(Sorry if this is too off-topic:) ISPs seem designed to funnel people to capitalist cloud services, or at least I feel like that. And it endlessly frustrates me.
The reason is even though IPv6 addresses are widely available (unlike IPv4), most ISPs won’t allow consumers to request a static rather than a dynamic IPv6 prefix along with a couple of IPv6 reverse DNS entries.
Instead, this functionality is gatekept behind expensive premium or even business contracts, in many cases even requiring legal paperwork proving you have a registered business, so that the common user is completely unable to self-host e.g. a fully functional IPv6-only mail server with reverse DNS, even if they wanted to.
The common workaround is to suck up to the cloud, and rent a VPS, or some other foreign controlled machine that can be easily intercepted and messed with, and where the service can be surveilled better by big money.
I’m posting this since I hope more people will realize that this is going on, and both complain to their ISPs, but most notably to regulatory bodies and to generally spread the word. If we want true digital autonomy to be more common, I feel like this needs to be fixed for consumer landline contracts.
Or did I miss something that makes this make sense outside of a big money capitalist angle?
If you have control over at least the root of your network you can totally get away with hosting in a dynamic pub ip. You just need to set up dynamicdns. There are other ways of handling this specific issue too. You can always go to a colocation and set up a server there if you want. You could also create your own reverse proxy tunnel in a place that is public then forward it. There are lots of work arounds really. Yeah, it sucks that American ISPs generally don’t support ipv6 but there are totally ways to work around it all.
What really gets me up in arms is when they advertise gigabit connections or 500mb speeds only to limit upload to 20mb/s. That is where they are actively inhibiting self hosting communities.
Even in an ideal DNS setup, you’re probably going to have downtimes whenever your dynamic IP changes. If only because some ISPs even force-disconnect you after a while to change your address.
I mean I’ll be real. Sure in some circumstances that could be an annoyance for 15 seconds for some software that might rely on a session whenever your ip changes like once a month if that. A rotating ip is probably one of the easiest things to work around amongst the plethora of challenges that ISPs present for those who want to self host.
I mean just take a look at what is involved if you are in a situation where cg-nat is implemented. You legitimately have no control over the root of your network at that point. I have that issue in particular with what is essentially a mobile hotspot as my failover for when my fiber fails. That being said I had to architect it in a way that took that took cg-nat into consideration. If I hadn’t then when fiber fails it would take down my services as a whole anyway.
My point is that those challenges have workarounds, you can solve those issues relatively easily and they even present a level of security. Where it is actively malicious is with restrictions to capacity such as upload limits in which they to a degree lie about their speeds and capacity. The terms of service stuff is just flat out awful too.
Some ISPs require changes ever 24 hours and will disconnect you if needed. Also, if you set DNS to cache such a short amount of time that you can react to that in 5 minutes, you will incur way more DNS traffic which can become a problem when your site is busier. Also, even if your DNS TTL is set to a super short value, a web search suggests to me in practice there will likely be downstream clients and networks that ignore it and won’t really update in such a short time frame.
What ISP are you referring to? I have genuinely never heard of an isp that takes 24 hours to rotate your IP. Also utilizing dynamicdns is not going to incur more dns traffic? Dynamic DNS updates your dns provider from a system on your local network that your pub ip has changed then your provider will start sending traffic to the new ip. Propagation used to take a while but I haven’t experienced propagation wait times of over 10 minutes in years. This all being said dynamic DNS isn’t exactly the most elegant solution. It is just one of the simplest that I mentioned. There are significantly better options overall that completely take the requirement of a static pubip completely out of the equation and can be built using all free open source tools relatively easily.
My dynamic IPv6 prefix hasn’t changed in a couple of years. It only changed because I reset the router config and that changed my DUID. That’s good enough for everything I host. I don’t even bother with dynamic DNS anymore.
I wouldn’t bother with trying to host an email server from a residential connection though. Even if you can get your ISP to open port 25 for you, many email servers won’t accept mail from residential IP addresses.
I think there are still enough v4-only systems out there that you don’t really want to host a mail server on v6. You are right though that it would be nice to be able to get static v6 (or for that matter v4) addresses from home isp’s. Some do offer that of course.
Another issue can be that the average home internet user has no idea keep even a client system secure. So ISP’s might use NAT and default firewall configurations partly to stop incoming connections on the theory that they are likely to be malicious. On home routers you can usually open ports if you know what you’re doing. I don’t know if that’s even possible on mobile phones.
IP blocklisting is still very much a thing as well so you can expect any mail originating from a residential IP to be rejected due to their /24 or larger having previously sent spam, and that assumes you can send server-to-server mail (destination port 25/tcp) in the first place since many ISPs and server providers block traffic destined to that port by default to prevent users from getting their IP blocklists. My home ISP blocks outbound SNMP traffic (or at least did 10 years ago) presumably to also prevent abuse. That said, things like blocking inbound port 80/tcp and 443/tcp is purely a measure to prevent people running servers at home which I’m not a fan of.
Yes, that too. I hadn’t even thought about trying to send email from a home ISP. Everyone knows you basically can’t. I thought the idea was to receive email rather than send it, so you wouldn’t be relying on some bigtech company to store it for you.
If you’re looking for sympathy, you got it. Fuck the state.
If you’re looking for solutions, use a cheap $5/mo VPS that exists purely as your gateway host. Run everything you want on your home machines, then tunnel the traffic to your gateway and reverse-proxy it there. Your data stays in your hands, you can spin up and expose new services publicly in a matter of minutes, AND your home IP isn’t vulnerable to doxxing or DoS.
@dgdft @ellie @selfhosted this is the way
While I agree on a practical level, and pragmatism sure is important, long term that workaround still keeps you paying for cloud services and gives cloud companies an easy way to directly man-in-the-middle your traffic. So I’m hoping one day the situation will improve.
@ellie @selfhosted what is the actual alternative? also, not all vps are offfered by megacorps.
The alternative is to get your ISP to offer you a static IPv6 and a reverse DNS PTR entry for your IPv6, like I asked for in the initial post. Some ISPs do if you offer them more money, some only do if you offer them more money and a legit business registration, apparently a few rare ones do it for free, and some never do it.
Once you got the static IP, you can point DNS directly to yourself, and there’s no VPS or anything in between. Browser traffic and so on directly comes to your machine.
use a cheap $5/mo VPS that exists purely as your gateway host
Now, why so expensive?
https://racknerdtracker.com/?sort=price
Disclaimer: I never used Racknerd (nor any other VPS).Thank you sir!
“JUST $10.28/YEAR - WOW!!” Laughed out loud at that, and I’ll have to give this a look. Currently I just use nginx and duckdns to expose my home IP for my self hosted stuff.
deleted by creator
I basically do exactly this, but I am running the reverse proxy on my home computer: the VPS is literally just acting as a proxy, for which I use wireguard to tunnel the connection. So far it’s worked great, though initial setup was a pain.
This is a great suggestion!
Lest anyone miss the buried lede, this approach means that traffic is pre-encrypted as it passes through the gateway VPS - so even if your VPS gets hacked, it’s way harder to steal credentials and break into the services running on your home network.
So you essentially have a DMZ between your VPS and home network that is divided by your reverse proxy?
Is there a more detailed guide to this practice and the pros/cons?
This is @Shimitar@downonthestreet.eu‘s work, not mine - but it’s pretty similar to how I’d set things up:
https://wiki.gardiol.org/doku.php?id=networking%3Assh_tunnel
Really appreciated the reference!
Good to know my wiki is of any use to somebody.
:)
Thanks king, this actually makes sense!
You’re not wrong. And the line between evil and laziness here is too messy for me to sort out. We got into this mess because the internet was originally designed as a communication tool between business, university, and government. Specifically, Bell Labs connecting universities as part of the military project DARPA. Since they were connecting dozens of sites, the 4 billion addresses (2^32) seemed like plenty.
Skipping over dialup and forward to early broadband, the issue of the number of addresses problem was ‘solved’ by a clever firewall technique network address translation (NAT). It was adversited as a security feature, but it allowed ISPs to give one public IP per customer. This standardized things for them - they give you one IP and you multiplex it as you wish. However, since the average customer wanted a turnkey solution, the ISPs would then toss in the modem as a rental. (Also, as enshitification hit this rental modem started getting more user hostile.)
But at this point ISPs are engorged and lazy and redoing everything is a chore, so they got one IPv6 space for everyone, and set up their IPv6 servers to assign chucks of that space based on your assigned IPv4 address. Easy-peasy! Now none of their other management or billing systems have to change! Of course, now your v6 space moves anytime your v4 space does but -they always have those business accounts to sell you …
A diamond in the rough: When I was younger, working at a data center and IPv6 was new, I found this gem coupled with IPv6 world day (via Reddit): https://tunnelbroker.net/
Hurricane Electric was/is happy to give you a free static IPv6 /48 prefix, and you could tunnel your home connection directly to this (like a site to site VPN). Their catch is if you start pushing significant traffic you’ll have to pay market rates. But if your goal is to add a free static IPv6 frontend to your home network, this has been here the whole time.
Similarly, I’ve read Cloudflare’s Terms of Service [privacy policy, et al.] and they’re fairly tame compared to many. I’m also partial to their WARP technology. The idea is the end user’s traffic is encrypted and sent to any of Cloudflare’s servers and from there they can then bounce to anywhere in the world (a handy trick if you need to get around a great firewall or other tools of censorship). If your home lab uses Cloudflare’s tunnel, and your phones use WARP, the only thing a third party can see it that you’re using the largest CDN in the world - which is sorta a ‘well, duh’ statement. Cloudflare’s schtick is they don’t need limits - they can flood you home connection and it wouldn’t be a blip on their radar. However, they need to run variations of these technologies to operate their primary business. So making a copy for you to use is almost trivial. (And if you go viral and suddenly need a CDN, I’m sure they can sell you some)
Tl;dr: you’re not wrong, but the desert has water in it, if you know where to look.
I think you’re giving their ability to coordinate too much credit. Best guess the ISPs are just withholding anything that requires investment to deploy or that they can monetize themselves. Everybody else is just bottom-feeding by selling workarounds wherever the ISPs can’t or won’t.
The invisible hand of the market sucks at creating optimal solutions, but it does great at creating scammy crap that will take your money, no conspiracy necessary.
Yepp, Hanlon’s razor: they are mostly just lazy and maybe incompetent, not necessarily evil, that’s just a side effect. E.g. in my country if you call them that you want to get out of CGNAT they’ll just do that for you. My IP haven’t changed in years, but I don’t pay for fix IP. But it may be different in each country, I have mostly good experiences with local ISPs here.
I wonder how often the assigned prefix changes with most of the regular ISPs. I’d have to look someone else’s router since I’m still stuck on an old contract. But I believe what I saw with some of the regular consumer contracts: the prefixes stay the same for a long time. You could just slap a free DynDNS service on top and be done with it.
But yes, I think this used to be the promise… We’d all get IPv6 and a lot of gadgets like NAS systems, video cameras and a wifi kettle and they’d be accessible from outside. Instead of that we use big capitalist cloud services and all the data from the internet of things devices has some stopover in the China cloud.
My ISP seems to use just normal DHCP for assigning addresses and honors re-use requests. The only times my IP addresses have changed has been I’ve changed the MAC or UUID that connects. I’ve been off-line for a week, come back, and been given the same address. Both IPv4 and v6.
If one really wants their home systems to be publicly accessible, it’s easy enough to get a cheap vanity domain and point it at whatever address. rDNS won’t work, which would probably interfere with email, but most services don’t really need it. It’s a bit more complicated to detect when your IP changes and script a DNS update, but certainly do-able, if (like OP) one is hell bent on avoiding any off-site hardware.
There are some good ISPs out there. My ISP in Australia (Leaptel) gives me the option to enable static IPv6 /48 for free.
Cries in American 🇺🇸😿
No german ISP that i know of does this, it’s awful. One doesn’t even offer reverse IP ptr entries whatsoever, even if you had a static IP.
You know, what’s kind of encouraging is that I posted something similar to this complaint on reddit, and 100% of the responses were corporate apologia how it would apparently be so much work and so much more expensive to provide a static instead of a dynamic IP, or how routing through VPSes is so much better anyway. I hadn’t realized the reddit to lemmy brain drain was so bad, which seems good for decentralized morally good hosting.
Capitalist institutions push capitalism? What kind of world is this!
<<<< has ipv4 static ip to my house. I do pay a small premium though. Like $15 bucks.
$5 for mine
That is basically what they do yes. ISPs are the only thing standing in between the entirety of humanity and out of the box selfhosting. With fixed IPv6 IP addresses you could build and sell devices that just self host all your stuff out of the box. You could just sell complete normie people a “cloud box” that they can slap in their home for a one time cost that will take care of all their cloud storage and smart device needs. You could integrate it into any smartphone OS ootb so that all you have to do is scan a QR code on the “cloud box” and it connects all your apps that need it to it.
It’s a pain but also it’s no surprise that DNS and ipv6 are premium when ipv4 and dynamic IP works so well for 99% of us. Even if you wanna host something publicly there are totally free services and software tools to cover most if not all caveats of not using ipv6 (for now).
I have selfhosted for years and only paid for a domain name recently.
We seriously need an international co-operative (Worker-owned) ISP.
My ISP is a local deal, well-known for protecting privacy, and run by an absolute nerd (in the best way possible, also outspoken about privacy, FOSS, and other such things). Their customer service is second-to-none; I had an issue with my static IP a couple years back, and had an actual engineer on the line within a few hours. On a weekend.
It’s XMission. I dropped Comcast for them once they were in my area. Comcast can climb up a cactus.
I’m jealous. Xmission is all around me but not in my area. Luckily I have another local ISP (and not Comcast) but they want $10 a month for a static IP.
I pay $89/mo total for symmetrical gigabit via UTOPIA, no monthly cap, and my static IP. I was paying Comcast a hair over $60/mo before this for 400/20 via cable w/1.2TB cap.
Absolutely worth it.
Pete Ashdown’s a badass. Big up XMission.
Hell yeah. I don’t normally simp for companies, but I will happily support locally owned alternatives to big, faceless corporations, even if it costs a bit more. Usually.
