Why ISPs need CGNAT
New public IPv4 addresses are scarce and expensive. With CGNAT each subscriber gets a private address, and the BNG translates their traffic to a small public pool. The ISP grows its subscriber base without buying a new IPv4 block for every new OLT.
How Dandy vBNG does CGNAT
- SNAT from your subscriber pools to one or more public pools, in the Linux kernel with a flowtable fast path.
- DNAT / port forwarding for subscribers who need a service reachable from outside.
- Per-user NAT session limit, so one infected device or a scan cannot fill the connection table for everyone.
- NAT guard: traffic that would leave without translation is dropped, so private addresses never reach your upstream.
- DDoS watch in the web panel shows which subscribers open unusual numbers of sessions.
Plan the public pool at about 128 subscribers per public address or fewer for heavy-traffic networks.
NAT logs with the subscriber's user name
Indian ISP licences require you to keep records of which subscriber used which public address and port. Dandy vBNG exports every NAT translation as NetFlow v9 or IPFIX to one or more log servers, and each record carries the subscriber's user name, not only the private address. Your log server keeps them as long as your licence requires; the BNG itself keeps its own logs for 7 days.
CGNAT and IPv6 together
With IPv6 dual stack each subscriber also gets an IPv6 prefix. Traffic to IPv6 services such as Google, YouTube and Facebook then goes without NAT at all, which lowers the load on the NAT pool and the volume of NAT logs.