How to access a modem on a LAN on a different subnet?

Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware
Author Message
Particle Man
DD-WRT Novice


Joined: 07 Jun 2021
Posts: 15

PostPosted: Sat Aug 28, 2021 21:59    Post subject: How to access a modem on a LAN on a different subnet? Reply with quote
I want to access my modem from the LAN on which the modem is the bridge but without having to be wired directly to the modem.

I can ping the modem only from the router.

Modem: Arris SB200 at 192.168.100.1
Router: ASUS RT-AC1900P at 192.168.x.x
DD-WRT r47135

I was able to do this with an SB6183 and an earlier DD-WRT (somewhere between about r44483 and r46069).

Nothing has worked, neither Access To Modem Configuration nor other threads touching this issue.

I've tried adding the firewall commands and the port forward rule and then rebooting the router:

Code:
ifconfig `nvram get wan_ifname`:0 192.168.100.2 netmask 255.255.255.0
iptables -t nat -I POSTROUTING -o `nvram get wan_ifname` -j MASQUERADE

The generated port forward rule in the output of iptables:
Quote:
-A FORWARD -s 192.168.0.0/16 -d 192.168.100.1/32 -p tcp -m tcp --dport 80 -j ACCEPT
-A FORWARD -s 192.168.0.0/16 -d 192.168.100.1/32 -p udp -m udp --dport 80 -j ACCEPT

And I've tried executing the above in the CLI plus a variation of the generated port forwarding rule and then not rebooting the router:

Code:
iptables -I FORWARD -s 192.168.x.0/24 -d 192.168.100.1 -o `nvram get wan_ifname` -j ACCEPT
Sponsor
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 14223
Location: Texas, USA

PostPosted: Sat Aug 28, 2021 22:32    Post subject: Reply with quote
Try the old method. I just edited the wiki to de-foncuse the sidexlic edits on the code to use and how to enter it. Not sure why we would need to change anything; because the original method should work fine.
Code:
ifconfig `nvram get wan_ifname`:0 192.168.100.2 netmask 255.255.255.0

Click "Save Startup"
Code:
iptables -t nat -I POSTROUTING -o `nvram get wan_ifname` -j MASQUERADE

Click "Save Firewall"

_________________
"Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity"
Contribute To DD-WRT
Pogo - A minimal level of ability is expected and needed...
DD-WRT Releases 2023 (PolitePol)
DD-WRT Releases 2023 (RSS Everything)

----------------------
Linux User #377467 counter.li.org / linuxcounter.net
Particle Man
DD-WRT Novice


Joined: 07 Jun 2021
Posts: 15

PostPosted: Sat Aug 28, 2021 23:28    Post subject: Reply with quote
kernel-panic69 wrote:
Try the old method.... the original method should work fine.

Tried it, yet again. Although it supposedly should work, it doesn't.
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 14223
Location: Texas, USA

PostPosted: Sat Aug 28, 2021 23:36    Post subject: Reply with quote
Try using $(nvram get wan_ifname) instead of `nvram get wan_ifname`. If that works, then I will make another edit. I seem to recall @egc mentioning a quirk with this. Sorry, I completely forgot to suggest this before Embarassed Rolling Eyes

Code:
ifconfig $(nvram get wan_ifname):0 192.168.100.2 netmask 255.255.255.0   

Click "Save Startup"

Code:
iptables -t nat -I POSTROUTING -o $(nvram get wan_ifname) -j MASQUERADE

Click "Save Firewall"

IF that does not work:
Code:
ifconfig $(nvram get wan_ifname):0 192.168.100.2 netmask 255.255.255.0
iptables -t nat -I POSTROUTING -o $(nvram get wan_ifname) -j MASQUERADE

Click "Save Firewall"

Found out why the wiki was edited: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=323890

_________________
"Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity"
Contribute To DD-WRT
Pogo - A minimal level of ability is expected and needed...
DD-WRT Releases 2023 (PolitePol)
DD-WRT Releases 2023 (RSS Everything)

----------------------
Linux User #377467 counter.li.org / linuxcounter.net
Particle Man
DD-WRT Novice


Joined: 07 Jun 2021
Posts: 15

PostPosted: Sun Aug 29, 2021 4:59    Post subject: Reply with quote
kernel-panic69 wrote:
Sorry, I completely forgot to suggest this before Embarassed Rolling Eyes

No worries!

kernel-panic69 wrote:
Try using $(nvram get wan_ifname) instead of `nvram get wan_ifname`....

Also do not work.

Now, if I should see evidence of the MASQUERADE rule in iptables, it's not there, regardless of the syntax used for specifying the interface.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12889
Location: Netherlands

PostPosted: Sun Aug 29, 2021 5:39    Post subject: Reply with quote
Try:
Code:
iptables -t nat -I POSTROUTING -o $(get_wanface) -j MASQUERADE


Check with:
iptables -vnL -t nat

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
ho1Aetoo
DD-WRT Guru


Joined: 19 Feb 2019
Posts: 2977
Location: Germany

PostPosted: Sun Aug 29, 2021 9:12    Post subject: Reply with quote
If I remember correctly there was once a change and BS said to run both in the firewall.

For me it works without problems, my modem is connected to the dd-wrt router in full bridge mode.

Firewall:

Code:
ifconfig `nvram get wan_ifname`:0 192.168.2.2 netmask 255.255.255.0
iptables -t nat -I POSTROUTING -o `nvram get wan_ifname` -j MASQUERADE


Code:
root@DD-WRT:~# ifconfig
eth0:0    Link encap:Ethernet  HWaddr XX:XX:XX:XX:XX:XX 
          inet addr:192.168.2.2  Bcast:192.168.2.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:100


Code:
root@DD-WRT:~# iptables -vnL -t nat
Chain POSTROUTING (policy ACCEPT 8 packets, 511 bytes)
    4   240 MASQUERADE  all  --  *      eth0    0.0.0.0/0            0.0.0.0/0


Code:
~$ ping 192.168.2.1
PING 192.168.2.1 (192.168.2.1) 56(84) Bytes Daten.
64 Bytes von 192.168.2.1: icmp_seq=1 ttl=254 Zeit=1.05 ms
64 Bytes von 192.168.2.1: icmp_seq=2 ttl=254 Zeit=0.963 ms


Code:
~$ telnet 192.168.2.1
Trying 192.168.2.1...
Connected to 192.168.2.1.
Escape character is '^]'.

Account:


Code:
~$ links2 192.168.2.1

Router Login

Username
Password [ Login ]

Security Warning: You are logging in without encryption which is not recommended. To login securely click here. Copyright © 2000- DrayTek Corp. All Rights Reserved.


without port forwarding stuff

both variants work for me too (why not?)


Code:
root@DD-WRT:~# echo `nvram get wan_ifname`
eth0
root@DD-WRT:~# echo $(nvram get wan_ifname)
eth0


but the rules get lost from time to time when you press "apply" somewhere in WebIF

I then simply execute the commands again in the "Administration -> Commands" tab


egc wrote:
Try:
Code:
iptables -t nat -I POSTROUTING -o $(get_wanface) -j MASQUERADE


Code:
root@DD-WRT:~# echo $(get_wanface)
ppp0


by the way this does not work for me, the string outputs the PPPoE interface

possible that it works with the WAN type DHCP or static


Last edited by ho1Aetoo on Sun Aug 29, 2021 12:10; edited 1 time in total
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 14223
Location: Texas, USA

PostPosted: Sun Aug 29, 2021 12:00    Post subject: Reply with quote
I smell a(nother) wiki edit coming, lol. Waiting on verification of @egc's method.
_________________
"Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity"
Contribute To DD-WRT
Pogo - A minimal level of ability is expected and needed...
DD-WRT Releases 2023 (PolitePol)
DD-WRT Releases 2023 (RSS Everything)

----------------------
Linux User #377467 counter.li.org / linuxcounter.net
Particle Man
DD-WRT Novice


Joined: 07 Jun 2021
Posts: 15

PostPosted: Tue Aug 31, 2021 22:32    Post subject: Reply with quote
kernel-panic69 wrote:
I smell a(nother) wiki edit coming, lol. Waiting on verification of @egc's method.

Let's not count our objects before they're compiled. Wink

I had already mentioned that both variants don't work (any differently).

Code:
# ifconfig
vlan2:0   Link encap:Ethernet  HWaddr XX:XX:XX:XX:XX:XX
          inet addr:192.168.100.2  Bcast:192.168.100.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

Code:
# iptables -vnL -t nat|grep M
  507 38064 MASQUERADE  all  --  *      vlan2   0.0.0.0/0            0.0.0.0/0
    9  2952 MASQUERADE  all  --  *      br0     192.168.x.0/24       192.168.x.0/24

And adding the port forward didn't seem to help.


Now, my apologies for forgetting some likely crucial details. For devices on the LAN on which a VPN is not enabled, the ifconfig and iptables commands are unneeded to facilitate access to the modem. Disabling the VPN solves the problem. So, although this issue seems to be due to the VPN, might a workaround be possible by changing something on the router?
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 14223
Location: Texas, USA

PostPosted: Tue Aug 31, 2021 23:22    Post subject: Reply with quote
Or rather, it's not an issue. VPN will not connect because there is no route to the modem; this isn't something that is broken, IMHO. The VPN connects the router via tunnel to the internet; it will not connect to your modem directly, ever. This is by design. I don't know how this basic networking concept is not understood. Perhaps you can use PBR to mitigate this in some way for a particular client, but I will let @egc or @eibgrad or one of the other folks answer and confirm.

And please do not reference development or software coding or anything technical since you completely pooched this. Here we are chasing our tails because you're expecting a VPN client to connect to your modem's webUI.

_________________
"Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity"
Contribute To DD-WRT
Pogo - A minimal level of ability is expected and needed...
DD-WRT Releases 2023 (PolitePol)
DD-WRT Releases 2023 (RSS Everything)

----------------------
Linux User #377467 counter.li.org / linuxcounter.net
Particle Man
DD-WRT Novice


Joined: 07 Jun 2021
Posts: 15

PostPosted: Wed Sep 01, 2021 0:00    Post subject: Reply with quote
kernel-panic69 wrote:
The VPN connects the router via tunnel to the internet; it will not connect to your modem directly, ever.

While this may be true for other VPNs, mine allows local connections (192.168.0.0 - 192.168.255.255 and 10.0.0.0 - 10.255.255.255)​, which I've confirmed only for IPs on the same subnet as the gateway.
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 14223
Location: Texas, USA

PostPosted: Wed Sep 01, 2021 1:17    Post subject: Reply with quote
But it's not working until you kill the VPN, and it won't. Your VPN bypasses the modem completely. LAN -> router -> VPN service provider. I really don't know how difficult this is to grasp.
_________________
"Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity"
Contribute To DD-WRT
Pogo - A minimal level of ability is expected and needed...
DD-WRT Releases 2023 (PolitePol)
DD-WRT Releases 2023 (RSS Everything)

----------------------
Linux User #377467 counter.li.org / linuxcounter.net
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum