Wireless 4G Broadband
Quick links
Service restrictions
The safety of Skinny customers and the quality of service we provide are important to us. For security and to reduce network risks that could impact service performance, we apply certain restrictions and controls to our broadband services. Below is a summary of the key service restrictions we apply.
Blocking objectionable websites
Trusted agencies provide Skinny with verified lists of some of the internet’s most harmful websites. Skinny then blocks these websites from our network, to help protect New Zealanders. This includes websites containing child abuse material. It also includes websites aimed at defrauding New Zealanders of money or information.
The New Zealand National Cyber Security Centre (NCSC) identifies and verifies some of the fraudulent websites we block. We then provide high-level, anonymised reporting to the NCSC on the total number of attempted visits to each of these websites. For example, ‘A’ website had seven attempted visits; ‘B’ website had 15 attempted visits. The NCSC uses this information to understand what they can do to help protect New Zealanders.
Port filtering
By default Skinny blocks some ports which are typically not used or needed. This is international best practice to help with security and prevent the spread of spam, worms and viruses.
The ports that are blocked are:
| Port | Protocol | Direction | Used for |
|---|---|---|---|
| 25 | TCP | Incoming and outgoing | Unencrypted email connections |
| 53 | TCP and UDP | Incoming only | DNS servers |
| 135-139 | TCP | Incoming only | NetBIOS |
| 445 | TCP | Incoming only | SMB |
Restricted traffic
To make sure there's enough capacity for all of our customers, Skinny restricts the following:
- The amount of Domain Name System (DNS) traffic a customer can send to Skinny-owned DNS servers.
- The amount of Network Time Protocol (NTP) traffic a customer can send to Skinny-owned NTP servers.
- The amount of Automatic Configuration Server (ACS) traffic a customer can send to Skinny-owned ACS servers.
Skinny Wireless Broadband IP addresses (CG-NAT)
Every broadband connection has an IP address. Think of this like your postal address on the internet for data traffic. The address is provided as part of your connection and most of the time you don’t need to worry about it.
Skinny's Wireless Broadband doesn't give each connection a unique IP address. Instead, it uses a pool of IP addresses. It uses a system called Carrier Grade – Network Address Translation (CG-NAT) to share these addresses among multiple users. This enables us to conserve the amount of IP addresses we need.
What does this mean for my Wireless service?
Generally, you won’t notice any differences. The systems are designed so you can still browse, stream, email, work, and play, and generally use the internet without any issues.
However, there are some applications and ways of working which might not work as well with CG-NAT. For example, you can’t port-forward (this is generally not recommended anyway as it poses security risks) or run a lot of concurrent connections.
For example, some file-sharing applications download files from hundreds of different users around the world, and thus use higher numbers of concurrent connections. Extreme use of any software which uses a lot of concurrent connections may not work optimally.
Additionally, users with very large households or businesses with a high number of users may also generate a high number of concurrent connections.