Transmission Entware Remote WAN times out/fail

[dooniem]

Hi. This topic has sort of been covered on different boards, but their fix don't fix mine, so I humbly present my problem to you guys in hope of using transmission outside of my home. Local connection to Transmission works, but not remotely through WAN.

My spec:
Asus RT-AC66U
Firmware Version:3.0.0.4.270.26 (Merlin build)
Entware
USB external drive 500GB, split in two partitions, 1 NTFS, 1 ext3

Using MYchosenDDNS.asuscomm.com:9091, it times out.
Using WAN-IP I got connection refused. So I checked port 9091 on grc.com/ and found it was closed! Used portforward in asuswrt web-gui to host 0.0.0.0 and got stealth. But portforwarding to the router is wrong anyway, right?

Here's my /jffs/scripts/firewall-start:

#!/bin/sh
iptables -I INPUT -p tcp --destination-port 51413 -j ACCEPT
iptables -I INPUT -p udp --destination-port 51413 -j ACCEPT
iptables -I INPUT -p tcp --destination-port 9091 -j ACCEPT
iptables -I INPUT -p tcp --destination-port 80 -j ACCEPT
iptables -I INPUT -p tcp --destination-port 34881 -j ACCEPT
iptables -I INPUT -p udp --destination-port 34881 -j ACCEPT

Yeah, I got a bit carried away, saw in the log something about port 34881 and unpnp listening on that port. Thought it couldn't hurt. Canyouseeme.org shows port 9091 as open btw.

Here's my .json:

{
    "alt-speed-down": 500,
    "alt-speed-enabled": false,
    "alt-speed-time-begin": 600,
    "alt-speed-time-day": 127,
    "alt-speed-time-enabled": false,
    "alt-speed-time-end": 1320,
    "alt-speed-up": 500,
    "bind-address-ipv4": "0.0.0.0",
    "bind-address-ipv6": "::",
    "blocklist-enabled": false,
    "blocklist-url": "http://list.iblocklist.com/?list=bt_level1",
    "cache-size-mb": 8,
    "dht-enabled": true,
    "download-dir": "/mnt/Doonie-Serve/#Torrent/Completed",
    "download-queue-enabled": true,
    "download-queue-size": 5,
    "encryption": 0,
    "idle-seeding-limit": 10080,
    "idle-seeding-limit-enabled": true,
    "incomplete-dir": "/mnt/Doonie-Serve/#Torrent/Incomplete",
    "incomplete-dir-enabled": false,
    "lazy-bitfield-enabled": true,
    "lpd-enabled": true,
    "message-level": 1,
    "open-file-limit": 32,
    "peer-congestion-algorithm": "",
    "peer-limit-global": 40,
    "peer-limit-per-torrent": 8,
    "peer-port": 51413,
    "peer-port-random-high": 65535,
    "peer-port-random-low": 49152,
    "peer-port-random-on-start": false,
    "peer-socket-tos": "lowcost",
    "pex-enabled": true,
    "port-forwarding-enabled": true,
    "preallocation": 1,
    "prefetch-enabled": 0,
    "proxy": "",
    "proxy-auth-enabled": false,
    "proxy-auth-password": "",
    "proxy-auth-username": "",
    "proxy-enabled": false,
    "proxy-port": 80,
    "proxy-type": 0,
    "queue-stalled-enabled": true,
    "queue-stalled-minutes": 30,
    "ratio-limit": 50,
    "ratio-limit-enabled": true,
    "rename-partial-files": true,
    "rpc-authentication-required": true,
    "rpc-bind-address": "192.168.1.1",
    "rpc-enabled": true,
    "rpc-password": "XXXXXXXXXXXXXXXXXXXXX",
    "rpc-port": 9091,
    "rpc-url": "/transmission/",
    "rpc-username": "dooniem",
    "rpc-whitelist": "192.168.*.*,127.0.0.1",
    "rpc-whitelist-enabled": true,
    "scrape-paused-torrents-enabled": true,
    "script-torrent-done-enabled": false,
    "script-torrent-done-filename": "",
    "seed-queue-enabled": false,
    "seed-queue-size": 10,
    "speed-limit-down": 1000,
    "speed-limit-down-enabled": true,
    "speed-limit-up": 70,
    "speed-limit-up-enabled": true,
    "start-added-torrents": true,
    "trash-original-torrent-files": true,
    "umask": 0,
    "upload-slots-per-torrent": 10,
    "utp-enabled": false,
    "watch-dir": "/mnt/Doonie-Serve/#Torrent/Watch",
    "watch-dir-enabled": true
}

*Tried with optware first, same story. Worked locally but not WAN.
*Used rm -f asusware and installed with "entware-setup.sh"
*Been through the .json a couple of times, exploring with different rpc-whitelists.
-I even went to findmyip.org with my iPhone to add that to the whitelist without luck.
*Tried turning off the firewall from the firewall setting inside the web-ui of asuswrt.
*Checked the "Transmission-deamon.lists" to see if the correct config file was being used
*Validated the json
*Tried with portforwarding in json both true and false, no prevail

What am I doing wrong?
Any ideas?

 

[dooniem]

Fixed it!
I disabled the rpc-whitelist for starters. Point being I want to use it on a 3G phone, I can't keep guessing my IP's all the time. Maybe less secure, but more practical to disable it.
Then I changed the rpc-bind-address back to "0.0.0.0", experimenting made me change it in the first place. Last, but probably important. Portforwarding enabled.

 

[xiphias]

Thanks

Thank you for this post. I was also struggling with opening the transmission client to WAN. Enabling port-forwarding in the .json and then removing any entries that dealt with 9091 in the WAN settings (port forwarding) of the router admin pages also resolved my issue. grc/canyouseeme were great troubleshooting resources.

Word of caution, there are several uPNP exploits out there, might not want to stick those allow rules in your iptables.

 

[dooniem]

Thanks

Glad you found this helpful, even without me omitting my final working .json!
Thanks for the heads up. I've changed my IP table since this.

 

[atkinsom]

Wondering if you guys can take a look at my .json file...I think it's right but I still can't access remotely from WAN using ip address or ddns hostname. All other port forwarding works on the router...thanks for any assistance.

{
    "alt-speed-down": 500, 
    "alt-speed-enabled": false, 
    "alt-speed-time-begin": 600, 
    "alt-speed-time-day": 127, 
    "alt-speed-time-enabled": false, 
    "alt-speed-time-end": 1320, 
    "alt-speed-up": 90, 
    "bind-address-ipv4": "0.0.0.0", 
    "bind-address-ipv6": "::", 
    "blocklist-enabled": false, 
    "blocklist-url": "http://list.iblocklist.com/?list=bt_level1", 
    "cache-size-mb": 2, 
    "dht-enabled": true, 
    "download-dir": "/mnt/sda2/Torrent/Completed", 
    "download-queue-enabled": true, 
    "download-queue-size": 5, 
    "encryption": 0, 
    "idle-seeding-limit": 10080, 
    "idle-seeding-limit-enabled": false, 
    "incomplete-dir": "/mnt/sda2/Torrent/Incomplete", 
    "incomplete-dir-enabled": true, 
    "lazy-bitfield-enabled": true, 
    "lpd-enabled": true, 
    "message-level": 1, 
    "open-file-limit": 5, 
    "peer-congestion-algorithm": "", 
    "peer-id-ttl-hours": 6, 
    "peer-limit-global": 450, 
    "peer-limit-per-torrent": 100, 
    "peer-port": 51413, 
    "peer-port-random-high": 65535, 
    "peer-port-random-low": 49152, 
    "peer-port-random-on-start": false, 
    "peer-socket-tos": "lowcost", 
    "pex-enabled": true, 
    "port-forwarding-enabled": true, 
    "preallocation": 1, 
    "prefetch-enabled": 0, 
    "proxy": "", 
    "proxy-auth-enabled": false, 
    "proxy-auth-password": "", 
    "proxy-auth-username": "", 
    "proxy-enabled": false, 
    "proxy-port": 80, 
    "proxy-type": 0, 
    "queue-stalled-enabled": true, 
    "queue-stalled-minutes": 30, 
    "ratio-limit": 50, 
    "ratio-limit-enabled": false, 
    "rename-partial-files": true, 
    "rpc-authentication-required": true, 
    "rpc-bind-address": "0.0.0.0", 
    "rpc-enabled": true, 
    "rpc-password": "", 
    "rpc-port": 9091, 
    "rpc-url": "/transmission/", 
    "rpc-username": "", 
    "rpc-whitelist": "*.*.*.*", 
    "rpc-whitelist-enabled": false, 
    "scrape-paused-torrents-enabled": true, 
    "script-torrent-done-enabled": false, 
    "script-torrent-done-filename": "", 
    "seed-queue-enabled": false, 
    "seed-queue-size": 10, 
    "speed-limit-down": 1000, 
    "speed-limit-down-enabled": false, 
    "speed-limit-up": 90, 
    "speed-limit-up-enabled": true, 
    "start-added-torrents": true, 
    "trash-original-torrent-files": true, 
    "umask": 18, 
    "upload-slots-per-torrent": 10, 
    "utp-enabled": true, 
    "watch-dir": "/mnt/sda2/Torrent/Watch", 
    "watch-dir-enabled": true
}

 

[atkinsom]

Quick glance and had my iptables set wrong...corrected with correct port 9091..had typed in 9901 Duh!