[Help needed] Reachhing a router behind another router through DDNS and port forwarding.

[mozbius]

Hi everyone, I need a little help with a mix of WAN + LAN + NAT situation…

So I have Router A, B & C.

(A) is Internet facing

(B) is setup on a different subnet to offer VPN coverage by using the router’s VPN client

(C) is configured as an Access Point to offer expanded wifi coverage.



With the help of a DDNS I can connect to Router (A) at:

https://xxx.xxxddns.com:8400

or alternatively at:

https://10.10.25.05:8400

EDITED ADDED NOTE: That 10.x.x.x address is completely fictious and shouldn't be read into as a valid IP. It is provided just as a placemarker of somekind to the description of my inquiry. My actual wan is not part of the reserved adress space.



Now I am trying to also connect remotely through DDNS to Router (B) & (C).



So I have tried to setup port forwarding to connect to Router (B) (and similarly but on a different port to try to connect to C) by using port 8460 (or https://10.10.25.05:8460) as follow:



Tried in Router (A):

ExtPort:8460 IntPort:Blank IntIP:192.168.3.1
Tried in Router (A):

ExtPort:8460 IntPort:Blank IntIP:192.168.2.20



Note:
I am able to connect to:

192.168.2.1, 192.168.2.5, 192.168.3.1 irrespective of which router I am connected to. This is so to allow any device to connect to all devices behind Router (A). As inferred above I did unsuccessfully try similar settings to port forward to Router (C).
So my question:

Is it possible to connect to a router behind another router from the wan and if so how?

 

[ColinTaylor]

Is "10.10.25.5" just a fictitious address that you're using as an example? Because that is not a publicly accessible address.

 

[cptnoblivious]

@mozbius just to add to what ColinTaylor said, here's info on the reserved address spaces:

Reserved IP addresses - Wikipedia

en.wikipedia.org

 

[mozbius]

Is "10.10.25.5" just a fictitious address that you're using as an example? Because that is not a publicly accessible address.

yes it is fictious.

 

[mozbius]

@mozbius just to add to what ColinTaylor said, here's info on the reserved address spaces:

Reserved IP addresses - Wikipedia

en.wikipedia.org

I have given a made up public IP ... This is not my actual WAN IP for privacy/security reasons...

 

[Tech9]

Router B - can it run VPN Server?

There may be a better way than your current Web access from WAN open on Router A.

 

[mozbius]

Router B - can it run VPN Server?

There may be a better way than your current Web access from WAN open on Router A.

Hi, yes Router B (Asus AC86u) can indeed run a VPN Server but it is configured as a client to use PIA (Private Internet Access).

Hmmm so you are thinking of having router B setup also as a VPN server that could be reached from WAN? But then it is using PIA to anonymize all the devices behind it... Wouldn't that interfere?

 

[Tech9]

Router A - disable Web Access from WAN, place Router B WAN IP in DMZ
Router B - run OpenVPN Server on non standard port, exclude router's own IP from VPN Client routing

From outside of your network - connect to the VPN Server on Router B by your DDNS + port. Once connected you are on your LAN. Now you have access to all your routers' Web GUI by calling them by IP address. This is more secure VPN access to your network and does what you need.

 

[mozbius]

Wow!!! Thank you for the detailed instructions!!! I will give this a go. Much appreciated!!