I recently signed up for T-Mobile internet, and I am VERY disappointed that I could not even forward NAT traffic to my home security system. I saw that this was discussed 7 months ago in a previous thread, and hope the developers will notice this. The speed is great, and the same as was advertised in the chat.I would like this issue to be resolved so that I don't need to continue with Optimum (Morris Broadband).

I'm fairly confident that this device (Nokia) is able to handle all of these things. I think what has happened here is T-Mobile threw a very locked down firmware on the device to make setup easy. The following things need to happen.Provide settings to place the gateway in bridge mode. This will allow customers to keep their existing setups and NAT fine.Provide settings to turn off the wifi in the gateway COMPLETELY. Turning off broadcast and reducing power to minimal is not sufficient.Make all of these settings accessible only through the web admin page. The average consumer doesn't need this stuff, but the power user who is smart enough to know how to login to the admin web page should be able to modify these settings. Ultimately, I just want "a dumb modem" just like I get with the cable co. I don't want or need T-Mobile helping me by dumbing down the device.

T-Mobile Home Internet uses CG-Nat - which means end users share IP addresses. Unless they move away from that (which they will not since it would require completely new infrastructure) you will not be able to do port forwarding. There simply is no way to identify YOUR unique address since you do not have one - it is shared. However, there is a solution which does work - I am using it. Paketriot https://packetriot.com/ allows tunnels to be created which will have a unique endpoint which will then allow you to hit a port in YOUR internal network. There are other providers like Packetriot. I like Packetriot because it has the option to create a Windoze Service for all your tunnels. Nice when the machine reboots because you can have the service autostart. Most of the providers offer a free tunnel so you can try it out.They should not call this Home Internet it is really a home hotspot.

They need to fix their screwy xlat464/cgnat style network first.As long as they continue to filter that unsolicited inbound traffic at the higher network layers, won't matter what options are available/configured on our local modems/routers. It is actually getting nixed at the outer edges of the networks, so it never makes it to the modem, much less the router.

I spoke with TMobile Home Internet technical support over the past week. They are working on the port forwarding feature within their 5g modem/router, but it's not available or ready yet. 2 different techs said they have a workaround, however (& it doesn't require 3rd party services).I haven't tested it yet, but what you need to do is, & many of us have this setup already, connect via Ethernet (wire) the garbage can LAN port <-> YOUR own router. Then configure port forwarding on YOUR router. That's it. (Your router needs to support ipv6! Not sure if we need to allow ipv6 passthrough for this.)Now, I was educated a long time ago on IPv4 & they barely touched on IPv6, so I don't know a lot about it, but this would never work this way with IPv6. Ipv6, however can allow passthrough so public "internet" can pass through a router, which is why I'm "buying" this theory. Ie, you can go through T-Mobiles garbage can, and then your router, and you device (call it a PC) could have a public IPv6 IP, which is why port forwarding could work this way.Anyone have time to test & report back? Or comments?I previously had a dynamic public IP (ipv4) that I made work with my domain name via ZoneEdit that allowed my PC to update ZoneEdit with public Ip changes since it was dynamic. With this NEW setup, I'm not exactly sure how that would work, or if my DNS service will play nicely or even support ipv6 or if ZoneEdit will either. And I have numerous services that I need to "hit" MY router & forward internally, such as a VPN, RDP, FTP, website, etc - not sure if all that will play nicely - or if all the services, like VPN client, can point to a domain->ipv6 ip & work. Like will the VPN client config & SW accept this new format?Anyways, lot of testing & messing around needed! Please report back with any updates!

I was researching a project I was doing and came across this thread. I have T-Mobile @ home internet. The speeds are amazing compared to what I had prior to T-Mobile. On the T-Mobile router, I have three bars out of 5. I have on average 300Mbps ↓ and on average 20-45Mps ↑. I'm very happy with the speeds. However, I can't connect to my Home Assistant, security cameras, and my media center. I have an ASUS router that I have flashed with OpenWRT and I have tried several tricks, including doing DDNS updates every 10 minutes to my DNS server, CloudFlare. Nothing really worked. I spoke to T-Mobile technical support. That was just painful. I went to a supervisor. Finally, I had to state, "I'm a 4th decade computer engineer, I have the highest licenses from the FCC in amateur radio communication. And what you are saying is so horribly incorrect". I spent an hour teaching the supervisor. Finally, I decided to try their business internet. It was the same price as the home internet. Plus, for an extra $3.00 I could have a static IP address. They send me this Inseego router. It wasn't even a quarter of the size of the @home internet router. It was about 1/8th of the size of the @home router. Before turning it on, I knew this was not going to work. Surprise, Surprise, it did not! Most of the time, I had the blue flashing light, meaning I barely had a signal. Sometimes it would switch to 4G. When I had only one bar (very weak signal), I was getting 14 Mbps ↓ and 2 Mpbs ↑. I found a spot in the house that I was getting three bars (good signal strength) and the speed was even worse. 8-14 Mps ↓ and 0.5 Mps ↑. This was not going to work. I cancelled the business account.I did find a workaround. Or the best that is possible with the situation we are all in.CloudFlare has a very generous free tier. I have many domain names. I have one that my entire family uses. CloudFlare has a very generous free tier on their Zero Trust feature. I use a Raspberry Pi Zero that costs $15.00. They're back in stock. If they are out of stock, they come back in stock very quickly. I have already received for this month (July 2023). I installed CloudFlared on the Zero W. Then in CloudFlare's Zero Trust I can set up sub domains to each device that I want. Home Assistant can have ha.familydomain.tld. Media Server, jellyfin.familydomain.tld, etc. Works with no problem. HOWEVER, there are two downsides. One, Zero Trust free tier does not "allow" and I use rapid quotes on allow. If you want to stream video, such as with your Plex or JellyFin Media server, you have to upgrade your Zero Trust plan to their $5.00 streaming service. However, as long as it's not to much, I heard they don't really say anything. But, technically, you could be cut off.Second, is that I have a NextCloud server for my family too. When, uploading files to NextCloud outside your LAN, you can only upload a max file size of 100mb due to CloudFlare's restrictions on their network unless you upgrade. Even if you upgrade, it's not that much. That's the only thing that's really horrible with this alternative work around to T-Mobiles restrictions on port forwarding. Other than that, it works very well!I'm going to create a YouTube video next week on how to set this all up. When I finish the video, I'll post an update with the link.Good luck!

NAT (Forwarding) in T-Mobile Gateway

EricNorcal
Network Novice
Hace 2 años
Just another success story here, if you’re the type who knows how to use SSH tunneling.
T-Mobile (business, in my case; don't think it matters) can't do port forwarding. But my ssh tunnel(s) worked, at least for a little bit. I use autossh, which re-establishes connections when they fail (due to routing changes, etc). It has been very reliable for me in the past to get around bad/broken NAT situations.
But I found that my ssh tunnels would only last for a short time (Arkadyan modem, using a router on the LAN connection). Then I read from another post somewhere else on this forum that t-mobile simply closes TCP connections without traffic after a period of time (looks like maybe as short as 5m).
So I changed the ssh settings on my server to add a keep-alive, and all is working perfectly. I have three ports forwarded on my LAN through an ssh connection to a server in the cloud; you could probably use ngrok for this (free accounts I think). I have a camera, ssh to a server, and another port forward to an IoT device, and all three have been working perfectly without interruption for over a week. I get between 120 and 250Mbps down and 30up pretty consistently.
I’m sold, and am currently on hold cancelling my AT&T DSL account!
Bogie
Network Novice
Hace 2 años
PortalWizard wrote:

My nat was strict and couldn’t play in a party on Xbox.

Great lad at customer service had me run 2 speed tests and that pushed me into whatever and now the nat is open. Yay for cgnat

What speed tests did he have you run? I've been trying to change it on my XBox series X and it won't even allow me to play a game
stevenclark612
Network Novice
Hace 2 años
You static ip the PC. 2) Use TCP View to find ports and ip addresses used by app. 3) Open on PC Firewall or Endpoint. 4) Open or port forward ports. 5)Test
BirdieShotz
Network Novice
Hace 3 años
I've been monitoring this thread for a year or so for the same issues. In my case I needed to get my webserver to allow incoming traffic from outside T-Mobile Home Internet to preview development sites.
Long story short, if you've got a similar use case, Tailscale did the trick for me. Installed the webserver as a VM on a Synology NAS, and Tailscale has a package that can be run on DSM. I add development site subdomains to public DNS and route to the tailscale address using an A record. Then I share the webserver tailscale node with whoever I want to preview the site, they connect to tailscale, type in the domain, and it works pretty great. Won't solve all issues I know….
For local development, I use VirtualMin and configure the primary IP address as the tailscale address, and I add the local address to the site-enabled entries in Apache and my hosts file. Takes a little configuring but I plan to post some steps on how in time. I added a quick article for now on my blog. Hope this helps somebody 🤷‍♂️
wase4711
Network Novice
Hace 3 años
CarSmart wrote:

So you can learn from my mistakes. First you will need a reason to switch to a business account, it is not unlimited data. Comes with 100 for 50 and 300 for 70/month. Can I do port forwarding? Don't know yet but will post the results

it comes with unlimited data, at least on my plan it does
tjwang668
Network Novice
Hace 3 años
@carSmart: Actually, I already successfully opened a small business account with unlimited data for $50/month with TMO by using my EIN (TMO allows SBA under your SSN but because I already have a TMO family plan under my SSN and I don’t want to convert my family plan to biz plan) and got inseego FX2000 gateway (after several phone calls to the right department) and tried it out.
I configured gateway port-forwarding for my security camera system, however, it seemed only working when my iPone connected to LAN. When I tried to view my camera remotely from work, either connected to work WiFi or TMO network, I was unable to view them at all. I think it was not just simply port-fowarding issue, TMO might block port-access request in the front end.
TMO also blocked access to some websites due to their contents or securities.
I also found speeds of FX2000 unstable. Speed of ethernet gave 200Mbps and above, while 5G WiFi speed went down to 10Mbps and 2,4G WiFi speed went down to 10Mpbs, both WiFi speed changed frequently, unless I placed the gateway next to my computer. I have very strong TMO 5G coverage in my area. FX2000 came without external antenna, which I think that was the reason and T-mobile should provide external antenna to FX2000 users.
Anyway, after trying it for a week, I decided to cancel it and stayed with ATT U-verse.
I will re-consider TMO internet once it can offer bridge-mode on their gateway. At this monent, it just couldn't meet my requirement.
CarSmart
Network Novice
Hace 3 años
So you can learn from my mistakes. First you will need a reason to switch to a business account, it is not unlimited data. Comes with 100 for 50 and 300 for 70/month. Can I do port forwarding? Don't know yet but will post the results
tjwang668
Network Novice
Hace 3 años
Jackson300zx wrote:

Not sure if anyone answered this exactly yet.....But, sounds like you can port forward. What you need to do is switch over to a business account. The monthy cost is the same, but you have to add $5 per month for a static IP address and also get their FX2000 modem. Then you can port forward. I have not tested it yet, I literally just ordered it.
Servicio:
https://www.t-mobile.com/business/solutions/business-internet-services/small-business-internet

Modem:
https://inseego.com/products/fixed/fx2000-tmobile/

@Jackson300zx: Just to follow up if you have successfully tested the NAT and Port-forwarding features of inseego FX2000 gateway. I talked to T-mobile rep about this and she told me that
Small Business Internet (SBI):
Gateway: Nokia 5G21 and Arcadyan KVD21
Note: Static IP eligibility - Not Included
Business Internet (BI)
Gateway:
• Nokia 5G21
• Inseego FX2000
• BYOD (Bring your own device)
Note: Static IP eligible (Inseego only)
Only BI can ask for static IP, not SBI
CarSmart
Network Novice
Hace 3 años
Thanks for the update, I ordered one too. Not sure what I am getting but it is coming. Will update when it arrives
mrbintx
Network Novice
Hace 3 años
Thanks for the responses.
I ended up taking the SmartThings hub to my current home (where I have Frontier FIOS service) and I got the SmartThings hub online there. I then moved the hub to my new home (T-Mobile 5G service) and connected it via Ethernet to the modem. It came online and has been working well. It appears the issue is only with the initial registration.