NAT (Forwarding) in T-Mobile Gateway

@arcanenox OpenVPN here since our existing ADSL with TDS allows our public IP to be reached. But for your issue specifically I don't have a tidy solution given I was going to suggest Cloudflare's Argo Tunnel, but it looks like it might be limited to protocols that can give a hint to what service they're trying to access or require software on the client otherwise for some turducken solution. https://danishshakeel.me/creating-an-ssh-tunnel-using-cloudflare-argo-and-access/

Full disclosure, I’m not certified in any capacity for network engineering: I’m a hobbyist.

But having to establish a tunnel with Argo then OpenVPN for local access is obviously not a nice solution. If someone has a better solution it'd be nice, but my working theory if I have to deal with this is renting a cheap VPS and set up OpenVPN to connect my firewall to with some route trickery to route traffic from the VPS to the firewall over OpenVPN. And if I'd want to expose a service from within my network then I'd use a IP Table rule to port-foward the traffic.

E.g.

VPS OpenVPN announces it handles IPs going to 192.168.0.0/16, 192.168.7.0/24 is where VPN clients live, and 192.168.1.0/24 is where the home network lives.

IP route on the VPS to direct 192.168.1.0/24 to whatever IP the firewall is given by OpenVPN (192.168.7.2 as example.)

IP route on the firewall (if needed) to direct 192.168.7.0/24 to the VPS (192.168.7.1 as example.)

So when I'm connected to the VPS VPN, accessing a service on 192.168.1.5 routes to the VPS, the VPS routes to the firewall, and the firewall routes it to the service. And the service can reply back in reverse order.

Overall hopefully reducing cruft in the connection. But does mean trading the OpenVPN job from my firewall to the VPS and losing some convenience (I can mint config files in pfSense to quickly get my devices working as an example.)

@jarrodsfarrell what solution are you using to tunnel? I've setup ngrok to get around the port-forwarding on a laptop running behind the T-Mobile 5G POS Modem, but it's not persistent. Every time I lose power or the internet connection is interrupted, the tunnel drops and I lose all remote connectivity. With CG-NAT I don't see how it's ever going to be possible to host an OpenVPN server from inside my network, even with port-forwarding, so I have to find something more durable.

On the waiting list ‘ere.

As far as I’m reading there’s passthrough which’ll let me reuse our existing network and maybe treat the modem as a dumb modem like we're doing to our ADSL modem. Our modem doesn't even do the job of providing DHCP; effectively as if we connected directly to our ISP's network.

Sin embargo,, from reading it sounds like T-Mobile is doing carrier level NAT for IPv4 similar to what I’ve been hearing with Starlink on their equipment; basically I could be sharing 18.0.12.3 between five other customers.

And IPv6 is not our silver bullet since it sounds like T-Mobile’s network is filtering requests before it even hits the equipment if I’m understanding what I’m reading.

IPv4 is a nice-to-have but at the same time it's deadweight going forward since IPv4 served it's purpose and is more of a nuisance. I can grab a IPv4 address---until IPv6 reigns supreme on public Wi-Fi---and set up tunneling and be happy with that so I can control my smart-home server wherever.

Spanx wrote:

I agree TMobile could have made this much easier by providing an internet facing IP address, as well as IP scope control and other things. But there are easy ways to get your setup working if you have another router.

To start, just have another router and connect either of the yellow ports of the TMobile gateway connected to the internet port (WAN) of your router. Now you have complete control over your internal network with DHCP, Scope, Static IPs if you want, Firewall rules for the internet, etc.

The next thing is to use something like the free version of TeamViewer, which will create the path through the internet to your computer for remote access and you can remote into your computer from outside the network whenever you want.

For security system viewing, just setup the viewing app on your home computer (which you probably already have) and remote into your computer and view your cameras that way. TeamViewer has a version for Windows computers, phones, tablets, Linux, MacOS, Raspberry Pi. So pretty much any device you have.

I know this is a workaround for T-Mobile's lack of services on the gateway, but it works great, it's reliable, it's a free solution, and restores functions many people need. It's also only takes a couple of minutes to setup. I use it all the time and I have no issues. I'm sure you could do this with other remote services that are available, but I prefer TeamViewer over many of the non-trusted remote services available.

Good Luck

The problem with that is we are out of IPV4 IP addresses. We have been out for a while now. The world seems to be incredibly slow at adapting to IPV6. I'm sure between costs for the ISPs and the ancient devices out there that have never or will ever be updated for IPV6 is also an issue. Now an easier solution would be for T-Mobile to just give us a usable IPV6 address as many of our modern devices will be able to use that. 

I agree TMobile could have made this much easier by providing an internet facing IP address, as well as IP scope control and other things. But there are easy ways to get your setup working if you have another router.

To start, just have another router and connect either of the yellow ports of the TMobile gateway connected to the internet port (WAN) of your router. Now you have complete control over your internal network with DHCP, Scope, Static IPs if you want, Firewall rules for the internet, etc.

The next thing is to use something like the free version of TeamViewer, which will create the path through the internet to your computer for remote access and you can remote into your computer from outside the network whenever you want.

For security system viewing, just setup the viewing app on your home computer (which you probably already have) and remote into your computer and view your cameras that way. TeamViewer has a version for Windows computers, phones, tablets, Linux, MacOS, Raspberry Pi. So pretty much any device you have.

I know this is a workaround for T-Mobile's lack of services on the gateway, but it works great, it's reliable, it's a free solution, and restores functions many people need. It's also only takes a couple of minutes to setup. I use it all the time and I have no issues. I'm sure you could do this with other remote services that are available, but I prefer TeamViewer over many of the non-trusted remote services available.

Good Luck

teckel wrote:

inteller wrote:

Holy sh* man you are saying exactly what I'm stating!  The right thing to do would be instead of trying to work against me, work WITH me to pressure T-Mobile to get this deivce more functional and then we can ALL do whatever we want with it.

 

 

 

All T-mobile has to do is enable the device to bridge.  That's it.  I know this because that's how my cable modem worked and I was able to do everything else I wanted from there.  So if you want to sit there and tell me the networking configuration I used for YEARS was 'incorrect' and didn't work, go right ahead…..but you are not helping. You can be an apologist for why they don't enable these things, but this device is for HOME INTERNET.  I do not sit at home on my phone and nothing else. If that is T-mobile's position then I'll be returning it and wait until they grow up.

Actually, we're not at all saying the same thing.  You believe the modem could be updated with a few feature and it would work.  I'm saying that's not the case, as you're basically behind T-Mobile's NAT/VPN so enabling features on the model wouldn't solve the problem one bit.

How exactly do do believe enabling bridge mode would solve your problem?  You're comparing your cable company's network with T-Mobile, which are TOTALLY different.  Your cable company didn't hide your connection behind a NAT/VPN.  You could identify your home connection with a unique IP address which you could access remotely (with or without a DDNS like NoIP).  But T-Mobile's network doesn't work like your cable company.  Every connection is like a VPN or NAT, where there's not a unique IP address, but it's shared with many other people.

So, lets's say bridge mode is available on your T-Mobile modem.  How would you remotely access your home modem?  By IP? Via a DDNS like NoIP?  Nope!  As there's still not a unique IP address assigned to your home connection, it's shared with thousands of other people.  So you would try to access your home network and it could never route to your home.

So I'm sorry, you don't know what you're talking about.  You have limited knowledge and basing your assumptions on how your cable company's network is configured, when in reality T-Mobile's network isn't at all setup the same way, and as a result, your assumption that bridge mode will solve everything is totally wrong.  Sorry, it's not as simple as that.

You are forgetting, that T-Mobile LTE gateway works just fine when switched into a bridge mode! So, it is not the network issue per se, it is a firmware issue on this 5G trashcan.

ok, so this is an interesting conversation, I came here via google for the same reason you guys did. I live in an RV, so a service like this is super interesting to me, but I also work in tech and some kind of public access to the network behind the T-Mobile device is pretty important to me for stuff like HomeAssistant, some kinds of file transfer I have to use, etc.

idk if T-Mobile is “incapable” of not using CG-NAT for this. if you’re doing NAT you can do routing; they’re comparable levels of compute-intensiveness. whether or not they will actually do it is another question; I am also skeptical (though this would be huge for me).

in my particular situation I have a lab environment with a public-facing IP hosted for me at a datacenter not far away from me. has anyone tried using Nebula to solve this "no publicly routable IP" issue? (Nebula is more or less self-hosted ZeroTier, I think) https://github.com/slackhq/nebula

inteller wrote:

Holy sh* man you are saying exactly what I'm stating!  The right thing to do would be instead of trying to work against me, work WITH me to pressure T-Mobile to get this deivce more functional and then we can ALL do whatever we want with it.

 

 

 

All T-mobile has to do is enable the device to bridge.  That's it.  I know this because that's how my cable modem worked and I was able to do everything else I wanted from there.  So if you want to sit there and tell me the networking configuration I used for YEARS was 'incorrect' and didn't work, go right ahead…..but you are not helping. You can be an apologist for why they don't enable these things, but this device is for HOME INTERNET.  I do not sit at home on my phone and nothing else. If that is T-mobile's position then I'll be returning it and wait until they grow up.

Actually, we're not at all saying the same thing.  You believe the modem could be updated with a few feature and it would work.  I'm saying that's not the case, as you're basically behind T-Mobile's NAT/VPN so enabling features on the model wouldn't solve the problem one bit.

How exactly do do believe enabling bridge mode would solve your problem?  You're comparing your cable company's network with T-Mobile, which are TOTALLY different.  Your cable company didn't hide your connection behind a NAT/VPN.  You could identify your home connection with a unique IP address which you could access remotely (with or without a DDNS like NoIP).  But T-Mobile's network doesn't work like your cable company.  Every connection is like a VPN or NAT, where there's not a unique IP address, but it's shared with many other people.

So, lets's say bridge mode is available on your T-Mobile modem.  How would you remotely access your home modem?  By IP? Via a DDNS like NoIP?  Nope!  As there's still not a unique IP address assigned to your home connection, it's shared with thousands of other people.  So you would try to access your home network and it could never route to your home.

So I'm sorry, you don't know what you're talking about.  You have limited knowledge and basing your assumptions on how your cable company's network is configured, when in reality T-Mobile's network isn't at all setup the same way, and as a result, your assumption that bridge mode will solve everything is totally wrong.  Sorry, it's not as simple as that.

Holy sh* man you are saying exactly what I'm stating!  The right thing to do would be instead of trying to work against me, work WITH me to pressure T-Mobile to get this deivce more functional and then we can ALL do whatever we want with it.

All T-mobile has to do is enable the device to bridge.  That's it.  I know this because that's how my cable modem worked and I was able to do everything else I wanted from there.  So if you want to sit there and tell me the networking configuration I used for YEARS was 'incorrect' and didn't work, go right ahead…..but you are not helping. You can be an apologist for why they don't enable these things, but this device is for HOME INTERNET.  I do not sit at home on my phone and nothing else. If that is T-mobile's position then I'll be returning it and wait until they grow up.

inteller wrote:

I can't use noip with t-mobile because it doesn't support it, but if it was just bridging I could.

 

I'm not willing to wait around for another device when the speeds I get right now are just fine and the device I have is capable of the functions I need.

Sorry, you're incorrect.  You can setup NOIP on other devices other than just your modem.  I set it up on my local server.  But, this doesn't work as T-Mobile doesn't assign you a unique IP address (it's shared with hundreds/thousands of other people).  So even if you setup NOIP, that doesn't help one bit.  Nor would port forwarding or bridge mode.

You're failing to understand the problem.  The issue is how the T-Mobile network is setup for a security aspect.  It was setup to be a secured network for phones.  It's not capable of working with a DDNS service, bridge mode, or port forwarding.  That's why they disabled these features on the T-Mobile modem, as they would never work.  Keep in mind that Nokia added these features to this modem firmware when they designed it (for other markets).  When T-Mobile wanted to use it, they had to disable features as they don't work on their network, not because they wanted to limit the device.

The new modem won't resolve the problem either.  It may happen along with a T-Mobile network change, but a modem alone can't fix the problem, either a firmware update or new hardware.  The only work-around is a service like ZeroTier until T-Mobile changes their network, which very well may never happen.