Hacker News Reader

Comment by DougN7 | Hacker News Reader

Why not use a dynamic DNS service instead? I’ve been using dyn.com (now oci.dyn.com) for years and it has worked great. A bonus is many home routers have support built in.

View on HN

Only works if you're not behind CGNAT, which has problems in and of itself. I pay my ISP an extra 29 DKK (about 4.50 USD at the moment) for a static address; my IPv4 connections and downloads in-general became way more stable after getting out from behind CGNAT.

CGNAT is hell. Here I had to choose between crap bandwidth or CGNAT. I chose crap bandwidth.

Hell for hosting, but if you're doing adversarial interoperability as a client, it does help you avoid being IP-banned. (At least in Western countries. I hear that Africa and Latin America tend to just get their CGNAT gateways banned because site operators don't give a shit about whether users from those regions can use their sites)

Not quite. I'm in the UK and some of our customers get blocked by overzealous CDNs and they're all on CGNAT.

It's not really overzealous since not banning the CGNAT IPs just gives the abusers safe harbor.

And banning them makes an entire country unable to use your site. That might be tolerable (to the site owner, but not in general) if the country is Argentina. Not if the site is France. Which is why Argentina gets blocked a lot more than France and if you want to scrape things you'd do better on a CGNAT network in France.

The client feature only works for websites that care about making exceptions for CGNAT users. Plenty of them simply ban the shared addresses.

That's part of the reason why countries like India are getting so many CAPTCHAs: websites don't care for the reason behind lackluster IP plans from CGNAT ISPs. If the ISP offered IPv6 support, people wouldn't have so many issues, but alas, apparently there's money for shitty CGNAT boxes but not IPv6 routers.

> it does help you avoid being IP-banned

Actually all it does is get everyone behind the CGNAT banned. I've lost access to the WSJ and NYT recently, and other websites over time. For every Cloudflare backed website, I have to pass a captcha on every access.

Fuck those people doing "adversarial interoperability as a client", AI scraping, et al, who take away from thousands of people for profit, then move on to the next pool of victims.

YouTube showed me a "this household watches suspiciously many videos" once when the provider moved us behind a CGNAT (because 100 households were suddenly watching from the same address, not just one).

It also messes a bit with geolocation, we frequently teleport to different places within the country.

Yeah, but in this case, the negotiation between the ISP and YouTube typically ends with the IP being unblocked. It's not like when one household is actually watching as much as 100 people, when the IP stays blocked.

CGNAT is completely irrelevant to the average person. It’s only an issue if you expect others to connect to you, which is something that almost all people don’t need.

(inb4 but the internet was made to receive connections! Well yes, decades ago maybe. But that’s not the way things have evolved. Get with the times.)

Cloudflare sometimes preventing access to some sites and annoying CAPTCHA challenges due to CGNAT are relevant to the average person.

Full IPv6 support should be a requirement for both ISPs as well as websites and other servers.

> Cloudflare sometimes preventing access to some sites and annoying CAPTCHA challenges due to CGNAT are relevant to the average person.

They would be, but thankfully CGNAT doesn’t cause that.

It contributes to it, because now you're behind the same public IP address as X other people. You're then X-times more likely to get flagged as suspicious and need to enter a CAPTCHA X-times more frequently.

Cloudflare easily detects that using your discrete external port range and knows better than to show you a CAPTCHA.

Anecdotal experience (I know, of course... this is sample size n=1) tells me that you can't be further from the truth.

Putting CF aside, anyone who has tried to edit Wikipedia anonymously should understand the pain of CGNAT.

Someone should tell Cloudflare that because it's not been my experience at all.

(now n=2)

It's not a direct cause, but if an IP is hitting my website with spam, I don't care if it's a spam bot or a CGNAT exit point. The only way to stop the spam is to take action against the IP address. For CGNAT customers, that means extra CAPTCHAs or worse.

You can ask your ISP for your own IPv6 subnet if you don't want to be lumped in with the people whose computers and phones are part of a scraping/spamming botnet.

> It’s only an issue if you expect others to connect to you, which is something that almost all people don’t need.

Unless they're playing video games:

* https://steamcommunity.com/sharedfiles/filedetails/?id=27339...

* https://www.checkmynat.com/posts/optimizing-nat-settings-for...

The video game industry is bigger than movies, television, and music combined:

* https://www.marketing-beat.co.uk/2024/10/22/dentsu-gaming-da...

So I think CGNAT / double-NAT can hit a lot of folks.

> Well yes, decades ago maybe. But that’s not the way things have evolved. Get with the times.

Why? Why should I accept the enshittification of the Internat that has evolved to this point? Why cannot people push for something better?

Pathetic that in 2025 there still are games that rely on p2p connections, to the detriment of the experience because cheating can’t be detected server-side. GTA 5 is one of them.

If I've purchased a video game, why should I have to be reliant on the publisher's servers being up? Self-hosting should be a thing:

* https://store.steampowered.com/curator/41339173-Self-Hosted-...

At the very least if a game publisher wants to power down their own servers because they don't feel it's "worth" supporting their customers, they should post the server code so that the customers can continue to use the product they 'bought'.

Completely agree with the last paragraph.

If you're behind a CGNAT - check out hoppy.network

High quality IPv4 + a whole /56 IPv6 for $8/month

That's way more expensive than what I already have. My ISP, by default, provides me a /56, of which I'm only using two /64 subnets at the moment. For an extra 29 DKK (4.50 USD), I get a static IPv4 as well.

I also don't need to worry about the additional latency of a VPN, and have symmetric gigabit speeds, rather than 100Mbps up/down.

I have multiple devices on my internal network that I want to exist outside, and dynamic DNS is only going to let me expose one of them

If they don't all need distinct external IP addresses of their own, port forwarding is a typical approach.

That doesn't work well if you want to run the same service on multiple machines. For some you can proxy that (eg, for web you can just run nginx to proxy everything based on either the host header or SNI data), but for others you can't - you're only going to be able to have one machine accepting port 22 traffic for ssh.

Select an isp that gives you multiple ip v4 addresses. Or host on ipv6.

Yes, if I had multiple IPv4 addresses already it wouldn't be necessary to tunnel in additional IPv4 addresses, but since I don't and since there are no ISPs who will provide that to me at this physical address, tunneling is where I am.

In many countries, unless you buy a business broadband package (more expensive),residential internet does not come with such options.

You can port forward SSH to other internal machines, just like nginx + web.

I can port forward port 22 to a single machine. I can't proxy port 22 in a way that directs the incoming connection to the correct machine, at least not without client configuration.

You only need one inbound machine as your bastion. Then hop from there to the rest using local address. Once you set up the proxy config in ssh it’s completely transparent.

Right yes but I (for various reasons) end up using a lot of different client systems and I don't want to have to configure all of them to transparently jumphost or use different port numbers and why are people spending so much time trying to tell me that I should make my life complicated in a different way to the one I've chosen?

It's weird how much pushback you're getting for a few simple firewall rules, but I guess it's just another bikeshed. Basically all of the options for doing this are simple if you already know them, and have some annoying complexity otherwise. So everyone has a favorite.

I've got a similar setup to what you've done here, with the policy routing and wireguard tunnels being part of a larger scheme that lets me granularly choose which Internet horizon each particular host sees. So I can have a browsing VM that goes out a rotating VPS IP, torrent traffic out a commercial VPN, Internet of Trash out a static VPS IP (why not separate from my infrastructure IP), visitors' devices going out a different rotating VPS IP (avoid associating with me), Windows VMs that can only access the local network (they have personal data), etc.

I'm currently hosting email/etc on a VPS, but the plan is to bring those services back on-prem using VPS IPs with DNAT just like you're doing. Any day now...

Yeah, I currently have a VPS with various SSH port forwards allowing me to direct incoming connections of various types to my home computer which is behind NAT. It's evil and horrible and nasty for various reasons, not least of which that all your incoming connections look to your inner server like they come from the same IP address, preventing you from logging or filtering the source of any request. And you need to make sure if you forward incoming connections to your SMTP server that it doesn't think they are local trusted connections that it can relay onwards, turning your setup into an open relay.

Seriously thinking about switching to a setup similar to the article. I mean, my setup works for now, but it's un-pretty.

ipv6 has solved this. Too bad it's not yet a common thing.

The Google data strongly suggests that at this point it's probably available to a majority of home users. Corporate remains significantly worse. My employer, which paid me to do IPv6 stuff last century in a very different role, today has IPv6 for random outsiders but if you have a corporate issued laptop IPv6 is disabled and they cheerfully explained that it's "difficult" in a call this week right before I pointed out what I was paid to do and where a quarter century ago. Embarrassing for them.

A lot of consumer connections do indeed provide ipv6. But some are unstable, some change addresses every X days, some have weird routing etc etc.

Meta IIRC is one of several outfits which unsurprisingly discovered that (as a corporation) the cure is just purchasing policy. When your new Doodad vendor sells you a product that is IPv4 only instead of saying "Oh, shame, OK, set all corporate systems to IPv4-only" you point them to the line in your purchase contract which says you require IPv6 and it's not your problem it's their problem, do they want to fix it or refund you ?

Yes, that's how it works when you only have a single IP. The standard way to deal with this is a reverse proxy for web requests. Other services require different workarounds. I have a port 22 SSH server for git activities, and another on a different port that acts as a gateway. From that machine I can SSH again to anywhere within my local network.

It's really not onerous or complicated at all. It's about as simple as it gets. I'm hosting a dozen web services behind a single IP4 address. Adding a new service is even easier than without the proxy setup. Instead of dicking around with my firewall and port forwarding, I just add an entry to my reverse proxy. I don't even use IPs, I just let my local DNS resolve hostnames for me. Easy as.

The entire point of this is that I don't want to deal with non-standard port numbers or bouncing through hosts. I want to be able to host services in the normal boring way, and this approach lets me do that without needing to worry about dynamic DNS updates whenever my public IP changes.

Same for me, I actually like having a reverse proxy as a single point of entry for all my web services. I also run OpenVPN on 443 using the port share feature and as a result I only need one IP address and one open port for everything.

This is what I do, except the dynamic DNS service is just a script on my server that updates Cloudflare DNS with my current external IP. In practice my address is almost static, I've never seen it change except when my router is reset/reconfigured.

Many DNS registrars support updates via API these days. I use Porkbun and ddclient to update it. Slight rub is I couldn't get it to work for the apex domain. Not sure where the limitation lies.

Reply on news.ycombinator.com