Can’t forward new ports (just old ones)

[pjd50]

Hi all. I’ve searched multiple threads on here and Google, but remain stumped. Short of completely factory resetting the router to see if that fixes things, I’m dealing with the following.

1. Fiber internet (consolidated) which gives an automatically assigned IP address (not PPOE that needs credentials). They don’t block any ports and don’t use CGNAT, as far as I can tell. I have checked that the WAN on showing on the ASUS dashboard is the same as “whatismyipaddress.com” and is in a public range, not private.

2. RT-AC68U (router) in wired backhaul to another RT-AC68U (AIMesh node), both on latest Merlin firmware (386.13).

I have set up port forwarding in the past when I intially set up my router and the week after. Those ports remain open/forwarded (the app is working as intended, and online scanners for my WAN say “success, port is open).

The last two days, I’ve been trying to configure a new app and forward a new port. It is showing up in the system log as forwarded, but the app doesn’t work and neither does the online scanner say the port is open.

Not using QoS, AIprotection/TrendMicro, etc. Firewall is off.

Read a bunch of threads (someone did mention to try adding 0.0.0.0/0 in the Source IP field) which I haven’t tried yet, as I’m dubious it will fix anything (others reported no results).

There was a thread (which I now can’t find) saying there was some inherent bug to the ASUS firmware that Merlin software can’t fix - the recommendation from Merlin was to downgrade to stock firmware and leave a “ticket” for the ASUS team so they’d have pressure to fix it.

That seems like a few years ago, so hoping it’s fixed now?

Just so strange that SOME ports are working (again, ones that were opened a few weeks ago when I initially set up my router after doing a factory reset and fresh install)… but NOT new ones that I’ve been adding the last day or two.

 

[eibgrad]

The best way to know what's actually happening internally (and whether traffic is even reaching the router) is to dump the relevant data structures using ssh.

iptables -t nat -vnL PREROUTING
iptables -t nat -vnL GAME_VSERVER
iptables -t nat -vnL VSERVER
iptables -vnL FORWARD

Note, it's ok to mask your public IP, just do so consistently.

 

[ColinTaylor]

Firewall is off.

Firewall should be on.

What port and protocol are you trying to forward?

 

[pjd50]

Thanks for the replies, guys. While I guess it would have been a productive exercise to troubleshoot and see if there was a bug ... I did a HARD reset on the router, got everything clean / fresh install ... and now the ports are forwarding correctly... I tried to avoid it ... but it helped!

 

[ColinTaylor]

Glad to hear you got it working. But to reiterate my previous point, you should not turn off the router's firewall.