Dual Router Port Forwarding Difficulties

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking
Author Message
LogicallySkewed
DD-WRT Novice


Joined: 22 Aug 2019
Posts: 3

PostPosted: Fri Aug 23, 2019 21:00    Post subject: Dual Router Port Forwarding Difficulties Reply with quote
First, here is my current setup:

ISP Modem
Has no routing capabilities
Gets non-static IP address from ISP

Router 1 (no VPN)
Router: Linksys EA9200
Firmware: Linksys (DD-WRT not compatible)
WAN port connected via cable to ISP Modem
Local IP: 192.168.1.1
Subnet Mask: 255.255.255.0
DHCP enabled, IP range: 192.168.1.100 to 192.168.1.149
NAT,
IPv6: Disabled
Static Routes: None currently set up

Router 2 (VPN)
Router: Linksys WRT3200ACM
Firmware: DD-WRT
WAN port connected via cable to LAN port of Router 1
VPN: NordVPN set up through OpenVPN
VPN Passthrough: Enabled
WAN IP: 192.168.1.148
Local IP: 192.168.2.1
Subnet Mask: 255.255.255.0
DHCP enabled, IP range: 192.168.2.100 to 192.168.2.149
Operating Mode: Gateway
IPv6: Disabled
Static Routes: None currently set up

I can connect to the Internet when connected to either router. I can also connect to devices on Router 1 when I am connected to that router and the same for Router 2, but I cannot connect to devices on Router 1 when I am connected to Router 2 and vice versa. Further, I can connect to devices on Router 1 when I am outside my network but not to devices on Router 2. I've searched for a solution but haven't found anything that has worked. I've also talked to tech support at NordVPN and they inform me that port forwarding isn't supported by their VPN. I figure there has to be a way to get this to work though. What do I need in order to connect to devices on each router when connected to the other? What do I need to connect to the same devices when outside of my network?

Thank you very much in advance! Any help would be greatly appreciated.
Sponsor
jxm
DD-WRT Guru


Joined: 23 Jul 2017
Posts: 706
Location: Brisbane, Australia

PostPosted: Fri Aug 23, 2019 22:20    Post subject: Reply with quote
Try reading this

https://wiki.dd-wrt.com/wiki/index.php/Linking_Subnets_with_Static_Routes

Cheers
LogicallySkewed
DD-WRT Novice


Joined: 22 Aug 2019
Posts: 3

PostPosted: Fri Aug 23, 2019 22:26    Post subject: Reply with quote
I tried that previously and it didn't work Sad . Router mode on the VPN router seems to kill my connection to the Internet when I am connected to that router.
Per Yngve Berg
DD-WRT Guru


Joined: 13 Aug 2013
Posts: 5136
Location: Akershus, Norway

PostPosted: Sat Aug 24, 2019 7:29    Post subject: Reply with quote
Why don't you swap router 1 and 2?

On router 1: Enter static route to 192.168.2.0/24 gateway 192.168.1.148

Note: I would have used a static IP 192.168.1.2 for the WAN on router 2.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3798
Location: Netherlands

PostPosted: Sat Aug 24, 2019 7:42    Post subject: Reply with quote
First of all it is good practice to also state your build number, some builds can have problems ( Wink )

You can not do anything on your ISP modem does that mean it is in bridge mode?
In that case the WAN ip of router 1 should have a public IP, is this the case?

In this kind of setup you should be able to reach router 1 (and its clients) from clients on router 2 even if it is using a VPN.
If not then show output of:
Code:
ip route show
iptables -vnL FORWARD

(you did not use a kill switch by any chance?)

You normally will not have access from router 1 to router 2.
That is where the instructions @jxm send you come into play.
A lot of (older) instructions are telling you to use router mode, I am not a big fan of that because it breaks more things then that it solves on modern routers, like you found out.

Luckily router mode is not necessary just leave it in gateway mode, basically set a static route on router 1 and open up the firewall on router 2.

Attached my personal notes how I do it.

The last? problem connecting to router 2 from the internet:
Of course you have to set a port forward on router 1 to router 2 to begin with.
However that is not sufficient.
Have a look at post no 6 from @eibgrad detailing the problem and solutons: https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1129398 .

One of the solutions Port forwarding via the VPN is not possible with Nord as you have found out.
The easiest way out is PBR but the DDWRT PBR implementiation has its flaws, see: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662

But the DDWRT PBR implementation is easy to setup and a good start to see if it is working so perhaps start with that (warning never include the routers own IP address in the PBR range)

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
LogicallySkewed
DD-WRT Novice


Joined: 22 Aug 2019
Posts: 3

PostPosted: Sat Aug 24, 2019 17:02    Post subject: Reply with quote
Thank you, egc! I was using a kill switch and turned it off. After following the instructions, I've managed to get connectivity to the devices between each router. I haven't looked through everything yet to see about getting remote access when I am not in my network, but will let you know.

The kill switch I was using was recommended by my VPN provider:

WAN_IF=`nvram get wan_iface`
iptables -I FORWARD -i br0 -o $WAN_IF -j REJECT --reject-with icmp-host-prohibited
iptables -I FORWARD -i br0 -p tcp -o $WAN_IF -j REJECT --reject-with tcp-reset
iptables -I FORWARD -i br0 -p udp -o $WAN_IF -j REJECT --reject-with udp-reset

Is there a different way I can do a kill switch that won't break my connection between each router?
Per Yngve Berg
DD-WRT Guru


Joined: 13 Aug 2013
Posts: 5136
Location: Akershus, Norway

PostPosted: Sat Aug 24, 2019 18:17    Post subject: Reply with quote
WAN_IF=`nvram get wan_iface`
iptables -I FORWARD -i br0 -o $WAN_IF -j REJECT --reject-with icmp-host-prohibited
iptables -I FORWARD -i br0 -p tcp -o $WAN_IF -j REJECT --reject-with tcp-reset
iptables -I FORWARD -i br0 -p udp -o $WAN_IF -j REJECT --reject-with udp-reset
iptables -I FORWARD -o $WAN_IF -d 192.168.0.0/16 -j ACCEPT


Added a accept for the local LAN.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3798
Location: Netherlands

PostPosted: Sat Aug 24, 2019 18:23    Post subject: Reply with quote
LogicallySkewed wrote:
Thank you, egc! I was using a kill switch and turned it off. After following the instructions, I've managed to get connectivity to the devices between each router. I haven't looked through everything yet to see about getting remote access when I am not in my network, but will let you know.

The kill switch I was using was recommended by my VPN provider:

WAN_IF=`nvram get wan_iface`
iptables -I FORWARD -i br0 -o $WAN_IF -j REJECT --reject-with icmp-host-prohibited
iptables -I FORWARD -i br0 -p tcp -o $WAN_IF -j REJECT --reject-with tcp-reset
iptables -I FORWARD -i br0 -p udp -o $WAN_IF -j REJECT --reject-with udp-reset

Is there a different way I can do a kill switch that won't break my connection between each router?



That kill switch looks like a bit well eh overkill Wink

I am not even sure there exists such a thing as --reject-with udp-reset (where is @eibgrad when you need him Smile )

Because you are wanting to reach the router from the internet we need a state new in the kill switch and exclude addresses for the router higher up:
Code:
iptables -I FORWARD -i br0 -d ! 192.168.0.0/16 -o $(nvram get wan_iface) -m state --state NEW -j REJECT --reject-with icmp-host-prohibited


This rule should do it all in one.

Have not tested it so no guarantee it works.
Always test first from the command line before putting it in the firewall rules

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum