TelkomInternet IPs different for local & international?

Randerson

New Member
Joined
Oct 31, 2006
Messages
4
Hi all

We have a 4mb ADSL line through TelkomSA which we use for maintaining an overseas website.

Today we couldn't FTP in, so I figured the firewall must be blocking me. I checked my IP by accessing a site we host at IS, which logged us as 41.243.99.179.

So, being in a hurry to get into my box, I simply added 41.243.0.0/16 to the firewall rules. But we still couldn't get in. I phoned up Rackspace USA and ***ked them out. They suggested I go to www.ipchicken.com to see my IP. I was about to tell them I'd already checked my external IP, but I went there for amusement anyway, just to find something quite bizarre:

Even though my IP is 41.243.99.179 locally, its being presented to overseas sites as 196.25.255.195 (ctb-cache5-vif0.saix.net)

Thanks for telling us about the change Telkom, you totally buggered up a rollout we had to do this morning!

Does anyone have any info about this 196.25 range - i.e. what range must I add to my USA firewall to make sure this doesn't happen again??
 

|tera|

Master of Messengers
Joined
Mar 31, 2006
Messages
25,906
I agree I saw this today on an international site I was on, it doesn't make sense:confused:
 

Beta

Banned
Joined
Apr 23, 2006
Messages
348
Yeh,
Those cache IP's(there are a few of them) are used for HTTP traffic...
So when you go to a website, you go through the cache first....they cache traffic,transparent cache proxy, squid etc..
Other TCP,UDP,ICMP etc would utilize your assigned IP eg: the 41 X X X IP....
So in essence if you go to a website, you go through a cache proxy first, whereas if you communicate with a machine directly, you utilize the assigned dynamic/static IP
 
Last edited:

|tera|

Master of Messengers
Joined
Mar 31, 2006
Messages
25,906
Sounds like a stupid way to do things Beta, no wonder international is so slow :mad:

caching>caching>caching>caching>caching:sick: :sick: :sick:
 

Randerson

New Member
Joined
Oct 31, 2006
Messages
4
Yeh,
Those cache IP's(there are a few of them) are used for HTTP traffic...
So when you go to a website, you go through the cache first....they cache traffic,transparent cache proxy, squid etc..
Other TCP,UDP,ICMP etc would utilize your assigned IP eg: the 41 X X X IP....
So in essence if you go to a website, you go through a cache proxy first, whereas if you communicate with a machine directly, you utilize the assigned dynamic/static IP

Are they used for the FTP and RemoteDesktop ports as well? Because with the 41.* rules added, I can't FTP or Remote into the box... HTTP has never been a problem because its open to the whole world.
 

The_Unbeliever

Honorary Master
Joined
Apr 19, 2005
Messages
103,196
But... if they're caching data, then it means that they're not using the SAT3 cable, and just shafting us all the more for less...

grrrr... :mad:
 

Beta

Banned
Joined
Apr 23, 2006
Messages
348
No, that's the thing I don't quite fathom... if your ACL is permitting 0.0.255.255 as you say then you should be fine,even if you just permitted the specific host address...
And the caches are only for HTTP,80 8080 3128....are you sure you configured the ACL entry correctly?
There could be something I am missing, open to suggestions anyone?

Teraside,in theory it's great because popular sites that ppl visit will already be stored in cache locally so they will be accessed faster,also utilizing less bandwidth internationally, and providing a small security benefit....but what about less common sites ie not hustler.com .....they will endure a slight overhead.
 
Last edited:

Randerson

New Member
Joined
Oct 31, 2006
Messages
4
Great...now IPchicken reports it as 198.54.202.195 ...
Not even remotely similar to what it was an hour ago and I haven't rebooted the router ... Seems it just keeps changing...

How the hell am I supposed to maintain any kind of session with an overseas site?!
 

Beta

Banned
Joined
Apr 23, 2006
Messages
348
I administrate a site in the UK and I have tons of issues with administration via HTTP and IP issues,
(ipb 2.1.7)...I suggest non HTTP Admin, SSH2 etc
 

Syndyre

Honorary Master
Joined
Jan 26, 2006
Messages
16,821
Great...now IPchicken reports it as 198.54.202.195 ...
Not even remotely similar to what it was an hour ago and I haven't rebooted the router ... Seems it just keeps changing...

How the hell am I supposed to maintain any kind of session with an overseas site?!

I think its only http that does this, so any other protocol, including https, should be fine.
 

Kasyx

Expert Member
Joined
Jun 6, 2006
Messages
2,565
I run a site (http://www.the-bored.net), and half the time I can't access it due to Server Errors (500). I thought it was my hosting company so I contacted them and ripped them a new one.

It turns out pretty much everyone else can access my site fine (anyone who isn't on the 41.x.x.x range, anyway).

Thanks, Telkom :(
 

ech@

Member
Joined
Oct 30, 2006
Messages
20
This is nothing recent. I noticed this a few months ago, I tried a trace route then and i seem to be blocked.
Trying to figure it out in this thread if any one could help.
http://mybroadband.co.za/vb/showthread.php?t=57286

I would really like to see how many hopps there are from my connection, to somewhere like google. I get nothing tho
 

Randerson

New Member
Joined
Oct 31, 2006
Messages
4
All sorted... I opened up the following IP ranges (more than I'm comfortable with) on the firewall, now I'm in. Lets hope it lasts.

41.240.0.0/12
165.128.0.0/10
196.25.255.0/24
198.54.202.0/24

Is there anything I can subscribe to so that I know when next Telkom is planning on cocking everything up?
 

plenty

Well-Known Member
Joined
Nov 27, 2003
Messages
185
This is an interesting topic raised, and i have searched the forums for related material, of which there is enough! :) I will comment here though :p

The following is to the best of my knowledge and experience, and various aspects my be incorrect.

Telkom runs a vast network, and in terms of technical profficiency at the datacentres, larger POP's and INX's they are pretty damn hot.
You dont just set up a load balanced transparent-proxy network layer for the kinda traffic they must be pushing... easily! And lets be honest (and think of the scale here) it works, and most of the time well! (Every one of you peeps is proxied, all your porn, warez, music, mindless rubbish, research and work related stuff)
Unshaped as far as i know and i think i tested this once, does not route via a proxy.​
I do not advocate or agree with telkom, there strategies, monopoly, pricing, policies and underhanded tactics, telkom is the atypical incorrigible! Bully, and they know it.... Policies such as the one we find ourselves discussing now, 'transparent-cache', are a forgone conclusion and in reality simple economics..! for TELKOM

A quick google search with the right keywords can turn up loads of interesting information on a variety of topics. i'll comment on some as we go.

Firstly for those who are going - "Huh, transparent-cache ?" / "But dont we eat squid ?" - check these links.


My explanation (somewhat skewed, incorrect, and simple - but i hope it gets the idea across)

Telkom has initial caches (this is assumed) at each Edge Router (They are the localised gateways for a region), these are scattered around the country and everyone connects through one. These initial caches take care of - some of the load from HTTP(port 80) and very little FTP(21) requests / traffic.

They are slaves to what i think are between 4 - 6 master caches (could be alot more - ie ... clusters) These master caches are the transparent-proxy's that you all see on your outgoing requests! should the request even get that far... So if the localised cache cant deal with the request it will query one of the master caches, and if that cannot service you, it makes a full request to the server in question GET's your content and delivers it to your screen - but not before caching it (maybe replicating it across the trans-cache-squid network) for the next ZA'peep wanting that same content.

They are great in concept, supposidly increasing your browse speed and file tansfer speeds for smaller files! From the view of a large corporate behemoth, set on profit margins... They are an easy, practical solution saving more and more as the throughput increases "Economies of scale" is the magic term here, and i will illustrate my point in a minute.
"I will leave you all to research the Pros, Cons and finer details..."​

TENET
TENET - "Tertiary Education Network"

Is the association formed to facilitate, monitor and control an agreement with telkom to supply bandwidth to campuses country wide.
I reccomend checking the link out and reading some of the documentation there about the network and agreements in place, very interesting stuff some of which i will highlight now.

Now check this out: Transparent Cache Bypass List

Quote: "In terms of the GEN2 agreement, TELKOM operates a large web caching appliance that transparently caches most web requests from most GEN2 sites. This started under the HEIST agreement in October 2004, and reduces the requirement for shared SAT-3 bandwidth by about 10%. TENET bore the upfront cost of the cache appliance and bears the monthly service charges from TELKOM." - Telkom has vast experience in this field and i did read a couple of other references that validated telkom's experience and proficiency in setting up large distributed trans-cache networks.

TENET Transparent Caching Report - PDF

Quote: "If TENET were merely to reduce the IBF to 1.30, the monthly Telkom invoice would fall by some R275,000 per month. Five months’ of such savings would pay for the cache appliance outright. There is thus no doubt that the introduction of caching would generate significant economic benefits for the institutions." - Now i URGE! everyone to read this document in full!, based on the TENETreport and the amount of traffic TELKOM must be sending and recieving a quick mental calculation highlights the savings telkom must realise with this approach

Some comment on thread posts so far:

  • As far as i know all SAIX / TELKOM ADSL Iternational traffic goes out over fibre.
  • This end of the month madness, is very wierd and telkom must do some sort if purge or cache maintenance to cause such wierdness. (this is really a guess...)
  • This could all be related to telkom implementing these new IP ranges and i just spoke alot a garbage... ;)

Anyway enough rambling, i hope i made some sort of point, and that atleast one of you finds this interesting. :eek:
 

plenty

Well-Known Member
Joined
Nov 27, 2003
Messages
185
Hi Randerson,

A solution would be to connect to a non standard port that telkom filters do not flag as cacheable.

Example:

Visit www.dnsreport.com - It should give you some rubbish about how dodgy you are. :(

now..

Visit www.dnsreport.com:8080 - you will gain access because saix does not intercept port 8080 and hijack the packets. ;)

So in closing try running ftp on a non-standard port like 800 or use SFTP on port 22, you problems will be solved :)


Hi all

We have a 4mb ADSL line through TelkomSA which we use for maintaining an overseas website.

Today we couldn't FTP in, so I figured the firewall must be blocking me. I checked my IP by accessing a site we host at IS, which logged us as 41.243.99.179.

So, being in a hurry to get into my box, I simply added 41.243.0.0/16 to the firewall rules. But we still couldn't get in. I phoned up Rackspace USA and ***ked them out. They suggested I go to www.ipchicken.com to see my IP. I was about to tell them I'd already checked my external IP, but I went there for amusement anyway, just to find something quite bizarre:

Even though my IP is 41.243.99.179 locally, its being presented to overseas sites as 196.25.255.195 (ctb-cache5-vif0.saix.net)

Thanks for telling us about the change Telkom, you totally buggered up a rollout we had to do this morning!

Does anyone have any info about this 196.25 range - i.e. what range must I add to my USA firewall to make sure this doesn't happen again??
 
Top