192.168.0.1 in web browser and all that) then it's not possible.
It's through China Mobile
You could get an ONU like this
https://www.aliexpress.us/item/3256804134894710.html
Use it to clone every bit of authentication from ur current ONU to it, the realtek chip in it is very customizable.
https://github.com/Anime4000/RTL960x
https://hack-gpon.org/
I'm honestly amazed the internet isn't locked down even more for you then. I was under the impression that the Golden firewall would be complemented with strict local network rules
sounds like his router is locked down, and even then, if the isp puts him behind nat, there isnt much he can do on his side even if he could theoretically forward those ports.
yes, cgnat is very common in many countries due to IPv4 shortage, bypassing the ISP Router and using your own along with a self hosted VPN Server (for China, Hong Kong or Tokyo works great) is the best choice.
On the flip side, direct open ports to your home network isn't really a great idea anyway.
At one time it wasn't as bad, but today I'd be hesitant because of the number and capability of bad actors and I'm not a network security expert (though I have a lot of training in networks, just shy of that kind of expertise).
In a way, these restrictions have promoted the use of even more secure approaches, like using Cloudflare tunnels, VPS's with VPN connections to your network, or things like Wireguard/Tailscale, which provide a virtual (encrypted) network layered on top of the public (untrusted) network.
All of these can provide an externally controlled (secured and encrypted) access to specific resources within your own network. As mentioned, VPS with VPN, Cloudflare tunnels, or Tailscale Funnel or Share.
Is your service fiber? Is your router a combined ONT and router? If its not and you have an ONT serving ethernet to the router, you can just plug your own router in.
You said it's through china mobile so is it a cell modem/router?
Just checked, it looks like it's fiber. Definitely has something plugged into the wall anyway - I'm kinda afraid of unplugging it and ruining my internet access.
Idk how it works in china, is the wire coming from the wall a thin sorta stiff wire? or is it a thicker wire(5-10mm across) that is bendy?
If the latter, you can just plug that ethernet cable into your own router.
If its a fiber cable then I dont know if you can have your own ONT.
Here in Germany I get a "real" (non-shared) IPv4 address and a /48 IPv6 subnet I think. With Telekom at least. Vodafone is another story. I think the user must be able to use their own router because of some EU law.
Can't switch ISPs? I'd tell them exactly why I'm switching.
In my country we just buy a router and ask the ISP to set the modem/router in bridge mode
