What's new
By:

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

Port forwarding not working in RT-AC66U

D

Dimman Ramone

Occasional Visitor
Hi everyone.

Not totally sure that I'm posting in the right section of the forum, hopefully I do.
I'm wondering if anyone else has problems with port forwarding in the two latest Asuswrt-Merlin.
My port forwarding was working fine until I update to 380.61 and then to 380.62.
I did reboot my router and I removed and added the rules again but it doesn't seem to help.

Any ideas, anyone else that has the same problem?

/dimmanramone
 
I was thinking of downgrading to the version that the port forwarding was working.
I noticed also that my WAN IP is not the correct in the GUI, anyone else seeing that?

@RMerlin Any ideas on the WAN IP and the port forwarding issue?

Should be safe to downgrade right?
 
Not RMerlin, but check your nvram usage on the Tools>Sysinfo page. Port forwarding not working is one of the early signs of it being too full. You need a minimum of about 5000 bytes free for the router to work properly.
 
john9527 said:
Not RMerlin, but check your nvram usage on the Tools>Sysinfo page. Port forwarding not working is one of the early signs of it being too full. You need a minimum of about 5000 bytes free for the router to work properly.
Click to expand...

@john9527 Just check and it seems 12000 to be available.

NVRAM usage 53064 / 65536 bytes
 
Dimman Ramone said:
Just check and it seems 12000 to be available.

NVRAM usage 53064 / 65536 bytes
Click to expand...

OK...with that out of he way, next thing to check is that the NAT loopback type is set to ASUS and not Merlin (Merlin loopback can fight with some other options on the MIPS based routers)
 
How are you testing your port forwards?
 
@john9527 I was on Merlin and change it to Asus, but it didn't help.

@RMerlin It is port forwards that I was using before the update without any problems. I tested with my work PC and mobile in wired, wireless and 4g network.

The ports forwards are used to ssh in a RPi and for a VPN Server on my NAS.
 
OK....more data....
telnet/ssh to the router and post the output of

iptables -t nat -nvL
 
Here's the output

Code: 
Chain PREROUTING (policy ACCEPT 9041 packets, 913K bytes)
pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:1194
   67  3698 VSERVER    all  --  *      *       0.0.0.0/0            WAN - IP

Chain POSTROUTING (policy ACCEPT 882 packets, 76321 bytes)
pkts bytes target     prot opt in     out     source               destination
3989  601K MASQUERADE  all  --  *      eth0   !WAN - IP        0.0.0.0/0
2396  124K MASQUERADE  all  --  *      br0     192.168.1.0/24       192.168.1.0/24

Chain OUTPUT (policy ACCEPT 932 packets, 96460 bytes)
pkts bytes target     prot opt in     out     source               destination

Chain DNSFILTER (0 references)
pkts bytes target     prot opt in     out     source               destination

Chain LOCALSRV (0 references)
pkts bytes target     prot opt in     out     source               destination

Chain PCREDIRECT (0 references)
pkts bytes target     prot opt in     out     source               destination

Chain PUPNP (0 references)
pkts bytes target     prot opt in     out     source               destination
    0     0 MASQUERADE  tcp  --  *      *       192.168.1.21         0.0.0.0/0           tcp spt:32400 masq ports: 26712

Chain VSERVER (1 references)
pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:53 to:192.168.1.51:53
    0     0 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:123 to:192.168.1.51:123
    0     0 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpts:1024:1036 to:192.168.1.51
    0     0 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpts:3478:3479 to:192.168.1.51
    0     0 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpts:5060:5061 to:192.168.1.51
    0     0 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpts:10000:10007 to:192.168.1.51
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:666 to:192.168.1.21:1194
    0     0 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:666 to:192.168.1.21:1194
   67  3698 VUPNP      all  --  *      *       0.0.0.0/0            0.0.0.0/0  
   59  2656 TRIGGER    all  --  *      *       0.0.0.0/0            0.0.0.0/0           TRIGGER type:dnat match:0 relate:0

Chain VUPNP (1 references)
pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:5675 to:192.168.1.32:5675
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:5675 to:192.168.1.32:5675
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:26712 to:192.168.1.21:32400
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:6889 to:192.168.1.21:6889
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4433 to:192.168.1.21:4433
    7   911 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:6889 to:192.168.1.21:6889
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:51727 to:192.168.1.21:51727
    0     0 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:51727 to:192.168.1.21:51727
 
Hmmm....can you double check that you captured all of the output? (You are missing the PREROUTING and POSTROUTING chains)

If you did capture it all, please post the output of

cat /tmp/nat_rules_xxxx_xxxx

where xxxx is an interface name....like eth0 or ppp0 (do an ls /tmp to find what it is exactly)
 
I did post everything from the output prerouting and postrouting is the one in the first code block. Second code block is my cat output.

Code: 
Chain PREROUTING (policy ACCEPT 9041 packets, 913K bytes)
pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:1194
   67  3698 VSERVER    all  --  *      *       0.0.0.0/0            WAN - IP

Chain POSTROUTING (policy ACCEPT 882 packets, 76321 bytes)
pkts bytes target     prot opt in     out     source               destination
3989  601K MASQUERADE  all  --  *      eth0   !WAN - IP        0.0.0.0/0 
2396  124K MASQUERADE  all  --  *      br0     192.168.1.0/24       192.168.1.0/24

Code: 
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:VSERVER - [0:0]
:LOCALSRV - [0:0]
:VUPNP - [0:0]
:PUPNP - [0:0]
:DNSFILTER - [0:0]
:PCREDIRECT - [0:0]
-A PREROUTING -d WAN-IP -j VSERVER
-A VSERVER -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.1.51:53
-A VSERVER -p udp -m udp --dport 123 -j DNAT --to-destination 192.168.1.51:123
-A VSERVER -p udp -m udp --dport 1024:1036 -j DNAT --to 192.168.1.51
-A VSERVER -p udp -m udp --dport 3478:3479 -j DNAT --to 192.168.1.51
-A VSERVER -p udp -m udp --dport 5060:5061 -j DNAT --to 192.168.1.51
-A VSERVER -p udp -m udp --dport 10000:10007 -j DNAT --to 192.168.1.51
-A VSERVER -p tcp -m tcp --dport 666 -j DNAT --to-destination 192.168.1.21:1194
-A VSERVER -p udp -m udp --dport 666 -j DNAT --to-destination 192.168.1.21:1194
-A VSERVER -j VUPNP
-A VSERVER -j TRIGGER --trigger-type dnat
-A POSTROUTING  -o eth0 ! -s WAN-IP -j MASQUERADE
-A POSTROUTING  -o br0 -s 192.168.1.0/24 -d 192.168.1.0/24 -j MASQUERADE
COMMIT
 
john9527 said:
Hmmm....can you double check that you captured all of the output? (You are missing the PREROUTING and POSTROUTING chains)
Click to expand...
It's there, at the top. Did you scroll down past it?

I don't see any rules for SSH. Perhaps we need a screen shot of the port forwarding page in the routers GUI?
 
ColinTaylor said:
It's there, at the top. Did you scroll down past it?
Click to expand...
Duh...my fault in cut/paste so I could easily look at it.....

But, I think it shows the problem (also in the cat output)
Code: 
Chain PREROUTING (policy ACCEPT 9041 packets, 913K bytes)
pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:1194
   67  3698 VSERVER    all  --  *      *       0.0.0.0/0            WAN - IP

Chain POSTROUTING (policy ACCEPT 882 packets, 76321 bytes)
pkts bytes target     prot opt in     out     source               destination
3989  601K MASQUERADE  all  --  *      eth0   !WAN - IP        0.0.0.0/0
2396  124K MASQUERADE  all  --  *      br0     192.168.1.0/24       192.168.1.0/24

Looks like there is a code error resolving a variable 'WAN-IP' (or 'WAN - IP' with embedded spaces)...Either I or @RMerlin will need to dig into the code.
 
@ColinTaylor Yes I don't have the SSH Rules anymore. When I was trying fixing it I just removed them after a while.

upload_2016-9-28_21-49-14.png
 
@john9527 I just replaced my ip with WAN-IP :)

But as I said in a previous post it seems the wan-ip to be wrong. For example I'm surfing with 193.213.43.1 but in the GUI says 100.5.6.2
 
Dimman Ramone said:
@john9527 I just replaced my ip with WAN-IP :)

But as I said in a previous post it seems the wan-ip to be wrong. For example I'm surfing with 193.213.43.1 but in the GUI says 100.5.6.2
Click to expand...
Ahh....makes sense :)

Are you running in a double NAT setup? Recently change ISPs or any ISP hardware?

EDIT: I see you are also running a VPN server. Try turning that off just to eliminate a variable.
 
@john9527 No doule NAT, no new ISP or hardware, just new IP when I restarted but I shouldn't have any problems with port forwarding because of that.

With or without the VPN still doesn't work.
 
I was thinking that it sounds like carrier-grade NAT and then I read...

http://www.sweclockers.com/forum/trad/1443086-itux-bredband2-och-cgn

Itux Bredband2 och CGN
Tänkte bara informera att idag har B2 slagit på CGN för mig som sitter på Itux nät i Gbg.
Märkte det dessvärre efter kl 19 när deras kundtjänst stängt.
Någon annan som har Itux och kan ge er syn på den ISP ni har?

Edit: hittade svar

"Vi håller på att lägga om våra nät till privata IP-adresser. Det här görs via CG-NAT och förändringen införs i väntan på IPv6. Utrullningen kommer ske efterhand och övervakas noggrant. En icke-publik IP-adress påverkar inte vanligt surfande.

Skulle du trots det ha ett genuint behov av en publik IP-adress kan du kontakta vår kundtjänst så ordnar vi det åt dig kostnadsfritt."
Click to expand...
 
You must log in or register to reply here.

Similar threads

adri
Firewall, Port Forwarding, and DoS Question
Replies
8
Views
686
ColinTaylor
C
brentil
RT-AX88U Pro Port Forwarding not working
Replies
1
Views
438
brentil
brentil
A
DSL-AX82U HTTP/HTTPS Port Forwarding
Replies
7
Views
483
AX82U-user-2k
A
M
From Public IP to Private IP (issues with Port Forwarding, Skynet)
Replies
5
Views
256
manol68
M
P
Port Forwarding stops working after adding addional AiMesh node
Replies
1
Views
768
bbunge
bbunge
Similar threads
Thread starter Title Forum Replies Date
Philip Bondi HOWTO: Bell Fibe with Private Cloud; port forwarding; email, web & Plex servers running! Asuswrt-Merlin 1
M From Public IP to Private IP (issues with Port Forwarding, Skynet) Asuswrt-Merlin 5
adri Firewall, Port Forwarding, and DoS Question Asuswrt-Merlin 8
C Can port forwarding do failover to an alternative server? Asuswrt-Merlin 2
A DSL-AX82U HTTP/HTTPS Port Forwarding Asuswrt-Merlin 7
waldo43 Solved Port Forwarding Issue Asuswrt-Merlin 6
docta_v Is there any VPN provider with easy setup for port forwarding on Merlin? Asuswrt-Merlin 5
GShlomi Sharing my DualWan with port forwarding and DDNS experience Asuswrt-Merlin 0
GShlomi Two WANs but not dual-WAN, with port-forwarding Asuswrt-Merlin 7
K AX3000v2 cant find lan port ids in cli Asuswrt-Merlin 2

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 472 (members: 17, guests: 455)
Back
Top