Establish OpenVPN connection to server behind carrier grade NAT

Question

My ISP offers dual stack lite. Which means, I only have a fully usable IPv6 address.IPv4 connections are routed through carrier grade NAT. I would like to set up an openVPN server in my home network and connect to it. But my cell service provider has no IPv6 support (using iOS).

I do have multiple servers on the internet with true dual stack support. Is there some way to connect to my openvpn server with these ingredients? I read about ssh port forwarding: would this be a solution? Or is that to much overhead for the connection?

Niobos · Answer

As you already discovered, you can't connect directly from your mobile (which has only IPv4 connectivity) to your home network (which is not reachable over IPv4 due to CG-NAT). You can indeed "hop" over a well-connected host to mediate between your 2 devices. This does complicate the network setup somewhat, making troubleshooting much more.... challenging.

The basic idea is to configure one of your well-connected servers to act as forwarding station: It should accept TCP connections from your Mobile over IPv4, and forward these to your home server over IPv6. (You can set this up using UDP as well, but that is even more complicated because it is connection-less)

One tool that does this is socat:

socat -d -d TCP-LISTEN:1194,fork TCP6:[2001:db8::1]:1194

This will listen on your servr on port 1194 (the default OpenVPN port, change to suite your wishes), and forward every connection to the specified IPv6 address (or DNS-name) on the same port (again, change to suite your wishes). The fork option instructs socat to keep forwarding new connections after the first one.

Establish OpenVPN connection to server behind carrier grade NAT

One Answer

Add your own answers!

Ask a Question