NAT (Forwarding) in T-Mobile Gateway

PortalWizard wrote:

My nat was strict and couldn’t play in a party on Xbox.

Great lad at customer service had me run 2 speed tests and that pushed me into whatever and now the nat is open. Yay for cgnat 

What speed tests did he have you run? I've been trying to change it on my XBox series X and it won't even allow me to play a game

Just another success story here, if you’re the type who knows how to use SSH tunneling.

T-Mobile (business, in my case; don't think it matters) can't do port forwarding.  But my ssh tunnel(s) worked, at least for a little bit.  I use autossh, which re-establishes connections when they fail (due to routing changes, etc).  It has been very reliable for me in the past to get around bad/broken NAT situations.

But I found that my ssh tunnels would only last for a short time (Arkadyan modem, using a router on the LAN connection).  Then I read from another post somewhere else on this forum that t-mobile simply closes TCP connections without traffic after a period of time (looks like maybe as short as 5m).

So I changed the ssh settings on my server to add a keep-alive, and all is working perfectly.  I have three ports forwarded on my LAN through an ssh connection to a server in the cloud; you could probably use ngrok for this (free accounts I think).  I have a camera, ssh to a server, and another port forward to an IoT device, and all three have been working perfectly without interruption for over a week.  I get between 120 and 250Mbps down and 30up pretty consistently.

I’m sold, and am currently on hold cancelling my AT&T DSL account! 

EricNorcal wrote:

Just another success story here, if you’re the type who knows how to use SSH tunneling.

T-Mobile (business, in my case; don't think it matters) can't do port forwarding.  But my ssh tunnel(s) worked, at least for a little bit.  I use autossh, which re-establishes connections when they fail (due to routing changes, etc).  It has been very reliable for me in the past to get around bad/broken NAT situations.

But I found that my ssh tunnels would only last for a short time (Arkadyan modem, using a router on the LAN connection).  Then I read from another post somewhere else on this forum that t-mobile simply closes TCP connections without traffic after a period of time (looks like maybe as short as 5m).

So I changed the ssh settings on my server to add a keep-alive, and all is working perfectly.  I have three ports forwarded on my LAN through an ssh connection to a server in the cloud; you could probably use ngrok for this (free accounts I think).  I have a camera, ssh to a server, and another port forward to an IoT device, and all three have been working perfectly without interruption for over a week.  I get between 120 and 250Mbps down and 30up pretty consistently.

I’m sold, and am currently on hold cancelling my AT&T DSL account! 

Could you run thru a quick setup?? I'm jus tryna to game on my pc and Tmobile internet is blocking some of my games from connecting. I'm using Persistent SSH which is and alternative to autossh.

It would be much appreciated.

From what I understand, T-Mobile deploys 464XLAT. Meaning your IPv4 connections are translated over IPv6. This means IPv4s are not assigned in anyway to a traditional home-ISP, and instead IPv4 WAN are pooled and NAT'd together. This was reportedly done due to IP assignment issues, and used to mitigate and rollout to IPv6 at the same time. Business customers have the option to purchase a static IP which will remove your connection from the NAT pool and begin translating inbound IPv4 connections as if they were direct native IPv4. I'm not sure why T-Mobile is unable to provide this for free to all consumers. It may be a result of simply not having enough IPv4 allocation available, in which case how is that ever going to be fixed without freeing up used IPv4s? Or, it may be a system scalability issue that may need resolved. Who knows, but understand this problem is a little bit more complex than simply clicking a button. Currently for consumer home internet plans, there are no options for inbound IPv4 addresses, or opting out of the NAT system that the rest of the mobile-device network uses.

phenomdadon wrote:

EricNorcal wrote:

 

Could you run thru a quick setup?? I'm jus tryna to game on my pc and Tmobile internet is blocking some of my games from connecting. I'm using Persistent SSH which is and alternative to autossh.

It would be much appreciated.

You’ll need to have these two settings enabled on the ssh server into which you are setting up the tunnels:

ClientAliveInterval 60
ClientAliveCountMax 2

Without these, the ssh connection will eventually die, even with something like autossh (presumably also Persistent SSH).

Then there is a tunnel per device/port from some ssh host on your LAN (like a Raspberry Pi or whatever) to the ssh out on the internet which you will be using as a gateway:

autossh -N -p22 -R *:8000:192.168.1.2:8500 user@gateway.host.net

That command sets up a tunnel between your Raspi (or whatever) on your LAN to the gateway machine, with a port 8000 tunnel to the 192.168.1.2 device on your LAN on port 8500.

So now I can reach port 8000 on the 192.168.1.2 device from the outside world from gateway.host.net:8500.

For example, if you want to be able to ssh on a device 192.168.1.33 (on port 22), then you could set up:

autossh -N -R *:8222:192.168.1.33:22 user@gateway.host.net

and then you can do “ssh -p8222 root@gateway.host.net” and you will be ssh’d to root@192.168.1.33 on port 22.

The T-Mobile network is working as designed.   NAT464 is a transition strategy.  Your phone, or your home Internet device, is assigned a public, globally routable, unique IPv6 address.  It is better for everyone, everywhere, if we speed up the transition to IPv6.  When you request an IPv4 site, your device does NAT46 and then carries the traffic to a NAT64 gateway operated by T-Mobile on the Internet edge.  It works very, very well.  The downside, of course, is that you do not have a globally routable IPv4 address on which you can expose ports.

It is possible to expose ports, but of course only on your IPv6 address.  This means that you would only be able to connect to it from IPv6 clients.  For many applications this is an acceptable tradeoff.  As the supply of IPv4 addresses continues to become more problematic, you should expect other providers to begin adopting this strategy as well.

It is possible to expose ports, but of course only on your IPv6 address.

No, it not possible to expose ports, even for IPv6 addresses, if you are using the gateway they gave me.

There is no provision for inbound routing at all; all inbound access is blocked.  I can't verify what they do for local IPv6 connections currently (DHCPv6 with SLAAC?), but the addresses assigned on the inside network were either not globally routable, or they are blocked at the router (for good reason).

So your solo choice for accessing a device/devices on the internal network of a T-Mobile Home/Business Gateway is through port forwarding through an external host, like ngrok or ssh forwarding through a server on which you have an account.

I can’t edit my post above, but I got the ports backward in this sentence:

So now I can reach port 8000 on the 192.168.1.2 device from the outside world from gateway.host.net:8500.

You would reach port 8500 on the LAN device via port 8000 on the internet host; my last example got the ports correct.

EricNorcal wrote:

No, it not possible to expose ports, even for IPv6 addresses, if you are using the gateway they gave me.

 

I suppose that's possible.  Maybe try a different gateway, like a MikroTik with your SIM card moved to it.  Most providers are shy to let just any IPv6 inbound connection succeed, since that would create a pretty obvious security problem.

By the way, if you want to open more than just a single port, I highly recommend Ace Innovative [https://www.aceinnovative.com/internet-access/static-ip-vpn/].  For $15/month you get an unrestricted IPv4 /29 and IPv6 /64 and they even send you the router.

@wildernessfamily Thank you for that well detailed response! I'm looking forward to that Youtube tutorial when you get around to it 😉