Community discussions

MikroTik App
 
User avatar
atomicduck
Member Candidate
Member Candidate
Topic Author
Posts: 272
Joined: Fri Oct 02, 2020 1:42 pm

How to reach a router behind a CGNAT?

Sat Dec 21, 2024 11:06 am

I have a user that will use a residential StarLink on location, and that thing is behind a CGNAT.

How to punch through to make a WireGuard work for remote access / admin?
 
User avatar
mkx
Forum Guru
Forum Guru
Posts: 13126
Joined: Thu Mar 03, 2016 10:23 pm

Re: How to reach a router behind a CGNAT?  [SOLVED]

Sat Dec 21, 2024 11:16 am

BTH function is done exactly for such cases.
 
User avatar
atomicduck
Member Candidate
Member Candidate
Topic Author
Posts: 272
Joined: Fri Oct 02, 2020 1:42 pm

Re: How to reach a router behind a CGNAT?

Sat Dec 21, 2024 12:24 pm

Thank you very much! 8)
 
User avatar
patrikg
Member
Member
Posts: 367
Joined: Thu Feb 07, 2013 6:38 pm
Location: Stockholm, Sweden

Re: How to reach a router behind a CGNAT?

Sat Dec 21, 2024 2:02 pm

But don't do it in prod.

It's only for HO.
 
User avatar
atomicduck
Member Candidate
Member Candidate
Topic Author
Posts: 272
Joined: Fri Oct 02, 2020 1:42 pm

Re: How to reach a router behind a CGNAT?

Sat Dec 21, 2024 9:22 pm

But don't do it in prod.

It's only for HO.
Why? It is WireGuard, with specific client in. Should be quite safe. Or? What am I missing?

(I have done some tests today, but nothing much. Didn't work out of the box, need some tweaking.)
 
User avatar
patrikg
Member
Member
Posts: 367
Joined: Thu Feb 07, 2013 6:38 pm
Location: Stockholm, Sweden

Re: How to reach a router behind a CGNAT?

Sat Dec 21, 2024 10:08 pm

It's working today, but maybe not tomorrow.
Take a look at this answer from Mikrotik Own Support Technician.
viewtopic.php?p=1114268#p1114268
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 22202
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: How to reach a router behind a CGNAT?

Sun Dec 22, 2024 1:37 am

A bit over the top, but it should not be used as a business entity as on occasion, not very frequently the Mikrotik servers have gone offline. A couple of times a year is probably a safe bet.
Nothing for you to worry about unless your a hospital, a bank or any business requiring 24/7 VPN up time.
If that is concern then rent a server in the cloud, for like $7 a month and put a CHR on it and use that as the wireguard server.
 
User avatar
atomicduck
Member Candidate
Member Candidate
Topic Author
Posts: 272
Joined: Fri Oct 02, 2020 1:42 pm

Re: How to reach a router behind a CGNAT?

Sun Dec 22, 2024 1:38 pm

A bit over the top, but it should not be used as a business entity as on occasion, not very frequently the Mikrotik servers have gone offline. A couple of times a year is probably a safe bet.
Exactly my point. If a client is not willing to shelve out for a business connection with an fixed IP, then I don't really see them willing to finance a CHR instance configuration and maintenance.
Nothing for you to worry about unless your a hospital, a bank or any business requiring 24/7 VPN up time.
If that is concern then rent a server in the cloud, for like $7 a month and put a CHR on it and use that as the wireguard server.
As on the price of the cloud server - the issue is not a few bucks needed to make it work, but time to do so. All these costs need to be passed onto the client, and it adds up. It is simply more cost effective to have a business class internet access.

Also, 24/7 is overrated for most use cases.

(Also, I haven't forgot about that EAP I promised you, but I have so much work to do that I couldn't yet muster time to do a write up.)
 
optio
Forum Veteran
Forum Veteran
Posts: 962
Joined: Mon Dec 26, 2022 2:57 pm

Re: How to reach a router behind a CGNAT?

Sun Dec 22, 2024 2:09 pm

Why is CHR necessary just for Wireguard peer? It can be setup on Linux running on cloud server and save some money for CHR licence. Once setup on Linux is created, image can be made of it for reuse.
Initially some time will be spent to create setup, but later it should be more faster and charge more know-how than spent time and profit from such clients.
 
User avatar
sindy
Forum Guru
Forum Guru
Posts: 11278
Joined: Mon Dec 04, 2017 9:19 pm

Re: How to reach a router behind a CGNAT?

Sun Dec 22, 2024 2:22 pm

So we must clarify what business use means. If the BTH is used for occasional management access for a support company, then support intervention is not possible if the BTH infrastructure is unavailable. That's definitely unpleasant but it is not the same like if BTH was hypothetically used to provide service for end customers, because support interventions are only required at random times and the BTH infrastructure becomes unavailable at other random times, so the probability that these two events coincide is not that high.

But looking at it from the other side, if I provide support, it should not be a big deal for me to have a public (or global) IP address and let these customers actively connect to it so that I could reach their router for support interventions?
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 22202
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: How to reach a router behind a CGNAT?

Sun Dec 22, 2024 2:47 pm

Concur with Sindy, if you are providing a paid service, then having your own cloud wireguard to support all your clients ( shared cost ), is the smart way to go.
 
User avatar
atomicduck
Member Candidate
Member Candidate
Topic Author
Posts: 272
Joined: Fri Oct 02, 2020 1:42 pm

Re: How to reach a router behind a CGNAT?

Wed Dec 25, 2024 9:55 pm

Just to chip in a send a christmass thumbs up to anav and sindy. 8) All the best guys.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 22202
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: How to reach a router behind a CGNAT?

Wed Dec 25, 2024 10:17 pm

All the best to you and your loved ones in 2025 there AtomD.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 22202
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: How to reach a router behind a CGNAT?

Wed Dec 25, 2024 10:18 pm

Why is CHR necessary just for Wireguard peer? It can be setup on Linux running on cloud server and save some money for CHR licence. Once setup on Linux is created, image can be made of it for reuse.
Initially some time will be spent to create setup, but later it should be more faster and charge more know-how than spent time and profit from such clients.
This is a mikrotik forum, and I have no clue how to use linux LOL.
 
kreb
just joined
Posts: 11
Joined: Fri Mar 10, 2023 8:35 pm

Re: How to reach a router behind a CGNAT?

Wed Dec 25, 2024 11:48 pm

why don't you use IPv6? router should be reachable.
 
User avatar
atomicduck
Member Candidate
Member Candidate
Topic Author
Posts: 272
Joined: Fri Oct 02, 2020 1:42 pm

Re: How to reach a router behind a CGNAT?

Thu Dec 26, 2024 7:13 pm

why don't you use IPv6? router should be reachable.
Interesting proposition. But I think that local providers still use IPv4 here. Not sure about StarLink?

Would check, as this actually could be useful in practice.
 
User avatar
sindy
Forum Guru
Forum Guru
Posts: 11278
Joined: Mon Dec 04, 2017 9:19 pm

Re: How to reach a router behind a CGNAT?

Thu Dec 26, 2024 7:17 pm

Starlink indeed gives you a/56 global subnet, but only in "bypass" mode (or how do they call the bridge mode of their router), or if you connect your own router directly to the dishy, bypassing their router that way. So along with a Hurricane Electric tunnel that allows you to get a global subnet using your IPv4-only uplink, this is the budget way to get there.
 
User avatar
atomicduck
Member Candidate
Member Candidate
Topic Author
Posts: 272
Joined: Fri Oct 02, 2020 1:42 pm

Re: How to reach a router behind a CGNAT?

Fri Jan 10, 2025 11:26 am

Starlink indeed gives you a/56 global subnet, but only in "bypass" mode (or how do they call the bridge mode of their router), or if you connect your own router directly to the dishy, bypassing their router that way. So along with a Hurricane Electric tunnel that allows you to get a global subnet using your IPv4-only uplink, this is the budget way to get there.
We have end-user starlink terminal, the configuration options are more or less devoid of any options. Currently I have enabled BTH option and that one works flawlessly. However, I haven't yer configured firewall properly, so there is that... Configured BTH on site 2 days ago. I was surprised how easy it was... Probably the easiest setup for anything Mikrotik ever.

As for StarLink, I presume bypass works only for business models, or?

As for the antenna, it draws a lot of power. From what I understand the ethernet cable they provide is out of standard, as is power delivery, as it needs to supply up to 100W+ to the antenna itself? Meaning I can't really bypass the SL router itself.
 
User avatar
sindy
Forum Guru
Forum Guru
Posts: 11278
Joined: Mon Dec 04, 2017 9:19 pm

Re: How to reach a router behind a CGNAT?

Fri Jan 10, 2025 4:02 pm

As for StarLink, I presume bypass works only for business models, or?
It works also for the consumer grade service.

As for the antenna, it draws a lot of power. From what I understand the ethernet cable they provide is out of standard, as is power delivery, as it needs to supply up to 100W+ to the antenna itself? Meaning I can't really bypass the SL router itself.
3rd party solutions are available that allow to exclude the indoor router from the scheme completely and provide the non-standard power supply via the non-standard connector to the dish and the data lines on a standard RJ-45 socket. But the "bypass mode" is actually a setting of the "router" which then becomes a bridge (for some models, you need a separate Ethernet adaptor, for others the router has the Ethernet port directly).
 
User avatar
atomicduck
Member Candidate
Member Candidate
Topic Author
Posts: 272
Joined: Fri Oct 02, 2020 1:42 pm

Re: How to reach a router behind a CGNAT?

Fri Jan 10, 2025 4:26 pm

This was most informative. - Their "Bypass mode" is a bit a bit convoluted tho. Do I understand correctly that when I enable bypass mode, what happens is that the router itself is in bridge mode and "dead", but I will still get a DHCP ip from the antenna itself? It is like both antenna and router kind of redundant? The rotuer then just feeds the antenna and uses as an internal interface.
 
User avatar
sindy
Forum Guru
Forum Guru
Posts: 11278
Joined: Mon Dec 04, 2017 9:19 pm

Re: How to reach a router behind a CGNAT?

Fri Jan 10, 2025 4:35 pm

Indeed. Using DHCP, the antenna always hands out an IPv4 address from the 100.64.0.0/10 range and a /56 global prefix. If the router is active, it only requests an IPv4 address from the antenna, and only hands out IPv4 addresses from 192.168.1.0/24 on its LAN side; if it is set to bypass mode, it acts as a PoE switch only. To the extent that there is no way to configure it locally or over the air and to switch the bridge mode off, you have to use a "magic" sequence of power disconnects.
 
User avatar
atomicduck
Member Candidate
Member Candidate
Topic Author
Posts: 272
Joined: Fri Oct 02, 2020 1:42 pm

Re: How to reach a router behind a CGNAT?

Fri Jan 10, 2025 4:42 pm

Thanks. Given I already have WAN port set and and enabled DHCP on it that connects to router, would it actually make any real world benefit for using bypass mode, apart from WiFi being turned off? I mean, I am pretty sure the router is quite powerful. Given that consumer router is behind cgnat and that I have BTH set and works not sure if it makes any sense (I am annoyed by 80mhz wifi tho, it eats up channels). How and do the firmware updates work for antenna router after bypass?
 
User avatar
sindy
Forum Guru
Forum Guru
Posts: 11278
Joined: Mon Dec 04, 2017 9:19 pm

Re: How to reach a router behind a CGNAT?

Fri Jan 10, 2025 4:57 pm

would it actually make any real world benefit for using bypass mode
Unless you consider availability of IPv6 a real world benefit (it makes you independent on wthe BTH ifrastructure), and unless you suffer from the double-NAT-phobia, it wouldn't.

How and do the firmware updates work for antenna router after bypass?
They do - Starlink does have over-the-air access to the antenna even if the indoor router is not part of the setup.
 
User avatar
atomicduck
Member Candidate
Member Candidate
Topic Author
Posts: 272
Joined: Fri Oct 02, 2020 1:42 pm

Re: How to reach a router behind a CGNAT?

Fri Jan 10, 2025 5:09 pm

Thanks. :-)

I currently work with IPv6 disabled, as it seems too much work to worry about that too. But I might enable bypass out of curiosity...

Over the air access to antennas is the smart thing, but I have to admit that I was surprised to learn that the antenna itself was a standalone device.