Routing issue between two Sunrise connections (Destination Host Unreachable)

peterzhang

I am experiencing a very specific routing issue and am hoping to get some technical insight or assistance from the Sunrise support team.

The Setup: I have a home server running at my house. It is configured correctly, and I can access it from the outside world (mobile networks, other ISPs, different cities) with absolutely no problems.

The Problem: The only place I cannot access my server from is my neighbor’s house. My neighbor is also a Sunrise customer. When we try to reach each other’s public IP addresses, the connection drops, and a traceroute/ping results in a “Destination Host Unreachable” error.

The Technical Details: Because we live right next to each other and are both on Sunrise, I checked our public IP addresses and noticed they are extremely close. To protect our privacy, I won’t share the exact addresses, but they look like this:

My IP: 178.82.abc.x
Neighbor’s IP: 178.82.abc.y (just a few digits away from mine)

Because our IPs are in the exact same IP range/subnet, it seems like the traffic is failing to route back out. It behaves exactly as if there is Layer 2 isolation (client isolation) active on the local node/CMTS, preventing two Sunrise modems on the same subnet from talking to each other directly.

My Questions:

Is client isolation active by design between Sunrise customers who are provisioned on the same local node/subnet?
Is there a routing configuration on the Sunrise side that can be adjusted so our traffic successfully routes between our two connections?

Thank you in advance for any technical assistance or insight you can provide!

Daniele_Sunrise

peterzhang We’ve disabled CGN as a test. Your modem should restart in a few minutes. Could you please try again afterwards?

Greetings
Daniele

peterzhang

One context to add is that this routing issue only began after a recent network update. Both my neighbor and I were instructed by Sunrise to move our fiber cables from Port 2 to Port 1 on our optical wall sockets on 30.03.2026.

Before the update (Port 2): We were able to route traffic to each other’s public IP addresses with no issues.
After the update (Port 1): The “Destination Host Unreachable” errors started happening.

peterzhang

Hi Daniele,

Thank you for the quick response and for making that change!

My modem didn’t automatically restart after waiting a while, so I went ahead and did a manual power cycle. I also had my neighbor restart theirs just to be completely sure.

Unfortunately, the test was unsuccessful. We are still getting the exact same “Destination Host Unreachable” error when trying to reach each other.

Since we originally had different public IPs (178.82.abc.x and .y), is it possible we weren’t actually behind CGN, but are instead being blocked by something else?

Let me know what you would like us to try next or if there are any specific logs I can provide. I really appreciate your help with this!

Xydocq

hello peterzhang

@Daniele_Sunrise will be back on monday.

I don’t have a fibre connection but a test I did with my HFC connection, showed the same result. No routing within the same network segment.

While it works perfectly fine when connecting from a different network:

I do remember, back in the beginning, Cablecom had an issue with people seeing other computers on their device list. So I guess they have the client-isolation still active, even they don’t offer the affected modems any longer.

Daniele_Sunrise

peterzhang I assume we have isolation protection here, as you and Xydocq have tried and found. It won’t be possible to disable this. Perhaps a VPN might help?

Greetings
Daniele

Xydocq

@peterzhang

If you want to access each others resources, tailscale might be an option.

peterzhang

Hi Daniele and Xydocq,

Thank you both for looking into this and for the Tailscale suggestion. I will definitely look into overlay networks as a fallback, but I have to admit I am a bit disappointed to hear that direct routing might be permanently blocked. Having to rely on a third-party proxy service to connect to the house next door feels like a step backward.

Before we completely throw in the towel on a native solution, I’d like to ask two follow-up questions:

1. The Infrastructure Migration: This issue only started happening immediately after Sunrise instructed both of us to switch our fiber cables from Port 2 to Port 1. On the previous infrastructure, we were able to access each other’s networks with absolutely no issues. Since this worked fine before, is this strict isolation an intentional new policy for the new network segment, or is it simply a default setting on the new hardware that could potentially be adjusted to match the previous routing behavior?

2. IPv6 and Configuration Differences: Does this isolation protection also apply to IPv6 traffic? My neighbor currently has a public IP for both IPv4 and IPv6. Meanwhile, I am using the Connect Box 3 Fiber, and I currently only have a public IPv4. A while ago, I specifically opted in to get a public IPv4 address, and it seems I lost my IPv6 access in that process. Since my neighbor (who is using Zyxel fiber router) has both, I am wondering if there is a fundamental configuration difference between our two accounts—perhaps I need full Dual-Stack enabled? If IPv6 traffic is routed differently and bypasses this local IPv4 isolation, could restoring IPv6 on my connection fix this?

I really appreciate your time and help in exploring all the options here!

Xydocq

peterzhang

From what I know, Sunrise switched from a rented fibre infrastructure to it’s own infrastructure. That’s the reason you had to move the cable from port 1 to port 2.

Full Dual-Stack isn’t available for regular customers. I heard, some business-connections can get Dual-Stack. Non business connection only get DS-lite. A puplic IPv6 address combined with a non routable IPv4 address (CGNAT).

I have no idea if Sunrise uses some sort of isolation when it comes to IPv6.

peterzhang

Hi Xydocq and Daniele,

Thanks for the background on the infrastructure switch and DS-lite limitations. It perfectly explains why the connection dropped after moving to Port 1.

While it’s disappointing that direct routing is no longer possible on the new network, I understand the constraints. I’ll leave it at that and just set up Tailscale to bypass the isolation.

I really appreciate you both taking the time to explain everything and look into this!