Hacker News Reader

Comment by messe | Hacker News Reader

Only works if you're not behind CGNAT, which has problems in and of itself. I pay my ISP an extra 29 DKK (about 4.50 USD at the moment) for a static address; my IPv4 connections and downloads in-general became way more stable after getting out from behind CGNAT.

View on HN

CGNAT is hell. Here I had to choose between crap bandwidth or CGNAT. I chose crap bandwidth.

Hell for hosting, but if you're doing adversarial interoperability as a client, it does help you avoid being IP-banned. (At least in Western countries. I hear that Africa and Latin America tend to just get their CGNAT gateways banned because site operators don't give a shit about whether users from those regions can use their sites)

Not quite. I'm in the UK and some of our customers get blocked by overzealous CDNs and they're all on CGNAT.

It's not really overzealous since not banning the CGNAT IPs just gives the abusers safe harbor.

And banning them makes an entire country unable to use your site. That might be tolerable (to the site owner, but not in general) if the country is Argentina. Not if the site is France. Which is why Argentina gets blocked a lot more than France and if you want to scrape things you'd do better on a CGNAT network in France.

The client feature only works for websites that care about making exceptions for CGNAT users. Plenty of them simply ban the shared addresses.

That's part of the reason why countries like India are getting so many CAPTCHAs: websites don't care for the reason behind lackluster IP plans from CGNAT ISPs. If the ISP offered IPv6 support, people wouldn't have so many issues, but alas, apparently there's money for shitty CGNAT boxes but not IPv6 routers.

> it does help you avoid being IP-banned

Actually all it does is get everyone behind the CGNAT banned. I've lost access to the WSJ and NYT recently, and other websites over time. For every Cloudflare backed website, I have to pass a captcha on every access.

Fuck those people doing "adversarial interoperability as a client", AI scraping, et al, who take away from thousands of people for profit, then move on to the next pool of victims.

YouTube showed me a "this household watches suspiciously many videos" once when the provider moved us behind a CGNAT (because 100 households were suddenly watching from the same address, not just one).

It also messes a bit with geolocation, we frequently teleport to different places within the country.

Yeah, but in this case, the negotiation between the ISP and YouTube typically ends with the IP being unblocked. It's not like when one household is actually watching as much as 100 people, when the IP stays blocked.

CGNAT is completely irrelevant to the average person. It’s only an issue if you expect others to connect to you, which is something that almost all people don’t need.

(inb4 but the internet was made to receive connections! Well yes, decades ago maybe. But that’s not the way things have evolved. Get with the times.)

Cloudflare sometimes preventing access to some sites and annoying CAPTCHA challenges due to CGNAT are relevant to the average person.

Full IPv6 support should be a requirement for both ISPs as well as websites and other servers.

> Cloudflare sometimes preventing access to some sites and annoying CAPTCHA challenges due to CGNAT are relevant to the average person.

They would be, but thankfully CGNAT doesn’t cause that.

It contributes to it, because now you're behind the same public IP address as X other people. You're then X-times more likely to get flagged as suspicious and need to enter a CAPTCHA X-times more frequently.

Cloudflare easily detects that using your discrete external port range and knows better than to show you a CAPTCHA.

Anecdotal experience (I know, of course... this is sample size n=1) tells me that you can't be further from the truth.

Putting CF aside, anyone who has tried to edit Wikipedia anonymously should understand the pain of CGNAT.

Someone should tell Cloudflare that because it's not been my experience at all.

(now n=2)

It's not a direct cause, but if an IP is hitting my website with spam, I don't care if it's a spam bot or a CGNAT exit point. The only way to stop the spam is to take action against the IP address. For CGNAT customers, that means extra CAPTCHAs or worse.

You can ask your ISP for your own IPv6 subnet if you don't want to be lumped in with the people whose computers and phones are part of a scraping/spamming botnet.

> It’s only an issue if you expect others to connect to you, which is something that almost all people don’t need.

Unless they're playing video games:

* https://steamcommunity.com/sharedfiles/filedetails/?id=27339...

* https://www.checkmynat.com/posts/optimizing-nat-settings-for...

The video game industry is bigger than movies, television, and music combined:

* https://www.marketing-beat.co.uk/2024/10/22/dentsu-gaming-da...

So I think CGNAT / double-NAT can hit a lot of folks.

> Well yes, decades ago maybe. But that’s not the way things have evolved. Get with the times.

Why? Why should I accept the enshittification of the Internat that has evolved to this point? Why cannot people push for something better?

Pathetic that in 2025 there still are games that rely on p2p connections, to the detriment of the experience because cheating can’t be detected server-side. GTA 5 is one of them.

If I've purchased a video game, why should I have to be reliant on the publisher's servers being up? Self-hosting should be a thing:

* https://store.steampowered.com/curator/41339173-Self-Hosted-...

At the very least if a game publisher wants to power down their own servers because they don't feel it's "worth" supporting their customers, they should post the server code so that the customers can continue to use the product they 'bought'.

Completely agree with the last paragraph.

If you're behind a CGNAT - check out hoppy.network

High quality IPv4 + a whole /56 IPv6 for $8/month

That's way more expensive than what I already have. My ISP, by default, provides me a /56, of which I'm only using two /64 subnets at the moment. For an extra 29 DKK (4.50 USD), I get a static IPv4 as well.

I also don't need to worry about the additional latency of a VPN, and have symmetric gigabit speeds, rather than 100Mbps up/down.

Reply on news.ycombinator.com