In the previous article, I covered a different aspect of home Internet networking. I showed, with references to EU regulations, that users have the right to choose the equipment they use to access the Internet instead of being forced to use their ISP's device(s). I also explained which devices are actually needed in a home network and what each of them does.
I still remember that this series is about OpenWrt, and that's exactly where it's heading.
Before getting there, though, there's one important question to answer:
How does a router actually get onto the Internet? What happens the moment an Ethernet cable is plugged into the router's WAN port?
Part 0.5:
├ what your ISP can and cannot require
├ OpenWrt
├ home internet (WAN & Fiber)
└ ONT vs modem vs router
1. IP address lease
IP addresses can be imagined like mailing addresses, while network traffic, divided into packets, can be imagined like envelopes carrying letters. When you stumbled upon this article, your device actually started communicating with Dev.to's IP address (after Google redirected you here). Every request your browser makes is sent to one of Dev.to's servers, which has its own IP address. While you're reading this article, that communication doesn't stop. Your browser keeps exchanging packets with the server: loading images, checking for new data, fetching comments, and so on.
You can think of this address as the "door" between your home network and the rest of the Internet. It is the address through which you interact with the Internet and through which the Internet can interact with you.
The important thing to understand is that this address has nothing to do with whether you use your ISP's router, a GL.iNet Flint, or any other router. Your public-facing address is assigned by your ISP, not by the router sitting in your home.
NB! In the scope of this article I'll only talk about IPv4 addressing because it still dominates, and, for example, my ISP doesn't give me an IPv6 address at all.
When the ISP's technician gets all the network shaitan machinery working (the ONT, the router, or a single device that combines both), the router contacts the ISP's DHCP server - (in most residential connections) (I'm skipping PPPoE) — and asks to join the network.
1.1 DHCP
DHCP stands for Dynamic Host Configuration Protocol.
Whenever a device connects to a network (client), it needs some information about this network to join it. Most importantly, it needs its own IP address on that network. It also needs to know the address of a router (the default gateway) that can forward traffic to other networks, and usually the address of one or more DNS servers that can translate domain names into IP addresses.
Without DHCP, all of this information would have to be entered manually on every device. DHCP automates the process by assigning an IP address and providing the rest of the network configuration automatically.
DORA process:
- Discover – The client: "Is there any DHCP server out there?"
- Offer – The DHCP server: "Yes! You can have 192.168.0.4."
- Request – the client politely asks: "I'd like to use 192.168.0.4, please."
- Acknowledge (ACK) – The server: "Approved. It's yours."
Once the router is connected to the WAN, it broadcasts a DHCP request (DHCPDISCOVER message to locate available DHCP servers). The ISP's DHCP server receives it and assigns the router an IPv4 address.
An IPv4 address is a number like 103.130.238.205, 8.8.8.8, 192.168.1.8, or 10.1.6.7. You can check the address with which you present yourself to the Internet on What is my IP address?.
2. Network address translation
After clicking the link above and seeing an identified address, you may think that it is your own unique personal address, almost like a tax number... BUT! no worries, in all likelihood, it is...:
Shared IP address???
But for the envelopes (data packets) to reach the correct destination, your public (visible on the Internet) IP address has to identify where they should arrive after being requested. You might therefore expect every Internet user to have their own unique public IP address... but nowadays it's very often not the case. ISPs can make thousands of customers share the same public IP address.
WHY and HOW does this network communication not become a complete mess?
WHY: It is because of the scarcity of IPv4 addresses. There are only about 4.3 billion possible IPv4 addresses (2³², since an IPv4 address is made of four 8 bit numbers). That may sound like a lot, but it really isn't. Before we even talk about enterprises, think about households. Nowadays it's completely normal for 2 people living together to own 4 - 6 Internet-connected devices each... Imagine if every single one of them needed its own unique public IP address just to access the Internet, 4.3 billions does not sound that big anymore.
HOW: Network Address Translation (NAT) and Carrier Grade NAT.
NAT literally does what its name says: it translates network addresses. But who performs this translation? Your router. And we are back to the main character of this article.
I mentioned that the router creates Local Area Network. In case of house Wi-Fi this LAN becomes a network of all devices in this house connected to the same network created by router in wired or wireless mode. Inside this network, every device has its own UNIQUE PRIVATE IP address (192.168.x.x, 10.x.x.x, etc.), which cannot be reached directly from the Internet. In most of the cases, router handles the assignment of IP addresses to members of its network with his DHCP server.
Why can't these private addresses be reached directly from the Internet? Because they were explicitly reserved for private networks.
There are 3 private IPv4 address blocks: 10.0.0.0/8 (all 10.x.x.x);
172.16.0.0/12 (all 172.16.0.0 – 172.31.255.255);
192.168.0.0/16 (all 192.168.x.x). If your device has one of these addresses, it is not directly reachable from the public Internet. These addresses are free to reuse in millions of different homes, offices, schools, and companies all over the world because they are only meaningful inside their own local network.
Internet
|
Public IP: 77.104.200.1
|
Your Router --> does NAT
|
-----------------------------
192.168.1.10 PC
192.168.1.20 Phone
192.168.1.30 Some robot
So, if my PC got 192.168.4.17 from the router, how does it reach the Internet?
Whenever a device that is part of the LAN opens a website, the router remembers something like:
laptop: 192.168.4.17:portX
↓ sent request to (Persian cats website)
92.113.23.178
and when another device opens another website:
mobile phone:192.168.4.20:portY
↓ sent request to (Parmesan choooeeese)
89.118.107.132
The router also replaces the private source address (192.168.x.x) with its public IP address before sending the packet out to the Internet.
When a reply arrives from 89.118.107.132, the router looks it up in its NAT table and forwards it to the mobile phone. When a reply arrives from 92.113.23.178, it forwards it to the laptop, which happily displays a huge Persian cat picture.
Your router continuously keeps a lil table of these address and port "translations". This is called the **NAT table.
When replies come back, the router knows exactly which device requested them and forwards the packets accordingly. This translation between private and public addresses is called Network Address Translation (NAT).
The important part is that only the router's PUBLIC IP address is visible on the Internet. All devices in your house LAN are identified in Internet by this address. And that public IP address is assigned by ISP.
Now, about CGNAT.
2.1 CGNAT
Carrier Grade NAT (CGNAT) is NAT performed by ISP. Instead of a handful of devices in your home LAN sharing one public IP address, thousands of customers with their dozen of devices can share the same public IP.
The routers of those customers don't receive public IP addresses on their WAN interface. Instead, they receive carrier-private addresses from ranges reserved for that purpose.
ISP keeps track of every connection and makes sure all little packettini travel to the Internet and reach back the correct customer. It acts like a giant traffic controller, making sure replies from the Internet always end up at the right destination.
Public IP
93.44.120.15
|
ISP Carrier-Grade NAT
---------------------------------
| | |
Your router Alice's router Bob's router
192.168.1.x 192.168.0.x 10.0.0.x
Every customer still has their own private home network, but the ISP performs another NAT before packets reach the Internet. So if you are CGNAT-ted by your ISP then when you visit a website, the chain actually looks like this:
Your device (192.168.4.10)
↓
Your router → performs NAT
↓
10.x.x.x (carrier-private address assigned by your ISP)
↓
ISP CGNAT
↓
93.44.120.15 (the public IP address visible on the Internet)
↓
Internet
Your ISP keeps a ginormous translation table that remembers which customer each connection belongs to. That's why everything still works, even though hundreds of people appear to have the same public IP.
Why CGNAT is nasty?
What to care about? For normal browsing, gaming, streaming, YouTube, Discord ... nothing to worry. The problems start when someone on the Internet needs to initiate a connection to you.
For example, suppose you want to host a Minecraft server or SSH into your home PC from your friend house. If you had a stable public IPv4
With a normal public IPv4, you can just simply configure port forwarding on your router.
Internet
|
93.44.120.15:1234
|
Your Router (rule: redirect stuff to 192.168.1.50:4321)
|
192.168.1.50:4321
Anyone connecting in SSH 93.44.120.15:51820 reaches your PC.
With CGNAT, it is impossible. Because there are many other devices sharing same IP. The ISP has no idea where to send arrived requests, because nobody created that connection from inside first. Incoming connections are simply dropped, and port forwarding on your own router becomes useless. Your router never even gets the packets.
But it is not all that hopeless. Most of ISP provide a service for a humble (not really) remuneration of static public IP. Fastweb (my ISP) provides for 3 euros extra per month.
Whether you're using a router with OpenWrt or your ISP's router, NAT works exactly the same way. Understanding it now will make everything that follows - port forwarding, WireGuard, VLANs, and firewall rules - much easier.
Top comments (0)