Working around CGNAT - is it possible?

If you are looking at this, you may be in a situation where the internet connection provided by your ISP is something called Carrier Graded NAT (CGNAT). StarLink is a CGNAT ISP.

From Wikipedia:

Carrier-grade NAT (CGN or CGNAT), also known as large-scale NAT (LSN), is a type of Network address translation (NAT) for use in IPv4 network design. With CGNAT, end sites, in particular residential networks, are configured with private network addresses that are translated to public IPv4 addresses by middlebox network address translator devices embedded in the network operator's network, permitting the sharing of small pools of public addresses among many end sites. This shifts the NAT function and configuration thereof from the customer premises to the Internet service provider network (though "conventional" NAT on the customer premises will often be used additionally).

Carrier-grade NAT is often used for mitigating IPv4 address exhaustion.[1]

CGNAT techniques were first used in 2000 to accommodate the immediate need for large numbers of IPv4 addresses in General Packet Radio Service (GPRS) deployments of mobile networks. Estimated CGNAT deployments increased from 1200 in 2014 to 3400 in 2016, with 28.85% of the studied deployments appearing to be in mobile operator networks.[3]

In the FlexRadio world CGNAT breaks SmartLink since the user (client) can call the radio (server) directly which gives you a simple connection that is reliable and also has low latency.

In order to get around this, you need both the radio (server) and user (client) to do their initial connections outbound and calling (like phoning) to a common server (Cloud). As I am going to show you, this does work, but there are huge trade-offs.

SmartEther VPN has a feature called VPNAzure. In order to get this to work, you will need to install a VPN Server on the same network (subnet) as your radio. This can be simply done on a Rasberry PI and a model 3 is more than fast enough. You can also run it on a local PC.

The picture below sort of shows the setup. You have the radio (server) on the left side and the user (client) on the right side.

Directions on solutions can be found on the SoftEther web site: https://www.softether.org/4-docs/2-howto/6.VPN_Server_Behind_NAT_or_Firewall/2.VPN_Azure.

The really high level basic steps are:

1. Install and configure a SoftEther VPN Server on the Radio network https://www.softether.org/4-docs/2-howto/1.VPN_for_On-premise/2.Remote_Access_VPN_to_LAN
2. Configure it for using the VPN Asure Cloud (you can have normal VPN stuff too) https://www.softether.org/4-docs/2-howto/2.VPN_for_Cloud/3.Cloud_to_LAN_Bridge_VPN
3. Install SoftEther VPN Client on your Laptop https://www.softether.org/4-docs/2-howto/1.VPN_for_On-premise/2.Remote_Access_VPN_to_LAN#Step_4._Set_up_VPN_Client_on_Each_Member's_PC

With all that completed, you can give it a try.

1. Make sure the VPN server is running
2. Start the VPN client on your PC from a 'remote' location, even paired to a cell phone to test and make sure it connects.
3. Start SmartSDR and you should be able to see your radio. Go ahead and try to connect.

I had to mask out some of my target IP addresses but you see that SmartSDR can actually see both of my remote radios. This shows me that the Layer 2 UDP broadcast packets made it over the VPN and that my remote PC is now on the same SubNet.

Downside

• It can be complicated to set up if you do not have any networking knowledge. It doesn't take much to learn, so you can do it by asking questions of those that know it already. Give it a try, you can't really break anything if it doesn't work.
• Latency - when I tested it, the audio on SSB was running over 3-400ms behind reality
• SmartSDR may crash at times if the latency goes LONG. When we use SmartLink it has different software to handle longer response times. Over a VPN like this, SmartSDR does not think it is on a long haul network

If you got this far, good for you. If you are motivated enough, you may wish to give this a try.

Is this the only way? No, but I think it is one of the easier ways with limited customization. Network savvy hams will have many ways to achieve this sort of solution.

If Networks are new to you, you can now see why FlexRadio created SmartLink and why it is so simple to use today. We do all the heavy lifting for you with SmartLink.

If you have an issue working on this, feel free to ask here in the community. Please do not open a support ticket as we won't be able to do this for you, sorry.

73, Mike va3mw