CGHMN NAT and Firewalls - Revision history

Snep: Small adjustment in the last sentence on how to allow inbound ports for clearer instructions on where to set up the rules

2025-10-27T12:30:06Z

Small adjustment in the last sentence on how to allow inbound ports for clearer instructions on where to set up the rules

← Older revision		Revision as of 05:30, 27 October 2025
Line 59:		Line 59:
	The most drastic is simply to disable OpenWRT's firewall completely. This means any machine you plug in will have direct access to the network and any other devices on the network will be able to directly access it. If you choose this option we highly recommend putting any machines behind a (preferably modern!) Firewall and then port forwarding as necessary		The most drastic is simply to disable OpenWRT's firewall completely. This means any machine you plug in will have direct access to the network and any other devices on the network will be able to directly access it. If you choose this option we highly recommend putting any machines behind a (preferably modern!) Firewall and then port forwarding as necessary

	The other option is to set a static (fixed) IP address on the device you want to run servers or play games from. Once this is done you can access the OpenWRT Firewall page (Network -> Firewall) and manually ~~forward~~ the required ports for that specific host.		The other option is to set a static (fixed) IP address on the device you want to run servers or play games from. Once this is done you can access the OpenWRT Firewall page (Network -> Firewall -> Traffic Rules) and manually allow the required ports for that specific host to pass the firewall.

CursedSilicon at 23:36, 26 October 2025

2025-10-26T23:36:29Z

← Older revision		Revision as of 16:36, 26 October 2025
Line 32:		Line 32:
	Every CGHMN user is allocated a /24 block of IP's. Effectively every user has 253 IP addresses to use as they'd like. This was a deliberate decision both to maximize the amount of freedom users would have to connect ALL their retro equipment if desired, and to try and allow direct end-to-end connectivity that the old web "expects"		Every CGHMN user is allocated a /24 block of IP's. Effectively every user has 253 IP addresses to use as they'd like. This was a deliberate decision both to maximize the amount of freedom users would have to connect ALL their retro equipment if desired, and to try and allow direct end-to-end connectivity that the old web "expects"

	'''''However''''' because we have the benefit of historical hindsight. Having directly allocated IP addresses does not mean that your devices are directly exposed to the network. By default (if using OpenWRT with Snep's setup script) your IP block will be ''firewalled'' against incoming connections. This is a necessary security measure because the very nature of the		'''''However''''' because we have the benefit of historical hindsight. Having directly allocated IP addresses does not mean that your devices are directly exposed to the network. By default (if using OpenWRT with Snep's setup script) your IP block will be ''firewalled'' against incoming connections. This is a necessary security measure because because of the very nature of "running a retro network". Connecting machines that are (likely) un-patched would make them immediately vulnerable to attack. Even before they're properly configured for service by the end user.

	=== So, what stuff breaks, exactly? ===		=== So, what stuff breaks, exactly? ===

CursedSilicon at 23:17, 26 October 2025

2025-10-26T23:17:15Z

← Older revision		Revision as of 16:17, 26 October 2025
Line 1:		Line 1:
	= ~~Or "a treatise~~ on ~~setting up a retro network"~~ =		=== A brief history on how the internet worked in the 1990's ===

			[[Compu-Global-Hyper-Mega-Net\|Compu-Global-Hyper-Mega-Net (CGHMN)]] exists in a difficult kind of space. We aim to emulate "the old web". A time of roughly "1995 to around 2005 or so". A sort of nebulous "Before Web 2.0 took off" kind of period. Though, really we support anything that speaks ethernet and (usually) TCP/IP. We've had devices as old as a DOS 286 PC clone connected successfully. Most users trend toward Windows XP as their platform of choice due to its relative flexibility and widespread hardware and software support

	~~=== A brief history on how the internet worked in the 1990's ===~~
	[[Compu-Global-Hyper-Mega-Net\|Compu-Global-Hyper-Mega-Net (CGHMN)]] exists in a difficult kind of space. We aim to emulate "the old web". A time of roughly "1995 to around 2005 or so". A sort of nebulous "Before Web 2.0 took off" kind of period. Though, really we support anything that speaks ethernet and (usually) TCP/IP. We've had devices as old as a DOS 286 PC clone connected successfully. Most users trend toward Windows XP as their platform of choice due to its relative flexibility and widespread hardware and software support

CursedSilicon at 23:16, 26 October 2025

2025-10-26T23:16:47Z

← Older revision	Revision as of 16:16, 26 October 2025
Line 1:	Line 1:
		= Or "a treatise on setting up a retro network" =

CursedSilicon at 23:16, 26 October 2025

2025-10-26T23:16:08Z

@@ Line 13: / Line 13: @@
-'''This created two major problems.'''
+<big>'''This created two major problems:'''</big>
 The first one was IP exhaustion. Even by the 1990's there was an understanding that there simply wouldn't be enough IP addresses for everyone on the internet. This needed to be fixed, and fast! This lead to IPv6 as an evolutionary upgrade (a problem the internet still struggles to even deploy in 2025, despite being ratified in 1998)
@@ Line 38: / Line 38: @@
 === So, what stuff breaks, exactly? ===
 === How do I opt-out out? ===

CursedSilicon: /* A brief history on how the internet worked in the 1990's */

2025-10-26T23:00:08Z

A brief history on how the internet worked in the 1990's

← Older revision		Revision as of 16:00, 26 October 2025
Line 1:		Line 1:




Line 30:		Line 32:
	As stated before, we live at the end of history. Which means we have the benefit of looking back on what was, and understanding the flaws. Which (finally) brings us to the point of this wiki page.		As stated before, we live at the end of history. Which means we have the benefit of looking back on what was, and understanding the flaws. Which (finally) brings us to the point of this wiki page.

	==== Okay but what does that have to do with CGHMN? ====		=== Okay but what does that have to do with CGHMN? ===
	Every CGHMN user is allocated a /24 block of IP's. Effectively every user has 253 IP addresses to use as they'd like. This was a deliberate decision both to maximize the amount of freedom users would have to connect ALL their retro equipment if desired, and to try and allow direct end-to-end connectivity that the old web "expects"		Every CGHMN user is allocated a /24 block of IP's. Effectively every user has 253 IP addresses to use as they'd like. This was a deliberate decision both to maximize the amount of freedom users would have to connect ALL their retro equipment if desired, and to try and allow direct end-to-end connectivity that the old web "expects"

	'''''However''''' because we have the benefit of historical hindsight. Having directly allocated IP addresses does not mean that your devices are directly exposed to the network. By default (if using OpenWRT with Snep's setup script) your IP block will be ''firewalled'' against incoming connections. This is a necessary security measure because the very nature of the		'''''However''''' because we have the benefit of historical hindsight. Having directly allocated IP addresses does not mean that your devices are directly exposed to the network. By default (if using OpenWRT with Snep's setup script) your IP block will be ''firewalled'' against incoming connections. This is a necessary security measure because the very nature of the

			=== So, what stuff breaks, exactly? ===

			=== How do I opt-out out? ===

CursedSilicon at 22:57, 26 October 2025

2025-10-26T22:57:54Z

← Older revision		Revision as of 15:57, 26 October 2025
Line 1:		Line 1:

	== A brief history on how the internet worked in the 1990's ==

			=== A brief history on how the internet worked in the 1990's ===
	[[Compu-Global-Hyper-Mega-Net\|Compu-Global-Hyper-Mega-Net (CGHMN)]] exists in a difficult kind of space. We aim to emulate "the old web". A time of roughly "1995 to around 2005 or so". A sort of nebulous "Before Web 2.0 took off" kind of period. Though, really we support anything that speaks ethernet and (usually) TCP/IP. We've had devices as old as a DOS 286 PC clone connected successfully. Most users trend toward Windows XP as their platform of choice due to its relative flexibility and widespread hardware and software support		[[Compu-Global-Hyper-Mega-Net\|Compu-Global-Hyper-Mega-Net (CGHMN)]] exists in a difficult kind of space. We aim to emulate "the old web". A time of roughly "1995 to around 2005 or so". A sort of nebulous "Before Web 2.0 took off" kind of period. Though, really we support anything that speaks ethernet and (usually) TCP/IP. We've had devices as old as a DOS 286 PC clone connected successfully. Most users trend toward Windows XP as their platform of choice due to its relative flexibility and widespread hardware and software support

Line 28:		Line 30:
	As stated before, we live at the end of history. Which means we have the benefit of looking back on what was, and understanding the flaws. Which (finally) brings us to the point of this wiki page.		As stated before, we live at the end of history. Which means we have the benefit of looking back on what was, and understanding the flaws. Which (finally) brings us to the point of this wiki page.

	== Okay but what does that have to do with CGHMN? ==		==== Okay but what does that have to do with CGHMN? ====
	Every CGHMN user is allocated a /24 block of IP's. Effectively every user has 253 IP addresses to use as they'd like. This was a deliberate decision both to maximize the amount of freedom users would have to connect ALL their retro equipment if desired, and to try and allow direct end-to-end connectivity that the old web "expects"		Every CGHMN user is allocated a /24 block of IP's. Effectively every user has 253 IP addresses to use as they'd like. This was a deliberate decision both to maximize the amount of freedom users would have to connect ALL their retro equipment if desired, and to try and allow direct end-to-end connectivity that the old web "expects"

	'''''However''''' because we have the benefit of historical hindsight. Having directly allocated IP addresses does not mean that your devices are directly exposed to the network. By default (if using OpenWRT with Snep's setup script) your IP block will be ''firewalled'' against incoming connections. This is a necessary security measure because the very nature of the		'''''However''''' because we have the benefit of historical hindsight. Having directly allocated IP addresses does not mean that your devices are directly exposed to the network. By default (if using OpenWRT with Snep's setup script) your IP block will be ''firewalled'' against incoming connections. This is a necessary security measure because the very nature of the

CursedSilicon at 22:57, 26 October 2025

2025-10-26T22:57:10Z

← Older revision		Revision as of 15:57, 26 October 2025
Line 1:		Line 1:
	[[Compu-Global-Hyper-Mega-Net\|Compu-Global-Hyper-Mega-Net (CGHMN)]] exists in a difficult kind of space. We aim to emulate "the old web". A time of roughly "1995 to around 2005 or so". Before "Web 2.0" took off. Though, really we support anything that speaks ethernet and (usually) TCP/IP. We've had devices as old as a DOS 286 PC clone connected successfully.

			== A brief history on how the internet worked in the 1990's ==
			[[Compu-Global-Hyper-Mega-Net\|Compu-Global-Hyper-Mega-Net (CGHMN)]] exists in a difficult kind of space. We aim to emulate "the old web". A time of roughly "1995 to around 2005 or so". A sort of nebulous "Before Web 2.0 took off" kind of period. Though, really we support anything that speaks ethernet and (usually) TCP/IP. We've had devices as old as a DOS 286 PC clone connected successfully. Most users trend toward Windows XP as their platform of choice due to its relative flexibility and widespread hardware and software support

	Unfortunately for us ~~now~~ we live at the end of history. In 1995 the "World Wide Web" was in its infancy in such a way that every single year brought quantum technological leaps over the previous year. By the end of the millennium we'd gone from rudimentary analog Dial-Up services to ''Wireless Networking'' being accessible to consumers (Apple's AirPort routers alone showed up in 1999)
			Unfortunately for all of us we live at the "[[wikipedia:End_of_history\|end of history]]". In 1995 the "World Wide Web" was in its infancy in such a way that every single year brought quantum technological leaps over the previous year. By the end of the millennium we'd gone from rudimentary analog Dial-Up services to ''Wireless Networking'' being accessible to consumers (Apple's AirPort routers alone showed up in 1999)

	However on a technical level this began to create severe issues. The internet as it was originally designed assumed simple "end-to-end" connectivity. Every computer on the internet could (more or less) talk to another computer without exception.		However on a technical level this began to create severe issues. The internet as it was originally designed assumed simple "end-to-end" connectivity. Every computer on the internet could (more or less) talk to another computer without exception.
Line 24:		Line 26:


	As stated before, we live at the end of history ~~however~~. Which means we'~~ve got~~ historical hindsight on the ~~problems that existed~~		As stated before, we live at the end of history. Which means we have the benefit of looking back on what was, and understanding the flaws. Which (finally) brings us to the point of this wiki page.

			== Okay but what does that have to do with CGHMN? ==
			Every CGHMN user is allocated a /24 block of IP's. Effectively every user has 253 IP addresses to use as they'd like. This was a deliberate decision both to maximize the amount of freedom users would have to connect ALL their retro equipment if desired, and to try and allow direct end-to-end connectivity that the old web "expects"

			'''''However''''' because we have the benefit of historical hindsight. Having directly allocated IP addresses does not mean that your devices are directly exposed to the network. By default (if using OpenWRT with Snep's setup script) your IP block will be ''firewalled'' against incoming connections. This is a necessary security measure because the very nature of the

CursedSilicon at 22:42, 26 October 2025

2025-10-26T22:42:51Z

← Older revision		Revision as of 15:42, 26 October 2025
Line 1:		Line 1:
	[[Compu-Global-Hyper-Mega-Net\|Compu-Global-Hyper-Mega-Net (CGHMN)]] exists in a difficult kind of space. We aim to emulate "the old web". A time of roughly 1995 to around 2005 or so. Before "Web 2.0" took off.		[[Compu-Global-Hyper-Mega-Net\|Compu-Global-Hyper-Mega-Net (CGHMN)]] exists in a difficult kind of space. We aim to emulate "the old web". A time of roughly "1995 to around 2005 or so". Before "Web 2.0" took off. Though, really we support anything that speaks ethernet and (usually) TCP/IP. We've had devices as old as a DOS 286 PC clone connected successfully.

	At time of writing that might not sound like too big a problem. After all, Windows 10 came out in 2015 and now it's 2025. But your 4th gen Core i7 PC is still perfectly usable. Just install Linux, right?

	Unfortunately for us now we live at the end of history. In 1995 ~~however~~ the "World Wide Web" was in its infancy in such a way that every single year brought quantum technological leaps over the previous year. By the end of the millennium we'd gone from rudimentary analog Dial-Up services to Wireless Networking being accessible to consumers (Apple's AirPort routers alone showed up in 1999)		Unfortunately for us now we live at the end of history. In 1995 the "World Wide Web" was in its infancy in such a way that every single year brought quantum technological leaps over the previous year. By the end of the millennium we'd gone from rudimentary analog Dial-Up services to ''Wireless Networking'' being accessible to consumers (Apple's AirPort routers alone showed up in 1999)

	However on a technical level this began to create severe ~~technical~~ issues. The internet as it was originally designed assumed simple "end-to-end" connectivity. Every computer on the internet could (more or less) talk to another computer without exception.		However on a technical level this began to create severe issues. The internet as it was originally designed assumed simple "end-to-end" connectivity. Every computer on the internet could (more or less) talk to another computer without exception.

	This created two major problems.
			'''This created two major problems.'''

	The first one was IP exhaustion. Even by the 1990's there was an understanding that there simply wouldn't be enough IP addresses for everyone on the internet. This needed to be fixed, and fast! This lead to IPv6 as an evolutionary upgrade (a problem the internet still struggles to even deploy in 2025, despite being ratified in 1998)		The first one was IP exhaustion. Even by the 1990's there was an understanding that there simply wouldn't be enough IP addresses for everyone on the internet. This needed to be fixed, and fast! This lead to IPv6 as an evolutionary upgrade (a problem the internet still struggles to even deploy in 2025, despite being ratified in 1998)

	The second, and much more obvious problem was security. By the year 2000 it was obviously apparent that every machine being able to talk to every other machine on Earth was a problem. Particularly when the dominant operating system these machines ran was what could be charitably described as..."not great" in terms of security. In the 2000's this would only escalate as the "[https://en.wikipedia.org/wiki/ILOVEYOU ILOVEYOU]" worm gave way to some of Windows XP's greatest hits, [https://en.wikipedia.org/wiki/Blaster_(computer_worm) Blaster], [https://en.wikipedia.org/wiki/Sasser_(computer_worm) Sasser], [https://en.wikipedia.org/wiki/Mydoom Mydoom], [https://en.wikipedia.org/wiki/Nimda Nimda] and [https://en.wikipedia.org/wiki/Conficker Conficker]. Among others.

	~~A fortunate side-effect at~~ the ~~time~~ of the ~~explosive growth~~ of ~~computers on~~ the ~~internet was~~ the ~~institution~~ of "Network Address Translation" or "NAT". In ~~laymans~~ terms this allows a bunch of computers to all sit behind a single IP address using a device such as a router. This technology is so ubiquitous that even in 2025 at time of writing it's still the defacto standard for computers and other devices to access the modern internet through.		The second, and much more obvious problem was security. By the year 2000 it was obviously apparent that every machine being able to talk to every other machine on Earth was a problem. Particularly when the dominant operating system these machines ran was what could be charitably described as..."not great" in terms of security. In the 2000's this would only escalate as the "[[wikipedia:ILOVEYOU\|ILOVEYOU]]" worm gave way to some of Windows XP's greatest hits, [[wikipedia:Blaster_(computer_worm)\|Blaster]], [[wikipedia:Sasser_(computer_worm)\|Sasser]], [[wikipedia:Mydoom\|Mydoom]], [[wikipedia:Nimda\|Nimda]] and [[wikipedia:Conficker\|Conficker]]. Among others.

			A remedy proposed in the 1990's to the issue of IP exhaustion was "Network Address Translation" or "NAT". In layman terms this allows a bunch of computers to all sit behind a single IP address using a device such as a router. This technology is so ubiquitous that even in 2025 at time of writing it's still the defacto standard for home and business computers and other devices to access the modern internet.

			'''''However,''''' this technology came at a cost. The internet as most folks imagine (or remember it) was originally built on the idea that every computer had its own, unique, IP address. NAT broke that assumption. And, in doing so, programs broke. Sometimes completely with services like FTP, sometimes in subtle ways. Like being unable to connect certain game players in a StarCraft lobby.


			The problem that NAT introduced was that while "outbound" traffic would work fine. Such as you connecting to a website. If a program needed to ''receive'' data on your local computer, it could no longer simply sit and wait for a connection from a remote PC. An example would be AOL Instant Messenger (AIM). Chats between users are routed through a remote server. You and the Other User talk to a central server and it handles sending messages to-and-fro. ''However'' to save on bandwidth, sending files happens directly between users. If either user is behind NAT. They won't be able to "see" the remote computer and send data to it as desired.

	'''''~~However,~~''''' ~~this technology came at a cost~~. ~~The internet was originally predicated on the idea~~ that ~~every computer had its own, unique,~~ IP address. ~~NAT removed that assumption~~. ~~And, in doing so,~~ programs ~~broke~~. ~~Sometimes completely with services like FTP~~, ~~sometimes in subtle ways. Like being unable to connect certain game players~~ in ~~a StarCraft lobby~~.		The "solution" to this problem is known as '''''Port Forwarding'''''. You tell your router that [these ports] always go to [this IP address on the LAN] exclusively. This (mostly) solved the problem at the time. Additional solutions were proposed such as "UPnP" to allow programs to ask the router to forward ports for them dynamically. However, support for this was few-and-far-between (mostly BitTorrent clients) and in time it faded into oblivion.

	The problem that NAT inadvertently introduced was that while "outbound" traffic would work fine. Such as you connecting to a website. If a program needed to receive data on your local computer, it could no longer simply sit and wait for a connection from a remote PC. An example would be AOL Instant Messenger (AIM). Chats between users are routed through a remote server. However to save on bandwidth, sending files happens directly between users. If user A is behind NAT. User B won't be able to "see" the computer and send data to it as desired.

	~~The "solution" to this problem is known as '''''Port Forwarding~~'~~''''. You tell your router that [these ports] always go to "this PC~~ on the ~~LAN" exclusively.~~		As stated before, we live at the end of history however. Which means we've got historical hindsight on the problems that existed

CursedSilicon: Still a WIP but this is as much as I could write before sickness took over and I passed out

2025-10-26T06:25:41Z

Still a WIP but this is as much as I could write before sickness took over and I passed out

New page

[[Compu-Global-Hyper-Mega-Net|Compu-Global-Hyper-Mega-Net (CGHMN)]] exists in a difficult kind of space. We aim to emulate "the old web". A time of roughly 1995 to around 2005 or so. Before "Web 2.0" took off.

At time of writing that might not sound like too big a problem. After all, Windows 10 came out in 2015 and now it's 2025. But your 4th gen Core i7 PC is still perfectly usable. Just install Linux, right?

Unfortunately for us now we live at the end of history. In 1995 however the "World Wide Web" was in its infancy in such a way that every single year brought quantum technological leaps over the previous year. By the end of the millennium we'd gone from rudimentary analog Dial-Up services to Wireless Networking being accessible to consumers (Apple's AirPort routers alone showed up in 1999)

However on a technical level this began to create severe technical issues. The internet as it was originally designed assumed simple "end-to-end" connectivity. Every computer on the internet could (more or less) talk to another computer without exception.

This created two major problems.

The first one was IP exhaustion. Even by the 1990's there was an understanding that there simply wouldn't be enough IP addresses for everyone on the internet. This needed to be fixed, and fast! This lead to IPv6 as an evolutionary upgrade (a problem the internet still struggles to even deploy in 2025, despite being ratified in 1998)

The second, and much more obvious problem was security. By the year 2000 it was obviously apparent that every machine being able to talk to every other machine on Earth was a problem. Particularly when the dominant operating system these machines ran was what could be charitably described as..."not great" in terms of security. In the 2000's this would only escalate as the "[https://en.wikipedia.org/wiki/ILOVEYOU ILOVEYOU]" worm gave way to some of Windows XP's greatest hits, [https://en.wikipedia.org/wiki/Blaster_(computer_worm) Blaster], [https://en.wikipedia.org/wiki/Sasser_(computer_worm) Sasser], [https://en.wikipedia.org/wiki/Mydoom Mydoom], [https://en.wikipedia.org/wiki/Nimda Nimda] and [https://en.wikipedia.org/wiki/Conficker Conficker]. Among others.

A fortunate side-effect at the time of the explosive growth of computers on the internet was the institution of "Network Address Translation" or "NAT". In laymans terms this allows a bunch of computers to all sit behind a single IP address using a device such as a router. This technology is so ubiquitous that even in 2025 at time of writing it's still the defacto standard for computers and other devices to access the modern internet through.

'''''However,''''' this technology came at a cost. The internet was originally predicated on the idea that every computer had its own, unique, IP address. NAT removed that assumption. And, in doing so, programs broke. Sometimes completely with services like FTP, sometimes in subtle ways. Like being unable to connect certain game players in a StarCraft lobby.

The problem that NAT inadvertently introduced was that while "outbound" traffic would work fine. Such as you connecting to a website. If a program needed to receive data on your local computer, it could no longer simply sit and wait for a connection from a remote PC. An example would be AOL Instant Messenger (AIM). Chats between users are routed through a remote server. However to save on bandwidth, sending files happens directly between users. If user A is behind NAT. User B won't be able to "see" the computer and send data to it as desired.

The "solution" to this problem is known as '''''Port Forwarding'''''. You tell your router that [these ports] *always* go to "this PC on the LAN" exclusively.