[a15995]

Hello!

Not sure if this belongs under "advanced" but here goes.

I have trouble accessing an FTP server from the WAN side of my router. Accessing the same server locally is no problem.

I have the following port forwarding rule set up:

[a15995]

Hmm, all that writing made me actually think.

The device is also an OpenVPN client (policy based routing) which explains why it does not react to the WAN request.

The problem remains though (it just got advanced).

How do I route traffic from my public IP address to this VPN client internally?

Thanks,

[eibgrad]

Given FTP is completely insecure (everything is in the clear, data and username/password), you should never expose it directly to the WAN anyway. You should be using a VPN (e.g., OpenVPN or WireGuard).

What I'm not quite sure about is whether the target device is actually hosting the OpenVPN client itself and using PBR there, or the OpenVPN client is on the router, and is being routed over the VPN due to PBR on the router. Your description was a bit ambiguous (at least to my eyes).

[a15995]

[eibgrad]

I believe @egc updated PBR in the OpenVPN client to allow port-based support, rather than just source IP. But I haven't used it myself. Check the stickies in this forum for latest OpenVPN documents by @egc.

The other option is to use my own advanced PBR script (see my signature).

With my script, you don't need to specify any specific rules for remote access purposes. The mere installation of the script will always route replies from unsolicited traffic in from the WAN (i.e., remote access), back over the WAN, even if the target of that remote access is otherwise bound to the router's OpenVPN client due to other rules. It does this by marking those incoming packets at the connection level, so it always knows from which network interface they originated. IOW, my PBR is *stateful*.

[eibgrad]

P.S. A few other options to consider.

1) If you know the public IP(s) from which you'll be accessing the remote device over the WAN (workplace, school, favorite wifi cafe, etc.), you can simply bind those public IPs (or the class C networks to which they belong) to the WAN w/ static routing (i.e., route directives in the Additional Config field of the OpenVPN client).

[egc]

Recent builds (currently 48141) support all ip rules e.g. sport.
To route a specific source port.

The Openvpn client setup guide, link in my signature, has a paragraph about that.

But all @eibgrads excellent suggestions of course will also work

[a15995]

[egc]

Yes you can e.g.:
route ipchicken.com 255.255.255.255 net_gateway

Note domains only support /32 aka 255.255.255.255

If you read the OpenVPN Client setup guide it is all there

[a15995]

[a15995]

[egc]

Regarding the use of sport, you should be able to just add in the PBR field :
sport 21

But you have to choose "Route selected sources via WAN"
You can add more things like ip addresses etc which are also then routed via the WAN, everything else is routed via the VPN.

As queries for the FTP server are coming in via the WAN they also have to go back via the WAN otherwise the firewall will block it.
I have tested it with an OpenVPN server but with an FTP server it is also supposed to work the same.

Of course you can enter the IP address of the FTP server but then everything from this server will go out via the WAN.

But indeed you should upgrade, the latest build as of now is 48141.
I am running that as we speak, a reset should not be necessary, just upgrade.

But otherwise the solutions proposed by @eibgrad are also excellent choices (actually DDWRT VPN's are inspired and guided by his work, if I am lost I ask him for help )

[a15995]

[egc]

First some tips about the static leases.

The static leases have changed but it could be that a simple refresh of your browser cache (CTRL+F5) will solve that.

That said most of us do not use the static leases box.

You can simply add the static leases in the Additional DNSMasq options like:
dhcp-host=00:08:9B:XX:XX:XX,192.168.0.91,QNAP453,1440m
dhcp-host=00:1B:XX:XX:XX:XX,192.168.0.99,Printer_HL2150,1440m

So that you can copy paste that list and add /sort delete in a text file.

You can retrieve your current leases from /tmp/dnsmasq.conf

Now on to your WG server.

To test disable the WG client tunnel and the OVPN tunnel so that you only have the WG server tunnel running. Make sure you also delete any scripts (e.g kill scripts)

The WG server should have an IP address of 10.4.0.1/24 check that

On first glance the setup looks OK.

You can use any port you want as long as it is not used elsewhere so the other WG tunnel can not use that port or you can also not use a port forward with that port!

51810 is the local listen port, that port is automatically opened on the server, the client must use that same port as endpoint and also as its local listen port (theoretically that is not necessary but if not it could get blocked)

so check that on the client (your phone).

Also check on the client that Keepalive is set to 20 (or 25) and that you use a publicly available DNs server e.g. 8.8.8.8.
It helps if you post the client config file (or you can PM it to me)

Newest version has a more elaborate config file option, to set DDNS etc.

Your MTU 1428 does not look OK, if you are using PPPoE use 1412 (set the same on the client).

As always test from outside with your phone on cellular.

If that does not help I need more troubleshooting information i.e. from CLI (telnet/Putty):
wg
wg showconf oet1
ip route show
iptables -vnL FORWARD | grep oet
iptables -vnL INPUT
iptables -vnL -t nat
iptables -vnL -t raw
nvram show | grep oet
grep -E -i 'oet|wireguard' /var/log/messages

[a15995]

Thanks Eric!

Have sent you PB - two in fact.

Regarding static leases - I have my setup in a file already, just find it odd that they are deleted on boot. Refresh does not help - they're all gone except the first entry...

/Søren