That would be transparent for me as a subscriber, though? I imagine the packets are routed to my cable modem based on some other identified like a MAC?
https://tailscale.com/blog/how-nat-traversal-works#concernin...
How could I reliably tell if I'm behind a CGNAT or not? If I poll one of those "what is my IP" websites, and the IP my router has assigned from the wan matches the what is my IP then I'm fine, I'm not behind one, right?
And if you can access the services using a dydns kind of thing, then you're safe, you're not behind a CGNAT as well. Only catch where you could be wrong is if you try to access from the same CGNAT network (is this how you call it?) But since the dydns is probably swing your wide internet IP that should still not work?
My layman understanding is that the WAN IP on your router will match the "what is my ip" website, but the problem is that it will also match many other people's routers.
Basically imagine your home router and NAT has been moved into the ISP and is serving thousands of end users as well as you... you can't just configure the ISP's CGNAT to forward port 80 to you alone.
I'm not sure if there is a definitive way to know if you are behind CGNAT, however its definitely the case on all mobile networks.
That's interesting. So the ISP is directing packets at the various customer routers using some other identifier than the WAN IP the router sees? MAC address or something?
HFC (Hybrid Fiber Coaxial) and FttN (Fiber to the Node) are such examples. The rest of them if you don't have a static IP or an internet routable address, use NAT (Network Address Translation) and in some even more exotic environments they use Port Address Translating (PAT), but it's been many years since I've seen PAT in any way at commercial, residential or enterprise setups in ISP space.
But PAT is quite common in the reverse and forward proxy space.
You'll get your public IP, it won't signal whether you are behind CGNAT or not.
Check your WAN, if it's in a private range then you're behind CGNAT, likely going to be 10.0.0.0/8 for most ISP's but all the other private ranges count too. Otherwise it will show a public address that matches your "whats my IP" website.
(With such internet connections you are always classified as a bot/spam with captcha services that don't understand IPv6 btw)
As a customer, you cannot influence the IPs and neither the ports that get routed through, so you have to connect to a server that you host somewhere else, just for the purpose of tunneling the traffic. So the server at home is actually a client that reconnects to the reverse proxy as there's no other way to have the open connection.
I saw a big chance for WebRTC data channels to fix exactly that, but I've given up because Google and Mozilla both put a lot of restrictions in the protocol to make it unfeasible for this use case.
And this kinda applies for most cable internet providers in Europe because RIPE ran out of IPs a long time ago. On one hand we got Daimler blocking a whole /8 subnet, and on the other hand we have ISPs that have less than 16 IPv4s. Doesn't make sense to me how this is handled tbh.
Thankfully, there are some pretty cheap VPS options out there. I actually have my homelab behind some, with the nodes running WireGuard to bypass CGNAT.
There's also a few proxy services mentioned in other comments that basically do the same.
Of course, you can also just run things "in the cloud" because the non-enterprise VPS providers come at many different price points, but at the same time it's also just really nice to put your own devices to a good use and have the data be on your own drives (hopefully with adequate backups)