Working around lack of router settings
Working around lack of router settings
I am currently living with my parents and we have just started an Internet contract with a 5G wireless company.
The issue is the MFND settings are behind a password and likely not allowed access by the ISP. Even if they weren't doing port forwarding on 5G likely isn't possible because of CGNAT. I think I can use cloudflare tunnels or tailscale to get around this, and not many things need to be directly accessible from the Internet.
The more annoying thing is that setting DHCP reservations likely isn't possible without getting access to the settings. It's going to make setting up static IPs difficult too.
Before anyone asks fixed line Internet almost certainly isn't practical in this area. Getting our own modem while possible is more expensive and potentially difficult, and would mean cancelling the contract.
Is there a reasonable way to work around these issues?
Any help or advice would be appreciated.
I use my own router with DD-WRT in-between the ISPs router/modem and my LAN, and use a different subnet. I haven't had any issues with this myself, and my router just sees the ISP router/modem as the WAN.
Normally this is bad advice, but if you already have CGNAT you'd be going from double NAT to triple NAT and it probably won't make anything worse. At least it shouldn't make things worse for IPv4. If you have 5G internet with CGNAT there's no excuse for your ISP not giving you proper IPv6. Putting a second router between will complicate your IPv6 setup.
There are some tricks you can do for IPv4 in the precense of hostile DHCP servers. Serious OSes should allow you to configure a second IP address on the same physical interface, so you could have a dynamic 192.168.0.x assigned by the ISP's DHCP server and a static 192.168.1.y assigned statically by you, and then you should be able to set up an additional route table entry to access 192.168.1.0/24 using the source address 192.168.1.y. As long as the ethernet/wifi switching between devices doesn't filter ARP packets based on IP subnet, you should be able to communicate between your machines using fixed IPs on the second subnet.
Triple NAT? Would that cause any problems?
Unlikely. The main issue comes with port forwarding, but you are locked out from doing that already. I say go for the triple NAT, put your own router after the ISP's modem and then you have full control of your LAN.
Yes, but probably no additional problems if you’re already behind CGNAT.
Not really for most applications
Do you even need reservations? You can also just set a static IP on the computer and it should be fine. Most DHCP servers test the IP before handing it out just in case.
That is bad practice as if the machine is powered off for any period of time you may get a different device with the same IP.
They do? I had no idea. This seems like the correct route to go down then.
Most, but not all, do. So it might be as simple as setting a static address, or it may overlap in the future.
You could ask from ISP (or try it out yourself) if you can use some addresses outside of DHCP pool, my ISP router had /24 subnet with .0.1 as gateway but DHCP pool started from .0.101 so there would've been plenty of addresses to use. Mine had a 'end user' account too from wehere I could've changed LAN IP's, SSID and other basic stuff, but I replaced the whole thing with my own.
In this scenario you could just get your own firewall to serve as an NAT gateway and connect its WAN port to the LAN side of your ISP’s gateway. You’d then have your own LAN you can do whatever you want on. The ISP’s device would provide the WAN IP to your gateway via DHCP, but that DHCP wouldn’t work through your gateway. You’d just make sure your new internal LAN(s) subnet is different from the one that exists between your firewall and your ISP’s gateway. The only problems this would cause in your scenario are because there’s now double the NAT going on, but if you’re already dealing with CGNAT then you’d already have those same problems.
Outbound traffic should all work just fine, and your ISP’s device would no longer have access to your LAN.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:
Fewer Letters More Letters CGNAT Carrier-Grade NAT IP Internet Protocol NAT Network Address Translation VPS Virtual Private Server (opposed to shared hosting)
4 acronyms in this thread; the most compressed thread commented on today has 10 acronyms.
[Thread #571 for this sub, first seen 4th Mar 2024, 18:45] [FAQ] [Full list] [Contact] [Source code]
Afaik tailscale will work with CGNAT and you can get your own router to sort out DHCP (or just pihole on your server?). Others can probably provide better answer
Wouldn't that cause a problem with two DHCPs being active?
Honestly I think someone else should answer this, but I believe you can just use different IP range (example 192.168.0.x on ISP device and 192.168.1.x on new router). Reading other comment it looks like its not the best idea, but we have that kind of setup in office and it works fine. There is no selfhosting involved tho
You connect them in a chain.
Maybe call your provider and ask them? Sometimes they hide settings in the user UI but can easily disable DHCP for you.
Another option that is sometimes offered by the provider is another, more capable router model. This might cost a little more.
It's not a lack of settings on the router. It's that I can't login to the router because only they have the password. I will double check but it's not in the normal place on the router, and it wasn't included in the paperwork.
I did the research on the company, and both routers seem to have roughly the same capability. They are selected seemingly at random for the package I am on.
First off get your own router. You can pickup a device capable of running OpenWRT from Walmart, Bestbuy or most other stores.
Once that's done you will have way more control. For remote access I would use Netbird and if you need to expose services use a VPS and wireguard.
I already have a router from another house. Not helpful given it doesn't have 5G. Also walmart? I am not an American lol.
So what this would actually mean, is cancelling a 24 month contract, buying two devices, one a 5G modem, and another to run OpenWRT, for well over £300. Shipping the other device back to the ISP. All with no guarantee any of it will work, given my experience with buying cellular modems previously. This would take probably 1 week plus, and cause more disruption to my parents after having already moved house and one of them being in hospital. That's not taking into account anything that goes wrong with using OpenWRT, which is any number of things given it's unofficial firmware that I have no previous experience with.
Yeah no that's not going to happen. They aren't going to go for that and honestly I don't blame them that's a horrible deal, even if I pay for half the equipment.