GL-MT3000 Hosting behind CGNAT

Sethide · 2024-09-20T06:48:12.380Z

I am using GL-MT3000 as my secondary router.
I recently change ISP, the new ISP uses CGNAT.
So I no longer have a public IPv4 like I used to.
My OpenVPN and WireGuard server no longer work.
Tailscale exit node is not supported by GL-MT3000 (yet?).
I don't know how to use ZeroTier on GL-MT3000 as a gateway...

Do you have any suggestion, please?
Thank you.

admon · 2024-09-20T06:50:35.011Z

Well, CGNAT is always a big issue.

You could try GL.iNet's AstroRelay https://www.astrorelay.com/ which might work around it.
ZeroTier could be fine as well, but Gateway is tricky and may not even work: https://zerotier.atlassian.net/wiki/spaces/SD/pages/7110693/Overriding+Default+Route+Full+Tunnel+Mode

All in all: CGNAT = no VPN from home, at least not reliable.

Exit node for Tailscale can be enabled manually, there are plenty of threads here in the forum. Since I don't use Tailscale myself, I can't assist with that.

Sethide · 2024-09-20T06:51:48.018Z

Would having a Public IPv6 resolve this issue?

admon · 2024-09-20T06:52:27.886Z

Depends.

It would make it possible to connect to your IPv6 VPN server - but only if your location, where you want to connect from, is reachable via IPv6 as well. Might work, might not.

Afaik IPv6 isn't fully supported in the GL.iNet VPN yet. Not sure what kind wasn't working, but I remember something.

Sethide · 2024-09-20T06:54:01.451Z

I see. Thank you admon for the quick response.

Sethide · 2024-09-20T07:49:48.248Z

Tailscale settings lost on reboot Technical Support for Routers

I have a GL-AX1800 and purchased because of Tailscale implementation among other features. I have noticed that there is very little available config in the UI but as I had SSH access I thought it would be ok and configured via: tailscale up --advertise-routes=192.168.10.0/23 --accept-dns=false --accept-routes --advertise-exit-node --reset I specifically want the /23 route advertised instead of a /24 and need the other options. This works fine however it is all resets on reboot. Is there a wa…

Thanks to @tragicshadow @ilium007 and @bring.fringe18

I manage to run the Tailscale exit node.

I edited /usr/bin/gl_tailscale to add
--advertise-exit-node

timeout 10 /usr/sbin/tailscale up --reset --advertise-exit-node --accept
-routes $param --timeout 3s --accept-dns=false > /dev/null

admon · 2024-09-20T08:18:28.596Z

Is it really all you need, just to add --advertise-exit-node?

Is there any issue if you don't use exit nodes at all but still set this?

Sethide · 2024-09-20T09:26:18.767Z

yes Adding it is just to make it persistent after reboot.
It is all i did and it worked fine.
I'm not sure.
I got this email from Technical support:

Question: "Do you plan to support Tailscalre exit node in a near future?"

Response:
"No, since it will conflict with other application like zerotier, Wireguard and Tor, we have no plan to develop the exit node function on our router.
I know some customers can run exit node by commands, but we can't guarantee there is no DNS leak if you are also using other applications."

So i guess it is yes if you use other applications.

tragicshadow · 2024-09-27T07:01:57.015Z

I'm glad that you worked it out.
If you're behind CGNAT and still wanna access your router, there maybe a couple of options that I am using.
1.Cloudflared tunnel
2.frp.
I will write up some outline of how I did it with those two.
I've been there myself, so I know how you feel and trust me, I'm no expert.
I am just learning myself.

alzhao · 2024-09-27T07:14:50.255Z

Another way is the relay your wireguard server using astrorelay.com

But we are working on astrowarp.net and it will give you same solution.