Hacker News Reader

Comment by dannyobrien | Hacker News Reader

Related and kinda related links:

* In San Francisco, good old MonkeyBrains offers an off-the-menu, In'n'Out-style coloc deal: https://www.monkeybrains.net/colocation.php

Fun! If you're thinking of doing this, say so here, maybe we can all share an amp or two.

* If you just want to play with something that isn't an Amazon instance, and are not sure you want to commit to a >$50 a month server somewhere, https://lowendbox.com/ always has a few crazy deals.

* Never underestimate just slinging a box under your desk at the end of a consumer internet connection. I think people sometimes overestimate how difficult it is; I honestly think everyone should do it once, if only to get that visceral feel of being a peer on the global Internet.

View on HN

Well shoot, if you're in the East Bay and would rather colo in Oakland, use the coupon code "non-clown" to get half off the prices here:

https://account.eppihost.com/order/colocation/

(I typically offer VPSes, but just added some colo options for my hosting services because of this thread, as you can probably tell by the package names I chose. The coupon only applies to colocation.)

Thanks for offering us a discount. Can I ask why your cabinet and the Mission facility mentioned in the parent comment have just a single 10Gbps fiber connection shared between colo servers. I can get a 5Gbps at home and probably 10 if I asked nicely, I thought in SF it would be straight forward to get multiples of that.

In case there's some confusion - I'm not with MonkeyBrains. I hope my comment didn't read like I was. (And just FYI, I know people who host with MonkeyBrains, and they have no complaints.) I'm just (self-interestedly) providing an alternative across the Bay. I can't speak for them, but my service is on a 10Gbps line because that covers the needs of my clients at the moment. With a network provider at a data center, you'll typically have a good Service Level Agreement, and throughput will actually match what you're paying for. Looking at the home fiber offering from one of the big players just now, they tell you up front, "Actual speeds may vary."

Thanks for the answer.

Maybe my information is out-of-date but traditionally home internet connections were heavily over-subscribed - so that "10 Gbps" ISP would transfer at that speed for short bursts, but their business model relies on you averaging <100 Mbps over the course of a week. That's still enough for you to watch 24 screen-hours of 4K video per day - but the reason residential bandwidth was 99% cheaper than commercial bandwidth was that if you routinely used more than 1% they'd cut you off, throttle you, or apply traffic shaping.

> if you routinely used more than 1% they'd cut you off, throttle you, or apply traffic shaping.

This is true, but how many projects will routinely use enough bandwidth to matter? Unless you're streaming media, very little.

Keep in mind that cloud backups, P2P/torrenting, etc also uses upstream bandwidth substantially, and ISPs have come to terms with it.

For home use? You're probably right.

teruakohatu asked why a colocation facility would have a mere 10Gbps link when a 5Gbps residential links are so affordable. If you tried to run a colocation facility on a residential link, it would spend most of the time severely throttled.

I should have clarified I am a New Zealander. We get multi-gig connections to home that are not over-subscribed, but I would be very surprised if we could saturate that over the trans-Pacific cables.

I live in Alameda and colo in San Jose and would way prefer the shorter drive, even though I never visit my server.. but... this webpage isn't a real product offering is it? Like, you made it in response to the topic post (right?)

I lol'ed regardless. Bravo, and... I may look you up if OpenColo keeps irritating me. They have been surfing that line just below "irritated enough to move". They recently rug-pulled my whole IP block and forced a bunch of reconfig on me I wasn't down for. I'm still salty. Quadranet never did that to me in ~13 years with them. AWS neither come to that.

Clearly my business/branding sense and my sense of humor are off... it is a real product offering, and I'll honor the offer and the coupon if you sign up. Typically I provide website and VPS hosting, just hadn't advertised colo services publicly so threw the product page together. I'll change the product names eventually when I come up with something I like.

(Standard disclaimer: while supplies last.)

> at the end of a consumer internet connection.

CGNAT needs to be routed around, which means you need at least a "$5 VPS" with a routable IP address to bastion for you. If you monitor the word "wifi" on social media it's a pretty decent proxy for where CGNAT is prevalent. Used in a sentence, "we just got wifi at the new house."

I've written a couple guides on this and subjects like it; i've had to use squid in a datacenter to forward proxy my lightning detector at the house, otherwise it would never receive a heartbeat - even though it would auth and start trying to send data; i've bypassed CGNAT so i could host console "co-op" games (diablo III, for example); and i've "mirrored" my phone media sync to a colocated server as well, just to avoid trying to route around (triple?) CGNAT to my synology at home.

Tailscale funnel will let you expose a service to the world without a $5 VPS.

ipv4 space and bandwidth cost non-zero dollars so I'd ask "who is paying and why?"

I'm understand that a significant portion of HN is on fiber or whatever, but not everyone has access to fiber, cable, or even - dare i speak it - DSL. CGNAT was mentioned as being prevalent in the UK and germany almost 6 years ago (for example.) I haven't had a non-cgnat ISP the entire time i've lived in Louisiana, and not for lack of trying. (at&t, t-mobile, at&t fixed wireless (x2!), starlink) I'm not paying >$5/month to solve the problem "but what if i want to self host a public service" to switch to business or whatever, either, that's ridiculous.

edit: also i have colo hardware; i write guides for people who either don't or don't know how. cool if tailscale works. wireguard does too...

Tailscale runs over Wireguard. I'm pretty sure they just subsidise their free plan using earnings from their paid plans. Getting a foot in the door and all that. If devs use it at home, they might vouche for it at work.

I also think they mostly provide the connection setup, actual traffic should travel directly between the peers most of the time.

Tailscale is essentially a free-to-home-users, paid-for-enterprise very usable frontend to Wireguard. They really make it easy. The free service is paid for by the enterprise users.

So they're offering a free (presumably limited) ngrok-like service?

Plenty of alternatives exist - https://github.com/anderspitman/awesome-tunneling. My issue with Funnel is that it includes no auth, exposing you to anyone in the world. I will advocate for zrok.io as I work on its parent project, OpenZiti. zrok is open source and has a free SaaS (as well as auth and hardening in general).

CGNAT is a scourge, but at least around me, it doesn't seem to be the norm for residential wired internet.

5G yes; starlink, I think so?; geosynchronous satellite, I don't know, but probably. T-Mobile 5G fixed location internet does offer static IPs if you have a SMB account with an EIN, but not for home accounts or SMB with a SSN.

> CGNAT is a scourge, but at least around me, it doesn't seem to be the norm for residential wired internet.

this is highly dependent on your location.

most isp's do not have enough v4-adresses for their consumer base.

> at least around me, it doesn't seem to be the norm for residential wired internet.

It used to be rare in France, too, but now it seems to be spreading. AFAIK SFR, one of the major ISPs, doesn't even offer the option (paid or otherwise) to avoid it.

Edit: they do provide what looks like a fixed IPv6, though.

> It used to be rare in France, too, but now it seems to be spreading. AFAIK SFR, one of the major ISPs, doesn't even offer the option (paid or otherwise) to avoid it.

They realised they can sell the ipv4 blocks for far more and most consumers don't know any better or care. At least I keep my ipv4 adres if I keep the connection up (dhcp lease time is ignored, it is 4 hours despite dhcp saying 24). Asking for a ipv6 adres is like shouting into the void and waiting for an echo which never comes.

SFR will switch you from cgnat to ipv4 if you contact customer support and explain that you work from home and need to open specific ports to access your work servers or VPN. I did just this a month ago. Takes less than 24 hours and you should be OK on ipv4.

Note for the unfamiliar that ISP (CG) NAT is not at all universal, nor always mandatory when initially present; my past several carriers all issued public IPv4 and public IPv6 /64 or greater that were accessible if I set the appropriate settings. Caveats apply; i.e. the AT&T BGW320 routers seem to cap at 8192 connections even when in bridging mode. Such are the tradeoffs of buying residential rather than business service. (The else-described proxies can be a cost-effective counter to this and other such concerns, i.e. dynamic IP assignments versus dyndns update intervals.)

Odd, I never heard of this. So I might be sharing a public IPv4 address with a neighbor?

I run a server out of my bedroom with a TON of services on it. I used to use google domains + DDNS + nginx reverse proxy to manage it, and I still use that for two services that wasn't playing nice with cloudflare (jellyfin + tubearchivist), but now mostly use cloudflare tunnels. For the two services, I just pray my IP address doesn't change. For some reason, it doesn't.

But I never new I might be sharing that IP address. I've never had routing issues, does that mean I'm lucky? Is this like, a major security vulnerability I've exposed users (just friends) of my hosted services to? Maybe because I'm in Taiwan our ISPs just operate a lot differently? For example, not a single complaint at terabytes up/down every month.

If your servers are working fine then chances are you're ISP just isn't using this setup. Some do, some don't.

If you've got Chunghwa/HiNet, you most likely don't suffer from CG-NAT. They're the most expensive offer because they're the best offer.

If you're with those shitty resellers, you 99% will get CG-NATed. You pay 50% of the CHT price, but you get 25% the quality. You see this in large apartment buildings: They take Chunghwa fiber and resell it, NAT the entire building into the 192.168.0.0/16 block to save on costs, because IPv4 is $$$. Forget about IPv6 support. The bandwidth they have is oversold, so the 400M you bought might not actually reach those speeds during peak hours, unless you're lucky enough to be living in a new building where more than half the apartments are vacant.

I have some experience with the latter. Their support staff is often utterly incompetent, too.

This sounds like the solution the provider offered when they commercialised my student internet connection. A building with over 1k connections had 4 ipv4 adresses and no proper cgnat. This means you get niceties like:

* Everyone gets their neighbors favourite language in the search engine if you have a incognito session.

* Only about 32k sessions possible per adres. And yes you can claim them all and kill everyone's internet connection.

* All local ip's were interconnected and not firewalled. That was fun.

* You get banned or soft throttled everywhere due to "strange behaviour".

They were doing it on the cheap and fortunately got told it would void their contract if they did not provide something better and it was "fixed" after about a year. But during rush you would still end up maxing the 4gbit fiber uplink even with only a fast ethernet connection for everyone.

In these parts that's only a thing on mobile connections.

Reply on news.ycombinator.com