Port forwarding - device not responding...

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking
Goto page 1, 2  Next
Author Message
a15995
DD-WRT User


Joined: 18 Oct 2016
Posts: 73
Location: Copenhagen, Denmark

PostPosted: Thu Jan 20, 2022 13:49    Post subject: Port forwarding - device not responding... Reply with quote
Hello!

Not sure if this belongs under "advanced" but here goes.

I have trouble accessing an FTP server from the WAN side of my router. Accessing the same server locally is no problem.

I have the following port forwarding rule set up:

Code:
Application   Protocol   Source Net   Port from   IP Address   Port to   Enable
FTPWAN      TCP         -                     21XX      192.168.X.X      21      Y


This works when pointing to other devices in my local network but not with this specific device.

The problematic device is linux based but does not have the iptables command installed. As written, the device responds to port 21 locally.

I have other forwarding port problems reaching this device from the outside. It does not seem to respond to any WAN requests.

Any ideas as to how to test this issue further?

Thanks,

_________________
/Søren
Netgear Nighthawk X4S (R7800 ver. 1) | Atheros/Qualcomm | IPQ8065 dual-core 1.7 GHz | AC2600 | 512 MB RAM | 128 MB FLASH | 128 KB NVRAM
Firmware: DD-WRT v3.0-r47665 std (11/24/21)
Install guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614

Sponsor
a15995
DD-WRT User


Joined: 18 Oct 2016
Posts: 73
Location: Copenhagen, Denmark

PostPosted: Thu Jan 20, 2022 14:17    Post subject: Routing internally to VPN client... Reply with quote
Hmm, all that writing made me actually think.

The device is also an OpenVPN client (policy based routing) which explains why it does not react to the WAN request.

The problem remains though (it just got advanced).

How do I route traffic from my public IP address to this VPN client internally?

Thanks,

_________________
/Søren
Netgear Nighthawk X4S (R7800 ver. 1) | Atheros/Qualcomm | IPQ8065 dual-core 1.7 GHz | AC2600 | 512 MB RAM | 128 MB FLASH | 128 KB NVRAM
Firmware: DD-WRT v3.0-r47665 std (11/24/21)
Install guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614

eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 8997

PostPosted: Thu Jan 20, 2022 18:22    Post subject: Reply with quote
Given FTP is completely insecure (everything is in the clear, data and username/password), you should never expose it directly to the WAN anyway. You should be using a VPN (e.g., OpenVPN or WireGuard).

What I'm not quite sure about is whether the target device is actually hosting the OpenVPN client itself and using PBR there, or the OpenVPN client is on the router, and is being routed over the VPN due to PBR on the router. Your description was a bit ambiguous (at least to my eyes).

_________________
ddwrt-ovpn-split-basic.sh * ddwrt-ovpn-split-advanced.sh * ddwrt-ovpn-kill-switch.sh * ddwrt-ovpn-watchdog.sh * ddwrt-ovpn-remote-access.sh * ddwrt-ovpn-client-backup.sh * ddwrt-mount-usb-drives.sh * ddwrt-blacklist-domains.sh * ddwrt-wol-port-forward.sh * ddwrt-dns-monitor.sh (NEW!)
a15995
DD-WRT User


Joined: 18 Oct 2016
Posts: 73
Location: Copenhagen, Denmark

PostPosted: Thu Jan 20, 2022 21:32    Post subject: Reply with quote
eibgrad wrote:
Given FTP is completely insecure (everything is in the clear, data and username/password), you should never expose it directly to the WAN anyway. You should be using a VPN (e.g., OpenVPN or WireGuard).

What I'm not quite sure about is whether the target device is actually hosting the OpenVPN client itself and using PBR there, or the OpenVPN client is on the router, and is being routed over the VPN due to PBR on the router. Your description was a bit ambiguous (at least to my eyes).


The VPN is on the router and the device is routed through the tunnel using PBR on the router.

I may block FTP but as I wrote, I have other services that I want to access from WAN.

How can I route specific ports to this device given VPN - I'm pretty sure I can put something in the firewall/commands that will get the devices VPN IP and route traffic that way...?

Thanks,

_________________
/Søren
Netgear Nighthawk X4S (R7800 ver. 1) | Atheros/Qualcomm | IPQ8065 dual-core 1.7 GHz | AC2600 | 512 MB RAM | 128 MB FLASH | 128 KB NVRAM
Firmware: DD-WRT v3.0-r47665 std (11/24/21)
Install guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614

eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 8997

PostPosted: Thu Jan 20, 2022 22:10    Post subject: Reply with quote
I believe @egc updated PBR in the OpenVPN client to allow port-based support, rather than just source IP. But I haven't used it myself. Check the stickies in this forum for latest OpenVPN documents by @egc.

The other option is to use my own advanced PBR script (see my signature).

With my script, you don't need to specify any specific rules for remote access purposes. The mere installation of the script will always route replies from unsolicited traffic in from the WAN (i.e., remote access), back over the WAN, even if the target of that remote access is otherwise bound to the router's OpenVPN client due to other rules. It does this by marking those incoming packets at the connection level, so it always knows from which network interface they originated. IOW, my PBR is *stateful*.

_________________
ddwrt-ovpn-split-basic.sh * ddwrt-ovpn-split-advanced.sh * ddwrt-ovpn-kill-switch.sh * ddwrt-ovpn-watchdog.sh * ddwrt-ovpn-remote-access.sh * ddwrt-ovpn-client-backup.sh * ddwrt-mount-usb-drives.sh * ddwrt-blacklist-domains.sh * ddwrt-wol-port-forward.sh * ddwrt-dns-monitor.sh (NEW!)
eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 8997

PostPosted: Thu Jan 20, 2022 22:31    Post subject: Reply with quote
P.S. A few other options to consider.

1) If you know the public IP(s) from which you'll be accessing the remote device over the WAN (workplace, school, favorite wifi cafe, etc.), you can simply bind those public IPs (or the class C networks to which they belong) to the WAN w/ static routing (i.e., route directives in the Additional Config field of the OpenVPN client).

Code:
route 199.199.199.199 255.255.255.255 net_gateway
route 188.188.188.0 255.255.255.0 net_gateway


Static routing will always take precedence over the default gateway. And it's the default gateway and whether it points to the WAN or VPN that causes the split tunneling (PBR). Of course, if you're truly roaming, then this strategy won't work since you won't know w/ any certainty what those public IPs will be.

2) https://pastebin.com/gnxtZuqg

3) Port forward over the VPN rather than the WAN, assuming your OpenVPN provider supports it (some do, most don't).

_________________
ddwrt-ovpn-split-basic.sh * ddwrt-ovpn-split-advanced.sh * ddwrt-ovpn-kill-switch.sh * ddwrt-ovpn-watchdog.sh * ddwrt-ovpn-remote-access.sh * ddwrt-ovpn-client-backup.sh * ddwrt-mount-usb-drives.sh * ddwrt-blacklist-domains.sh * ddwrt-wol-port-forward.sh * ddwrt-dns-monitor.sh (NEW!)
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 9608
Location: Netherlands

PostPosted: Fri Jan 21, 2022 8:14    Post subject: Reply with quote
Recent builds (currently 48141) support all ip rules e.g. sport.
To route a specific source port.

The Openvpn client setup guide, link in my signature, has a paragraph about that.

But all @eibgrads excellent suggestions of course will also work

_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
a15995
DD-WRT User


Joined: 18 Oct 2016
Posts: 73
Location: Copenhagen, Denmark

PostPosted: Fri Jan 21, 2022 11:27    Post subject: Reply with quote
eibgrad wrote:
P.S. A few other options to consider.

1) If you know the public IP(s) from which you'll be accessing the remote device over the WAN (workplace, school, favorite wifi cafe, etc.), you can simply bind those public IPs (or the class C networks to which they belong) to the WAN w/ static routing (i.e., route directives in the Additional Config field of the OpenVPN client).

Code:
route 199.199.199.199 255.255.255.255 net_gateway
route 188.188.188.0 255.255.255.0 net_gateway


Static routing will always take precedence over the default gateway. And it's the default gateway and whether it points to the WAN or VPN that causes the split tunneling (PBR). Of course, if you're truly roaming, then this strategy won't work since you won't know w/ any certainty what those public IPs will be.

2) https://pastebin.com/gnxtZuqg

3) Port forward over the VPN rather than the WAN, assuming your OpenVPN provider supports it (some do, most don't).


Cool, thanks!

I don't suppose you can use a domain name instead of an IP to get around the dynamic IP issue in your route example?

Thanks,

_________________
/Søren
Netgear Nighthawk X4S (R7800 ver. 1) | Atheros/Qualcomm | IPQ8065 dual-core 1.7 GHz | AC2600 | 512 MB RAM | 128 MB FLASH | 128 KB NVRAM
Firmware: DD-WRT v3.0-r47665 std (11/24/21)
Install guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614

egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 9608
Location: Netherlands

PostPosted: Fri Jan 21, 2022 11:34    Post subject: Reply with quote
Yes you can e.g.:
route ipchicken.com 255.255.255.255 net_gateway

Note domains only support /32 aka 255.255.255.255

If you read the OpenVPN Client setup guide it is all there

_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
a15995
DD-WRT User


Joined: 18 Oct 2016
Posts: 73
Location: Copenhagen, Denmark

PostPosted: Fri Jan 21, 2022 12:19    Post subject: Reply with quote
egc wrote:
Recent builds (currently 48141) support all ip rules e.g. sport.
To route a specific source port.

The Openvpn client setup guide, link in my signature, has a paragraph about that.

But all @eibgrads excellent suggestions of course will also work


Thanks egc, looking into your guide right now.

I tried using sport - is it not supposed to route specific ports from WAN to LAN?

Say I want to reach the device behind VPN hosting FTP - I would use my public IP adress (not VPN IP) and external port number. Port forwarding will take care of the correct local IP and port number, right?

This does not seem to work with r47665 - maybe I need to upgrade to latest build.

Thanks,

_________________
/Søren
Netgear Nighthawk X4S (R7800 ver. 1) | Atheros/Qualcomm | IPQ8065 dual-core 1.7 GHz | AC2600 | 512 MB RAM | 128 MB FLASH | 128 KB NVRAM
Firmware: DD-WRT v3.0-r47665 std (11/24/21)
Install guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614

a15995
DD-WRT User


Joined: 18 Oct 2016
Posts: 73
Location: Copenhagen, Denmark

PostPosted: Fri Jan 21, 2022 12:25    Post subject: Reply with quote
egc wrote:
Yes you can e.g.:
route ipchicken.com 255.255.255.255 net_gateway

Note domains only support /32 aka 255.255.255.255

If you read the OpenVPN Client setup guide it is all there


Read that in the guide but thought it only worked the other way - outbound traffic from behind the router would go through WAN and not VPN to that specific IP/domain...

Will try...

Thanks,

_________________
/Søren
Netgear Nighthawk X4S (R7800 ver. 1) | Atheros/Qualcomm | IPQ8065 dual-core 1.7 GHz | AC2600 | 512 MB RAM | 128 MB FLASH | 128 KB NVRAM
Firmware: DD-WRT v3.0-r47665 std (11/24/21)
Install guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614

egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 9608
Location: Netherlands

PostPosted: Fri Jan 21, 2022 12:51    Post subject: Reply with quote
Regarding the use of sport, you should be able to just add in the PBR field :
sport 21

But you have to choose "Route selected sources via WAN"
You can add more things like ip addresses etc which are also then routed via the WAN, everything else is routed via the VPN.

As queries for the FTP server are coming in via the WAN they also have to go back via the WAN otherwise the firewall will block it.
I have tested it with an OpenVPN server but with an FTP server it is also supposed to work the same.

Of course you can enter the IP address of the FTP server but then everything from this server will go out via the WAN.

But indeed you should upgrade, the latest build as of now is 48141.
I am running that as we speak, a reset should not be necessary, just upgrade.

But otherwise the solutions proposed by @eibgrad are also excellent choices (actually DDWRT VPN's are inspired and guided by his work, if I am lost I ask him for help Smile )

_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
a15995
DD-WRT User


Joined: 18 Oct 2016
Posts: 73
Location: Copenhagen, Denmark

PostPosted: Tue Jan 25, 2022 9:21    Post subject: WG server... Reply with quote
egc wrote:
Regarding the use of sport, you should be able to just add in the PBR field :
sport 21

But you have to choose "Route selected sources via WAN"
You can add more things like ip addresses etc which are also then routed via the WAN, everything else is routed via the VPN.

As queries for the FTP server are coming in via the WAN they also have to go back via the WAN otherwise the firewall will block it.
I have tested it with an OpenVPN server but with an FTP server it is also supposed to work the same.

Of course you can enter the IP address of the FTP server but then everything from this server will go out via the WAN.

But indeed you should upgrade, the latest build as of now is 48141.
I am running that as we speak, a reset should not be necessary, just upgrade.

But otherwise the solutions proposed by @eibgrad are also excellent choices (actually DDWRT VPN's are inspired and guided by his work, if I am lost I ask him for help Smile )


Hey Eric!

I hate to bother you with this but I tried several things with port forwarding and came to the conclusion that I need a VPN server. Better and safer. Port forwarding introduced more problems than it solved.

I followed your Wireguard server guide (v42) but cannot get a handshake with my Android WG client (added with QR code). I try to access the router via afraid.org (DDNS) but have also tried directly (WAN IP).

I have a OVPN running on tun1 and a WG client on oet1. OVPN gave me all sort of trouble (in the end, the problem was a leading hashtag in the PBR window). I tried disabling both tun1 and oet1 but still don't get a handshake on oet2.

Could you point me in a new direction here?

Your guide mentions things to do in the firewall - but since I can get it working on port 51515 (oet1 WG client/piHole) I don't see why it won't work on port 51810. I haven't put anything in my firewall yet.

As far as I can tell, this is not a port forwarding problem since WG is listening on port 51810 on the router itself.

Could this be a problem with my cell phone company blocking certain ports or traffic? The VPN does not work on LAN either...

I tried several DNS servers as well and checked the routing tables according to your troubleshooting guide.

I have enclosed my settings and they should be set as per your guide.

The phone sends data and receives very little after a while. The WG server says "waiting for connection". At some point I got a connection from an unknown IP:port (at which point I suspected the VPN messing up something as you mention in your guide).

Tried upgrading to r48141 but that introduced another problem with deleted static IP entries on reboot...

Any ideas?

Thanks,

_________________
/Søren
Netgear Nighthawk X4S (R7800 ver. 1) | Atheros/Qualcomm | IPQ8065 dual-core 1.7 GHz | AC2600 | 512 MB RAM | 128 MB FLASH | 128 KB NVRAM
Firmware: DD-WRT v3.0-r47665 std (11/24/21)
Install guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614

egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 9608
Location: Netherlands

PostPosted: Tue Jan 25, 2022 16:21    Post subject: Reply with quote
First some tips about the static leases.

The static leases have changed but it could be that a simple refresh of your browser cache (CTRL+F5) will solve that.

That said most of us do not use the static leases box.

You can simply add the static leases in the Additional DNSMasq options like:
dhcp-host=00:08:9B:XX:XX:XX,192.168.0.91,QNAP453,1440m
dhcp-host=00:1B:XX:XX:XX:XX,192.168.0.99,Printer_HL2150,1440m

So that you can copy paste that list and add /sort delete in a text file.

You can retrieve your current leases from /tmp/dnsmasq.conf

Now on to your WG server.

To test disable the WG client tunnel and the OVPN tunnel so that you only have the WG server tunnel running. Make sure you also delete any scripts (e.g kill scripts)

The WG server should have an IP address of 10.4.0.1/24 check that

On first glance the setup looks OK.

You can use any port you want as long as it is not used elsewhere so the other WG tunnel can not use that port or you can also not use a port forward with that port!

51810 is the local listen port, that port is automatically opened on the server, the client must use that same port as endpoint and also as its local listen port (theoretically that is not necessary but if not it could get blocked)

so check that on the client (your phone).

Also check on the client that Keepalive is set to 20 (or 25) and that you use a publicly available DNs server e.g. 8.8.8.8.
It helps if you post the client config file (or you can PM it to me)

Newest version has a more elaborate config file option, to set DDNS etc.

Your MTU 1428 does not look OK, if you are using PPPoE use 1412 (set the same on the client).

As always test from outside with your phone on cellular.

If that does not help I need more troubleshooting information i.e. from CLI (telnet/Putty):
wg
wg showconf oet1
ip route show
iptables -vnL FORWARD | grep oet
iptables -vnL INPUT
iptables -vnL -t nat
iptables -vnL -t raw
nvram show | grep oet
grep -E -i 'oet|wireguard' /var/log/messages

_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
a15995
DD-WRT User


Joined: 18 Oct 2016
Posts: 73
Location: Copenhagen, Denmark

PostPosted: Tue Jan 25, 2022 21:18    Post subject: Reply with quote
Thanks Eric!

Have sent you PB - two in fact.

Regarding static leases - I have my setup in a file already, just find it odd that they are deleted on boot. Refresh does not help - they're all gone except the first entry...

/Søren

_________________
/Søren
Netgear Nighthawk X4S (R7800 ver. 1) | Atheros/Qualcomm | IPQ8065 dual-core 1.7 GHz | AC2600 | 512 MB RAM | 128 MB FLASH | 128 KB NVRAM
Firmware: DD-WRT v3.0-r47665 std (11/24/21)
Install guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614

Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum