Hacker News Reader

Comment by TJSomething | Hacker News Reader

My problem is that I have never been able to purchase residential internet that allowed me to open port 443 or port 80.

You can setup a wireguard network then proxy pass from a cheapie VPS if that’s helpful. Probably only worth it if you have multiple services though.

Use Cloudflare. Or, rent the cheapest machine you can with a public IP and use something like Rathole. I like Cloudflare because it’s fast and free, but they do MITM you.

Can you set up Cloudflare as a blind pipe? Just forward the packets with rewritten return address

Cloudflared is what I believe they are referring to and it proxies HTTP/S, although maybe it can do more.

Why do ISPs do this? Is there a legitimate reason or they just feel that their clients don’t host these services so they might as well block the ports for safety?

Not sure but probably some security thing - if you don't need it why leave it open to abuse.

An ISP I've used in the past hasn't allowed self hosting on a standard plan but has allowed on a plan you need to ask for specifically.

Not necessarily security. Maybe just not having to deal with reports for self hosted illegal content. They might be more than happy to let other companies deal with that. Their competitors are probably doing the same thing.

Spam reduction from botnetted machines, and selling business lines, are the reasons I have seen given.

ISPs are media companies. They do not want regular people publishing content or having a voice unless they can get their commission. The world would not have become just 5 websites with identical content if everybody had a server at their house.

I believe this to be true because in the usa they really are media companies, aka Comcast, and I don't have this problem in other countries where I lived where ISPs were ISPs and nothing else. They delivered internet and maybe also phone.

In Taiwan I get 1gbps down, no caps, and a bunch of weird networky config stuff I don't quite understand but apparently you don't get in the usa, for like 30 usd/month. It's awesome.

Plus I'm torrenting basically 24/7 and my isp just doesn't give a fuck. When I did that in the usa Comcast sent me an email for every single torrent lol. My download is in the tens of terabytes a month and uploads are at least a terabyte a month. ISP doesn't care. Love it.

Major reason will always be support burden. For http to work reliably you need to put clients into DMZ anyway. If you let computer illiterate end users operate in DMZ you will end up supporting them anyway, because in the your network will be at risk of depeering/blacklisting. Supporting http behind NAT is again significant support burden that costs actual money while your competitors offer service access cheaper. It makes sense to not only not support http behind nat but block ports altogether for retail and offer proper liability waived DMZ access under enterprise plans.

Do isps still do this? I've been using a business cable account for years, but when our local telco went fiber and wanted me to switch, they told me they didn't have such restrictions. I haven't made the switch because configuring pppoe is more complicated than plugging in a network cable and asking for an ip.

You can try https://pinggy.io

Cloudflare Tunnel is great for NAT traversal.

Reply on news.ycombinator.com