On a CGNAT network, hundreds of subscribers share each public IPv4 address, so they also share its reputation. When one infected device starts sending spam, the shared address is blocklisted and everyone behind it pays. Hexium vBNG contains the offender with one standard RADIUS attribute, Framed-Pool, and a single CoA, without touching the customer’s router.
1. The problem: one address, shared fate
Public blocklists list addresses, not subscribers. Behind CGNAT, one public address carries the traffic of many households, and a blocklist cannot tell them apart.
The usual trigger is a compromised home router, camera or other IoT device that joins a botnet and starts sending spam or attack traffic. Once the shared address is listed, every subscriber behind it sees the effects:
- mail from their own servers or clients is rejected;
- websites throw up CAPTCHA walls or block them outright;
- online services flag their logins as suspicious.
The calls go to your helpdesk. The subscriber who caused it usually has no idea their device is infected.
2. Why the usual responses fall short
Each common response either punishes the innocent or moves the problem somewhere else.
| Response | What actually happens |
|---|---|
| Disconnect the offender | Stops the abuse, but costs a support call or a site visit, and the customer may not know why they were cut off. |
| Rotate the shared public address | Burns scarce IPv4. The offender is still behind CGNAT and poisons the new address next. |
| Request delisting and wait | Requests fail while the address keeps sending abuse, so the listing keeps coming back. |
What the operator needs is a way to take the offender’s traffic off the shared address, quickly, without a site visit and without disturbing anyone else.
3. The building block: RADIUS Framed-Pool
Framed-Pool is RADIUS attribute 88, defined in RFC 2869. It names the address pool a subscriber should use, and every major BNG supports it, so most operators’ RADIUS policies already send it.
Hexium applies the same attribute to CGNAT. For a NATed subscriber, Framed-Pool refers a designated public IP address pool their traffic is translated from. The private address on the customer’s router is not tied to that choice. One standard attribute therefore decides whether a subscriber leaves from the shared CGNAT pool, a dedicated public pool or a quarantine pool, with no vendor-specific attributes in the RADIUS policy.
When RADIUS sends more than one addressing instruction, Hexium applies them in this order:
| Priority | Source | Result |
|---|---|---|
| 1 | Framed-IP-Address | That exact address is used |
| 2 | Framed-Pool | The named pool is used |
| 3 | Interface default pool | Used when RADIUS names neither |
If RADIUS names a pool that does not exist, Hexium rejects the subscriber by default. Operators can configure a Default Pool as a fallback instead. For quarantine pools, keep Reject: a typo in the RADIUS policy should fail loudly, not quietly release an offender into the shared pool.
4. The solution: move the NAT, not the subscriber
The operator sets aside a handful of public addresses as a quarantine NAT pool. When abuse is traced to a subscriber, RADIUS sends one CoA naming that pool:
- Hexium re-authorises the live session in place, with the new Framed-Pool.
- It flushes the subscriber’s existing NAT mappings, so nothing keeps using the shared address.
- All new traffic from that subscriber leaves from a quarantine address.
The customer’s router keeps its private address and its session: no DHCP exchange, no PPP redial, no reboot. The move works the same way for IPoE and PPPoE subscribers.
The CoA changes only which public pool Hexium translates the subscriber from; the CPE keeps its address and session.
The effect is immediate. The shared address stops collecting fresh evidence, so a delisting request actually sticks. Offenders share the quarantine pool only with other offenders. Once the customer has cleaned up their device, a second CoA returns them to the shared pool.
Two more controls limit the damage one device can do:
- Per-subscriber NAT session cap. Configurable, 1,024 by default. At the cap, Hexium evicts that subscriber’s own least recently used sessions, so one infected device cannot exhaust NAT state for its neighbours.
- Walled garden. As an alternative to quarantine, a pool can be kept out of NAT and routed to a notification portal that tells the customer what is wrong.
On IPv6 the problem largely disappears, since each subscriber already has its own prefix. Hexium supports Framed-IPv6-Pool and Delegated-IPv6-Prefix-Pool for the same per-subscriber control, so pushing dual-stack also shrinks the shared-fate exposure.
5. Configuration
Three pieces are needed: two NAT pools on Hexium, a RADIUS policy that names them, and a CoA to move a live subscriber.
5.1 Hexium settings
| Setting | Purpose | Example value |
|---|---|---|
NAT pool cgnat-shared | Public addresses for normal CGNAT subscribers | 203.0.113.0/26 |
NAT pool cgnat-quarantine | Penalty box for offenders | 203.0.113.64/30 |
| Missing-pool behaviour | Reject (default) or fall back to the Default Pool | Reject |
| Per-subscriber NAT session limit | Caps NAT state per subscriber, LRU eviction at the cap | 1,024 (default) |
| IPDR export | Per-session NAT records | Enabled |
# Hexium CLI for the settings above: exact syntax to be inserted by engineering5.2 RADIUS policy
Normal subscribers get the shared pool in their Access-Accept. An offender’s entry is switched to the quarantine pool, so it also applies if they reconnect later. A FreeRADIUS users-file example:
# Normal CGNAT subscriber
sub-1042 Auth-Type := Accept
Framed-Pool = "cgnat-shared"
# Quarantined subscriber
sub-2077 Auth-Type := Accept
Framed-Pool = "cgnat-quarantine"5.3 Moving a live subscriber
The policy change takes effect on the next login. To move the subscriber now, send a CoA-Request to Hexium naming the new pool:
echo 'Acct-Session-Id = "<session-id>", Framed-Pool = "cgnat-quarantine"' \
| radclient -x 192.0.2.10:3799 coa <shared-secret>A CoA-ACK confirms the move. Returning the subscriber to cgnat-shared is the same command with the original pool name.
6. Verification and traceability
Hexium’s IPDR records every NAT session with six fields: source address, source port, destination address, destination port, NAT address and protocol. That gives the operator two things.
- From abuse report to account. A report naming the shared address and a port leads to one subscriber, not a thousand.
- Proof of containment. After the CoA, the offender’s new sessions appear against a quarantine address. That record is the evidence to attach to a delisting request.
# Hexium CLI to show a subscriber's NAT pool and current NAT address: to be inserted by engineering7. Five questions to ask your BNG vendor
Most BNGs support Framed-Pool. What decides whether you can contain an offender is everything around it.
| Question | Hexium vBNG |
|---|---|
| Can standard Framed-Pool choose the public NAT pool for each subscriber? | Yes. No vendor-specific attributes needed. |
| Can a live subscriber be moved to another NAT pool by CoA, without touching the CPE? | Yes. Re-authorised in place, for IPoE and PPPoE. |
| If RADIUS names a pool that doesn’t exist, does the BNG reject or fall back silently, and can you choose? | Rejects by default. A Default Pool fallback is optional. |
| Is NAT state capped per subscriber, and can you set the cap? | Yes. 1,024 sessions by default, configurable. |
| Can NAT logs trace a public address and port back to one subscriber? | Yes. Per-session IPDR with NAT address and ports. |
8. What’s next
Quarantine starts once an offender has been identified. That signal comes from abuse reports, blocklist feeds or your own monitoring, and spotting offenders before the blocklists do is a topic for a later post. Next in this series: why gamers complain about CGNAT, and what Hexium’s endpoint-independent NAT (NAT44-EI) does about it.