My frustration with WISP

Hi all, I live in where there’s little to no cable internet in my city, therefore majority uses wireless ISPs. I recently change my WISP to a one of the best in my coverage area, and I’m gonna give the name in case they reply in this thread (Extend Broadband) website: https://www.extendbroadband.com/urunler-gamepack.php

I use the gamer pack package because it has P2P connection and guaranteed speed.

My frustration is that, package has a free public static IP (not CGNAT’ted… IP belongs to me) and I ask them to give that IP on my Mikrotik router’s WAN interface (not the private DHCP assigned IP) and DMZ it, so there will be no double NAT and I can do my stuff on my end. But they said they don’t work in that way and simply enabled uPnP on their Mikrotik antenna/router but it didn’t work.

My question is, is there anything you think of legitimate reason behind their act? It should be a simple configuration change on their antenna/router… I’m gonna insist they do it but created this thread to gather information.

Thanks!

package has a free public static IP (not CGNAT’ted… IP belongs to me)

Didn’t see that in the packet description. It looks like they use a static IP address but do CGNAT to many customers on that one IP address.
Your outgoing IP address to the internet then will always be the same, but with CGNAT it is not exclusive for you.

No its included, I verified it on phone plus did a ping test, I can ping it <1ms. My package is a premium one, just under business packages, free static IP is included even in standard packages.

did a ping test, I can ping it <1ms

<1ms. Looks like just a local ping. Try “tracert” trace-route.

If you ping from the Internet, what device is responding to the ping ?

Yes its “local” as I stated its assigned in the antenna/router’s interface, rather I want it in my router’s WAN interface.

I did trace its route but I will do it again and post it here when I get back home from work.

As WISP, I can reply to you:
We don’t want people to bother us with custom configurations: everything must be configured the same in order to give a homogeneous service
that does not involve remembering that the one has the configuration like this, the one has the configuration like that, and so on.

And then it also depends on the fact that if their “technician” doesn’t know how to do it, he doesn’t do it…
If they learned by copying-and-pasting youtube to open the WISP, it’s obvious…

Thanks for replying from the WISP point-of-view. So basically they might be incompetent or too lazy to do it? I suspect the latter. Yet, please tell me whether I’m asking too much from them. I mean I just want to use my public IP on my router (for remote conns, open NAT for gaming, hosting small server etc.)… Isn’t that a basic need that they should fulfill?

I don’t know your WISP, but we EXCLUSIVELY provide NOT shared Public IPs to our customers.
If the user asks what you also asked to put the IP on their router, we let this happen, NO PROBLEM :wink: (and why not?)
but we do not provide further assistance on the internal network.
We make sure the radio link goes, but the customer takes care of the rest and can’t call for help.
We provide only the right WAN parameters, and the other parameters are customer business…

That’s what I’m looking for… I handle my internal network, I don’t ever give anyone access to it.

Thanks for the reply again, I will continue asking them to give me what I want, referring this thread.

Some ports are opened outside exclusivly after written request, for example, but not all: 20,21,22,23,80,443, RDP, PPTP, SQL,
and other that not remember at memory, but nothing that block games, steam, uplay, and all other services… :wink:

But is impossible to ask to open standard winbox port, dns, ntp and other that now I not remember, but are all for protecting network.
Is oblvious I mena that ports are closed not on outgoing connection but only from new connection from outside the customer network.

I see… what if they ask for DMZ’ing the public IP?

(
And is also impossible use VoIP outside authorized IPs, because the VoIP service have the absolute higher priority, and some P2P try to use 5060 and 5061 ports…
Free of any charge, if some VoIP server is not on whitelist, just call… :wink:
)

I think that the right way is not the DMZ, I hate the DMZ…
Simply use Internal ISP IPs 100.64.0.0/10 to route the Public IP directly to your router…
Is so easy…
if their technician can do it …

It could be that not all routers are flexible enough, so delivering single public IP address to them could mean wasting other three (for /30 subnet, which is standard and compatible with everything, but who can afford that nowadays). There are other ways like routing the address to private one (as mentioned by @rextended) or using point to point /32, but if customer has some simple home router, it may not be able to use that. Or there’s PPPoE, but it’s yet another things that ISP may not want to introduce into their network. So maybe NAT won as one common solution that works for everyone (if they don’t really need the address on their router, that’s the downside).

Antenna which they installed is a mikrotik router and I have mikrotik hap AC2. I dont want double nat, I want a single router in the network and thats my router.

edit: I think antenna get its public static IP from PPPoE.. then let me have PPPoE as a client in my router, isnt it that simple?

Just wandered what my ISP is doing.

I don’t have a fixed public IP, it changes every 16 hours. Port 443 and 80 is not forwarded incoming (unless specific request and accepting the risk, in writing). They don’t allow us to run a public web server.on those ports.

They deliver a solution for multiple client devices, but allow you to set a DMZ Host, and allow to set the LAN subnet range, and allow some extra port forwarding to be set.

So the NAT is always there, but you can set it up so that the outside can reach any internal device.

That one and only internal device is a MT router in my case, handling all LAN devices and opening VPN servers to the outside where needed.

http://imageupper.com/s12/1/1/G1656956126138986_1.png
http://imageupper.com/s12/1/1/G1656956126138986_2.png

192.168.5.1 is the MT antenna’s network acting like a router. (192.168.1.1 is my router). ping to 9.9.9.9.
and the other picture is pinging my public static IP from outside.

Both png:
You don’t have permission to access /s12/1/1/G1656956126138986_x.png on this server.

Have only skimmed through the thread but i’ll try and lay out a simple explanation from an ISP perspective

Firstly it doesn’t matter that its a WISP. This is not a reason for you to not have a public IP address, however there’s a lot more behind-the-scenes going on that can be a very viable explanation for why they won’t give you one. So let me attempt to explain

First and foremost, a WISP has significantly higher cost and network complexity to deliver a service to a customer. Fixed services are relatively simple, they share capacity on a switch or a DSLAM and often they are chassis units with multiple cards with high density. Multiple resellers/ISPs have access to this equipment, but they often don’t maintain or configure any of it. From their perspective they simply have a customer connection arrive at the data center via a VLAN/VXLAN/VPLS and they handle it all at a few central locations.
Whereas fixed wireless needs a dish at every single customers location, they need power, pole position and site access to the multi point radio and it can severely limit density. Not to mention its using shared radio waves, there isn’t’ a dedicated link for every customer. Public IP addresses aren’t always cheap, and its yet again another ongoing expense.
However the bigger issue is that all of this equipment needs configuration and is entirely setup and managed by the WISP, for instance there might be failover links that add complexity to the network (since wireless is inherently a service without any guarantees on bandwidth or connection quality). This has a lot more administrative overhead

Depending on how they have configured their network, it may be that routing needs to be setup such as to effectively extend their reach from a data center all the way through a network to eventually get to a tower and at your premises. If this is the case, then all that routing needs to be configured and maintained, and adding a single additional public IP address just for you, means a fair bit more config on their side
It’s not so much the initial work involved, but the management and maintenance. The absolute worst thing at scale is when you have individually configured devices that don’t conform to any standard and you are constantly doing custom config to make things work
To you it may seem like a switch has been flicked, but on the back end it may be like stringing a cable across the front of an otherwise nice neat equipment rack. This doesn’t matter if the situation is a single switch on a desk, you’re just going to plug things in. But at scale you may be stringing a thousand cables, and you end up with a complete fkn mess that is a nightmare to troubleshoot, fix or expand

If they say no you can’t have a public IP, then too bad you can’t. And it’s probably for a good reason
You may be asking them to do a hell of a lot more work than you realize, and I don’t blame them for just outright refusing if it creates a mess

Doesn’t mean its the end of the world. You can either get angry because the ISP won’t spend resources on catering to you, and spend lots of time on a forum. Or you can spend a few of your own resources and take matters into your own hands. Set up a VPN connection and policy based routing (if you don’t want all traffic always going across the VPN), that way you can have your own public IP address at the VPN’s data center, piped directly to your router
Even better, take this is a learning experience and find a server hosting company, something very cheap that lets you deploy your own image. Spin up a MikroTik CHR image, then setup an EoIP tunnel (benefit of this is you will be able to use a full 1500 byte MTU) and again setup your own routing

OP in his original post expressed frustration over double NAT. I don’t know if the frustration is more or less philosophical or he actually encountered any problems because of that (e.g. increased delay as he’s into gaming according to the gist of hist post or poorly/wrongly done double NAT). But if it’s either the philosophical or added delay problem, then having VPN won’t help much (in case of added delay it would probably even get worse). But then, he being customer of WISP, the delay introduced because of wireless hops likely largely exceeds whatever delay caused by a half-decent NAT device. So I don’t think the problem is actually a real one.
But then it’s not my use case and my opinion on it doesn’t count with OP …

Yesterday it was working.. now it gives error page. Sorry, I will upload on another site today.