Public IP logged by default? Or easily added? Copyright strike claim rebuttal

[jaimito]

Hi. I'm in deep rural Spain and have Starlink now, which gives me better download speed than I had in London. But it's not perfect, sometimes it goes skewift and I have to reboot the transceiver a couple of times before it settles down.

Starlink recently contacted me with a copyright strike claim, which AFAICS alleges I downloaded a French version of Hawaii 5-0 and distributed it. I didn't. I am wondering if I was assigned a public IP of someone who had done that.

I wanted to check what my public IP address assignment history was, but Starlink don't keep that info. So I looked at my OPNSense (up-to-date, running on the old PC Engines dual AMD box). This is now default, it's not overpowered so I run it vanilla.

I don't see any public IP Log facility there.

Is there any easy built-in way for me to log my public IPs either on change, or interval-based?

I can use a much more powerful 4 core small Intel firewall box if more power is required, the PC Engines device still just about keeps up though!

Thanks in anticipation for any pointers (the OPNSense is the only thing currently always on, hence this is my target for the logging).

MeJ

[Monviech (Cedrik)]

Since Starlink puts you behind CGNAT your public IP won't be logged by the OPNsense, since it only has the internal IP address of your Provider, who then NATS you from the CGNAT 100.64.0.0/10 Subnet to a public IP.

You could try using the os-ddclient plugin, get a free Domain at Duckdns and then you could have a small log that exposes when your public IP has changed. In the ddclient log set on "Notice" you then see logs like this:

Code: [Select]

2024-09-20T09:35:20 Notice ddclient Account 535905c8-0116-4933-b524-db500691ae1c [duckdns - DuckDNS] set new ip 80.XXX.XXX.XXX for domains monviech.duckdns.org,monviech2.duckdns.org,monviech3.duckdns.org

[dseven]

If your OPNsense WAN interface is a DHCP client, it may be logging its addresses in the system log. I believe it keeps 31 days of those by default. From a shell, try:

grep -r "New IP Address" /var/log/system/

[dseven]

If it's a CGNAT public address that the claim was being made against, it's nonsensical, as that address could be used by multiple customers simultaneously - that's kindof the point of CGNAT... (?). One might expect StarLink to understand that, but.......................

[jaimito]

Since Starlink puts you behind CGNAT your public IP won't be logged by the OPNsense, since it only has the internal IP address of your Provider, who then NATS you from the CGNAT 100.64.0.0/10 Subnet to a public IP.

Duh. Thank you. I am being dim. Will experiment, I do have a DDGo but not used it in ages...

[jaimito]

If it's a CGNAT public address that the claim was being made against, it's nonsensical, as that address could be used by multiple customers simultaneously - that's kindof the point of CGNAT... (?). One might expect StarLink to understand that, but.......................

Yes, I was bit slow here. Thanks. But yes. Just to clarify, Starlink only passed on the notice. They are not taking any further action, but the slander is annoying! Bit of insurance could be good. I've heard of this happening to other people, I am not a rabid social media user and post nothing dubious, so not expecting to get a hit myself!

[jaimito]

Thought I'd just follow-up: thanks for the kick in the posterior regarding CGNAT. I got back to Starlink over this, together with other questions about IP address assignment, and they have now told me the report may have been wrongly assigned, grrr. What a surprise for me that is, not. So the case is closed and they said "donaworry"  . So I won't. I will still look into logging the CGNAT address just in case: the infringing IP was in their CGNAT block and not the external IP of the network, AFAICS. Thanks to all for the help.