Port forward through VPN

[sevenz]

I did search on "error 110", "port forward", and "Connection Timed Out" but nothing matches my problem. I'm not sure whether to post on AirVPN or this forum but I'll just post on both.

Little background on my network. I use MerlinWRT (Asus Router) plugged after some ZTE router (the one ISP gives).

ISP gives me private IP, which in no way I can open any port, contacted them and I have to change to business plan for me to get a public IP. I have dealt with port forwarding when I signed up with AirVPN, everything worked fine but now I hit the wall for some reason.

I`m running a server on Unraid and made 3 dockers for Nextcloud, Plex and Transmission.

Until a few days ago everything is working fine, Nextcloud can be accessed from port 61466 (local 443), I can stream Plex (albeit slow, but good enough to watch from work) with port 61477 (local 32400), and transmission with port 9958 (local 9958).

Now all that is working is port 9958 for torrent (green circle), Nextcloud and Plex get Error 110: Connection Timed Out when I press the check button (Dark grey circle). I haven't changed my prerouting/port forwarding much but I will list it below.

#!/bin/sh
touch /tmp/000nat-start
iptables -I FORWARD -i br0 -o tun11 -j ACCEPT
iptables -I FORWARD -i tun11 -o br0 -j ACCEPT
iptables -I FORWARD -i br0 -o vlan1 -j DROP
iptables -I INPUT -i tun11 -j REJECT
iptables -t nat -A POSTROUTING -o tun11 -j MASQUERADE

iptables -I FORWARD -i tun11 -p udp -d 192.168.2.140 --match multiport --dports 9958,61466,61477 -j ACCEPT
iptables -I FORWARD -i tun11 -p tcp -d 192.168.2.140 --match multiport --dports 9958,61466,61477 -j ACCEPT

iptables -t nat -I PREROUTING -i tun11 -p tcp --match multiport --dports 9958,61466,61477 -j DNAT --to-destination 192.168.2.140
iptables -t nat -I PREROUTING -i tun11 -p udp --match multiport --dports 9958,61466,61477 -j DNAT --to-destination 192.168.2.140

This IP table from some other thread in Air and this forum helped me in the past. So I'm wondering why now I get error 110: Connection Timed Out. Everything was working well until a few days ago.

I checked that all 3 programs are running properly, I can access all three with local IP 192.168.2.140.

Although in the Plex browser, I get

Your server is signed in to Plex, but is not reachable from outside your network. Learn more
Tip: It looks like your server may be connected to the internet through multiple routers or other network devices. Try connecting it directly to your primary device, or visit our support site for more information about troubleshooting this "Double-NAT" scenario. Learn more

So yeah, I'm wondering if I'm actually under Double-NAT issue. But if I do, I shouldn't be able to connect to Transmission from outside(using VPNIP:9958). 2 ports (61466 & 61477) don't work, 1 port (9958) works.
EDIT: port 9958 sometimes work, sometimes don't.

If my server is connected to VPN, my route should be like SERVER > VPN > INTERNET right?

Anyway, I tried to google and tried various methods but to no avail.

Any help would greatly appreciated. Thanks!

I tried restore to defaults and format the jffs partition at next boot. Still nothing.

EDIT: I see this in my noip docker log.

Using configuration from /config/no-ip2.generated.conf
Last IP Address set 185.200.x.x
Account sevenzk
configured for:
host blabla.ddns.net
Updating every 30 minutes via /dev/eth0 with NAT enabled.
[May 18 07:32:55] /config/no-ip2.generated.conf is older than /config/noip.conf, so not regenerating it
[May 18 07:32:55] Launching the noip2 daemon
[May 18 07:33:00] Current status
1 noip2-x86_64 process active.

I wonder if this creates another NAT?

And I'm attaching the syslog.txt from jffs folder. (somehow I cant upload .txt file)

https://drive.google.com/open?id=19v1R8KprFr08WjGHkWnR143F03g5dLtuD2c1FR_a2W8

More edit: I setup plex on my PC with port 45543, and qbittorrent with port 41588.

Plex still says I'm on a double NAT, and qbittorrent keeps crashing after connection online (turns green).

So safe to say I'm on double NAT? What is the fix for this?

 

[sevenz]

Fixed this after 2 days of restless nights.

I will post for the sake of some others if they ever had trouble with this.

Up until several days ago. I had working port forwards on my network. Originally I had port 61477 with local port 32400 (for plex) and 61466 with local port 443 (for owncloud).

I used merlinwrt RT-87N with setting IP tables as follows.

Spoiler

iptables -I FORWARD -i tun12 -p udp -d 192.168.2.140 --match multiport --dports 61466,61477 -j ACCEPT
iptables -I FORWARD -i tun12 -p tcp -d 192.168.2.140 --match multiport --dports 61466,61477 -j ACCEPT

iptables -t nat -I PREROUTING -i tun12 -p tcp --match multiport --dports 61466,61477 -j DNAT --to-destination 192.168.2.140
iptables -t nat -I PREROUTING -i tun12 -p udp --match multiport --dports 61466,61477 -j DNAT --to-destination 192.168.2.140

Suddenly it breaks on me with no knowledge of what happens. So I tinkered with the router, IPtables, trials and errors, only to figure out that I need to forward it properly.

End result, this is what I did

AirVPN Port and Local port I made the same, 61466 and 61466, 61477 and 61477.

Changed the IPtables in for the router manually via ssh with this code

Spoiler

iptables -I FORWARD -i tun12 -p udp -d 192.168.2.140 --dport 9958 -j ACCEPT
iptables -I FORWARD -i tun12 -p tcp -d 192.168.2.140 --dport 9958 -j ACCEPT
iptables -t nat -I PREROUTING -i tun12 -p tcp --dport 9958 -j DNAT --to-destination 192.168.2.140
iptables -t nat -I PREROUTING -i tun12 -p udp --dport 9958 -j DNAT --to-destination 192.168.2.140

iptables -I FORWARD -i tun12 -p udp -d 192.168.2.140 --dport 61477 -j ACCEPT
iptables -I FORWARD -i tun12 -p tcp -d 192.168.2.140 --dport 61477 -j ACCEPT
iptables -t nat -I PREROUTING -i tun12 -p tcp --dport 61477 -j DNAT --to-destination 192.168.2.140:32400
iptables -t nat -I PREROUTING -i tun12 -p udp --dport 61477 -j DNAT --to-destination 192.168.2.140:32400

iptables -I FORWARD -i tun12 -p udp -d 192.168.2.140 --dport 61466 -j ACCEPT
iptables -I FORWARD -i tun12 -p tcp -d 192.168.2.140 --dport 61466 -j ACCEPT
iptables -t nat -I PREROUTING -i tun12 -p tcp --dport 61466 -j DNAT --to-destination 192.168.2.140:443
iptables -t nat -I PREROUTING -i tun12 -p udp --dport 61466 -j DNAT --to-destination 192.168.2.140:443

On the prerouting IPtables I added port number which is to point to local port, so it becomes like this.



Anyway, I don't know if this is correct, but this works for me. All ports opened and I can access plex and nextcloud mainly from work.

Hopefully this will help some others who own Asus router and port forwarding AirVPN.

Anyway, jffs nat-start loaded but doesn't put iptables for me for some reason. Anyway I have to live with this for the moment.

Regards