Help with issue for external port forwarding

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> General Questions
Author Message
benbrockn
DD-WRT Novice


Joined: 19 May 2017
Posts: 11

PostPosted: Fri May 26, 2017 15:26    Post subject: Help with issue for external port forwarding Reply with quote
I have my setup like this:

System:
Linksys 1200AC
DD-WRT Build 30796





I have a windows box that I can connect using PuTTy, a Linux box using the "ssh user@IP -p ##" command, and also connectbot on android.

Note: I also made sure my LAN listening client (linux) has its sshd_config set to Port "BB" instead of Port 22

When I connect via internal LAN to my 192.x.x.x gateway on my router using the LAN IP & port "BB" of my listening client, I can SSH into my box just fine. When I try to connect via my WAN IP & port "AA" the router does not redirect, it errors out saying "No route to host" on any device that I use (wired windows/linux or wireless android)

I tried to troubleshoot by just making my Port Forwarding scheme from "BB" to "BB" but even that gives the same error.



I have iptables FORWARD rules set to DROP packets from certain ports, but none of those rules include these ports (AA & BB) that I am using.

I've also tried to experiment with the following settings on/off and none have worked either:

    Services->SSHd
    Security->Filter WAN NAT Redirection
    Security->Limit SSH Access


I'm out of ideas... Anyone have any experience with this?

Thanks
Sponsor
benbrockn
DD-WRT Novice


Joined: 19 May 2017
Posts: 11

PostPosted: Thu Jun 01, 2017 22:00    Post subject: Reply with quote
Can anyone help with this?
mrjcd
DD-WRT Guru


Joined: 31 Jan 2015
Posts: 2428
Location: Texas

PostPosted: Thu Jun 01, 2017 22:57    Post subject: Reply with quote
Just use 'Port Range Forwarding'
e.g. If client IP is 192.168.1.67 and has SSH open on port 54321

start = 54321 > end = 54321 > Protocol = TCP > IP Address = 192.168.1.67 > check Enable

of course you will have to hit it with that port -
ssh root@mydomainname.com -p 54321
ssh root@yourWAN IP -p 54321
benbrockn
DD-WRT Novice


Joined: 19 May 2017
Posts: 11

PostPosted: Thu Jun 01, 2017 23:04    Post subject: Reply with quote
mrjcd wrote:
Just use 'Port Range Forwarding'
e.g. If client IP is 192.168.1.67 and has SSH open on port 54321

start = 54321 > end = 54321 > Protocol = TCP > IP Address = 192.168.1.67 > check Enable

of course you will have to hit it with that port -
ssh root@mydomainname.com -p 54321
ssh root@yourWAN IP -p 54321


Thanks mrjcd, I'll try this out and see if that works.
benbrockn
DD-WRT Novice


Joined: 19 May 2017
Posts: 11

PostPosted: Fri Jun 02, 2017 0:45    Post subject: Reply with quote
mrjcd wrote:
Just use 'Port Range Forwarding'
e.g. If client IP is 192.168.1.67 and has SSH open on port 54321

start = 54321 > end = 54321 > Protocol = TCP > IP Address = 192.168.1.67 > check Enable

of course you will have to hit it with that port -
ssh root@mydomainname.com -p 54321
ssh root@yourWAN IP -p 54321


port range forwarding works less than regular port forwarding. Regular PF at least allows internal LAN forwarding, PRF does not erroring out with "connection refused".
benbrockn
DD-WRT Novice


Joined: 19 May 2017
Posts: 11

PostPosted: Fri Jun 02, 2017 0:54    Post subject: Reply with quote
Random internet guy on Youtube (here = https://www.youtube.com/watch?v=vGMKZWkFEmk) says to enter this command under Administration -> Commands -> Firewall to fix this issue. It was for an older build but others said that it works more recently to allow WAN to LAN port forwarding. Can anyone explain what this command does before I try it?

Code:
insmod ipt_mark
insmod xt_mark
iptables -t mangle -A PREROUTING -i ! `get_wanface` -d `nvram get wan_ipaddr` -j MARK --set-mark 0xd001
iptables -t nat -A POSTROUTING -m mark --mark 0xd001 -j MASQUERADE


EDIT: Random internet guy got it from official DD-WRT forums (here = http://www.dd-wrt.com/phpBB2/viewtopic.php?t=89353), but I still don't know exactly how it works...
benbrockn
DD-WRT Novice


Joined: 19 May 2017
Posts: 11

PostPosted: Fri Jun 02, 2017 2:36    Post subject: Reply with quote
I finally figured it out, and it's not that random guy's code, it's so dumb and simple...

I noticed earlier that the DD-WRT software does not like "all" or "both" commands when it comes to TCP & UDP ports.
You literally have to go into NAT/QoS -> Port Forwarding and do each port for TCP & UDP, NOT using the "both" selection. Just like this:

Code:
App_Name, "TCP", port#1, LAN_IP, same_port#1, "Enable"
App_Name, "UDP", port#1, LAN_IP, same_port#1, "Enable"

App_Name, "TCP", port#2, LAN_IP, same_port#2, "Enable"
App_Name, "UDP", port#2, LAN_IP, same_port#2, "Enable"


Hope this works for anyone else (and keeps working for me!)

- Ben
tarahenergy
DD-WRT Novice


Joined: 14 May 2016
Posts: 1

PostPosted: Wed Jun 14, 2017 15:52    Post subject: Reply with quote
Thanks for sharing
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> General Questions All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum