Problem accessing router remotely + DDNS (CNAT modem)

[fearz]

Hello everyone,

Got a problem accessing the router remotely, hence losing all port forwarding & GUI access, here is my configuration, Asus router configured to be accessed from WAN.

I got a modem configured with a fixed WAN/Public IP 197.134.x.x & a LAN cable connected to it on LAN port 1 to the Asus AC5300 router to the WAN port.

The Asus router has a private internal WAN IP of 192.168.x.x - DDNS configured x.asuscomm.com as that IP (No option to choose Internal or External).

Modem has no option to use Bridge mode & upon checking, NAT is configured (Address-Restricted Cone NAT (NAT2)).

The router is shown on the modem as a client device with IP 192.168.x.x - I tried adding it to DMZ with no avail, I tried port forwarding to the router GUI remote port, still no success.

Anyone has any suggestions?

 

[ColinTaylor]

OK, so your "modem" is actually a wireless router that also has a built-in modem.

The Asus router has a private internal WAN IP of 192.168.x.x - DDNS configured x.asuscomm.com as that IP (No option to choose Internal or External).

If your DDNS name is assigned to the 192.168.x.x address then you can't use that name to access your router. Put the 192.168.x.x address in the "modem's" DMZ and access your router using the 197.134.x.x IP address, e.g. https://197.134.x.x:8443. You must test this from the internet, it will not work from inside your LAN.

Make sure you don't have any VPN clients running on the router as that may cause problems with remote access.

 

[fearz]

OK, so your "modem" is actually a wireless router that also has a built-in modem.

If your DDNS name is assigned to the 192.168.x.x address then you can't use that name to access your router. Put the 192.168.x.x address in the "modem's" DMZ and access your router using the 197.134.x.x IP address, e.g. https://197.134.x.x:8443

Make sure you don't have any VPN clients running on the router as that may cause problems with remote access.

No VPN, added it to DMZ, still no access via IP.

 

[ColinTaylor]

No VPN, added it to DMZ, still no access via IP.

Are you using the default port of 8443? If so, try changing it to something like 21543 and seeing if that makes a difference.

It's possible that your ISP blocks all incoming connections. Does the modem have a remote access option? If so you could try enabling that. If that doesn't work then I'd say it's being blocked by the ISP.

 

[fearz]

Are you using the default port of 8443? If so, try changing it to something like 21543 and seeing if that makes a difference.

It's possible that your ISP blocks all incoming connections. Does the modem have a remote access option? If so you could try enabling that. If it still doesn't work then I'd say it's being blocked by the ISP.

I'm using a 5xxxx port, remote access to modem GUI is enabled & working on port 443 using WAN IP 197.x.x.x - Modems firewall & Anti-dos disabled.

I have an option to choose between in NAT Type: NAPT & CNAT - configured by the ISP was CNAT, just tried changing to NAPT, still doesn't work.

Is there any configuration I can change in the modem related to IP Address Mapping?

 

[ColinTaylor]

Is there any configuration I can change in the modem related to IP Address Mapping?

Sorry, I don't know anything about your ISP modem.

NAPT would normally only apply to outgoing connections, not incoming. I don't know what CNAT is, I've never heard of it.

Can you confirm that you are testing the connectivity from the internet, it won't work if you test it from your LAN?

 

[fearz]

Tested from both, In & Out.

 

[ColinTaylor]

The only thing I can find that mentions CNAT is this, but it may not be the same thing as your modem has.

cPacket Expands Service Provider Offering with cNAT IP Address Resolution Compliance

cPacket networks extended its service provider portfolio with cNAT, a service that provides IP address resolution for Service Providers.

www.cpacket.com

This is something that you normally wouldn't want enabled. However, disabling it would likely change your WAN IP address to a CGNAT address. Try changing your modem from CNAT to NAPT and checking your WAN IP address at https://whatismyipaddress.com/. Is this the same as before? Does this still match the WAN IP shown in your modem's GUI, or has that changed to a 100.x.y.z address?