EE 4G Sim + Router

[ND0724]

Hello,

I recently bought a TP-LINK MR200 router to utilise in a remote area. The plan was to use this with the OpenVPN server on the router to connect to a LAN remotely. 

When I use my EE sim card I am able to connect to the internet when directly connected to the router (i.e. LAN). However, if I try and access remotely it is as if all ports are blocked to incoming traffic. 

I have enabled remote management and ICMP echos from remote in the settings. I have a public IP address with the EE sim card and have set up a DDNS server which is working. 

Out of curiousity, I tried the router with my three mobile sim card and I made a slight adjustment to the APN and everything worked perfectly after that and as expected.

I was wondering if anyone has come across this issue and if they managed to resolve it on the EE network?

Best regards,

N

[XRaySpeX]

@ND0724 : You may be finding yourself up against a limitation of EE's mobile network. The EE mobile network uses Carrier Grade NAT (CGNAT) resulting in a double NAT, which means that you don't get your own public IP address but share it with other users. So you can't be uniquely id'ed on the Net & therefore your LAN cannot be addressed from outside for unsolicited accesses. This is unlike fixed BB.

If this occurs there is nowt you can do to avoid it.

[ND0724]

@XRaySpeX 

Thanks for the prompt reply. If I've understood correctly, a double NAT would leave me with a private up address. My router page shows a public IP address which matches what I see when I Google or visit a site that shows my public IP address.

Would you agree with the above and hence does that rule out your suggestions.

Thanks again,

N

[XRaySpeX]

Yes, I would expect the router itself to see its public IP addy to start with 10. if CGNAT was in operation.

[ND0724]

Thanks, this doesn't appear to be the problem then.

Lost for ideas. I'm going to speak to EE directly and see if they have any suggestions.

Thanks for your help though,

N

[mikeliuk]

Hi @ND0724 ,

If you check your WAN IP address on your router you will find it to be of the form 100.x.x.x or 10.x.x.x (or some other private range) and it will not match the IP address you see when you visit online what-is-my-IP services. Those services will show your exit point to the internet but you will share that exit point with many people.

To get around CGNAT, you can use a commercial VPN service to obtain a publicly routable address but this would defeat the point of running a VPN server at home, otherwise you can use a commercial solution with a matcher service such as https://www.draytek.com/solutions/vpn-matcher/

[XRaySpeX]

@mikeliuk : Even tho' the OP states otherwise?

[ND0724]

@mikeliuk 

Hi Mike!

Thanks for your suggestions. I can definitely confirm that I have both WAN IP and "what's my IP" IP matching & both public.

Thank you for your suggestions on other routes around this issue though, much appreciated.

I actually plugged in my three sim card and changed the APN from three.co.uk to 3internet and everything worked like a charm. I'll maybe just opt for another service provider as it seems to be the path of least resistance.

Thanks though,

N

[mikeliuk]

Hi @ND0724 ,

That sounds good! A routable IPv4 address is one of the things I miss most about Three.

I would be really interested in how you get EE to assign a routable IP address onto your 4G LTE WAN interface on a consumer (not business) contract. Obviously you can't just take the value from what-is-my-ip and just assign it to the WAN interface (it must be put there by EE's infrastructure) as it will listen to traffic addressed to that IP but the service provider will never route any incoming traffic to you (unsolicited incoming traffic to that IP will be blocked at the perimeter as it is unknown whose WAN interface it should go to).

I currently have DDNS running under OpenWRT which is updating a domain name to point to my exit point address but even if I were to assign that exit point IP address to my WAN I could never receive any unsolicited traffic to it.

[ND0724]

@mikeliuk 

I don't know the specific reason I've ended up with a proper public IP address assigned. It's not a SIM only contract, I bought it with one of their WiFi hotspot products which maybe triggers the difference?

Either way, it's still not working. I can only think that they've closed ports for security purposes for some unknown reason. I'm going to give them a call tomorrow to see if they can assist with that and perhaps open them on their end. 

N