Routing from the DMZ to the interior network only

Question

I have a home network connected to Verizon's FIOS service. Verizon's ActionTec router is connected to the ONT via coax to establish the MOCA network. My DD-WRT router's WAN port is connected to one of the ActionTec's LAN ports. The DD-WRT router is configured with a static IP address and assigned to the DMZ (this is done so I only have to configure port forwarding once).

My issue is that this does not allow computers connected to the DD-WRT to serve streaming audio/video to the MOCA network using Verizon's Media Manager. I know that Media Manager uses ports 18000, 18001, 5050, and 5060, but I don't know how to forward those ports so that they are only available to the ActionTec's network (i.e. the cable set-top boxes) and not the rest of the internet.

For ease of discussion, the IP addresses current being used internally are:

192.168.1.1        - ActionTec Router
192.168.1.2        - DD-WRT Router's WAN port (assigned to DMZ)
192.168.1.100-.103 - Set-Top Boxes (STBs)
192.168.0.1        - DD-WRT's LAN address
192.168.0.151      - Computer running Media Manager

Answer 1

DD-WRT's web interface does not support restricting the source IP address of the data to be forwarded. However this functionality is supported by the OS, so it can be configured at the command line (accessed via SSH) using the "iptables" command. I'll be breaking the command up into multiple lines for readability, but they should all go on the same line if you're actually trying to use them.

Start by creating rules in the "PREROUTING" chain of the "nat" table for each STB/port combination. Insert these rules after the existing port forwarding rules and before the final "TRIGGER" rule, like this:

iptables 
   -t nat 
   -I PREROUTING 8 
  --source 192.168.1.100 
  --dst 192.168.1.2 -p tcp
  --dport 18000 
   -j DNAT 
  --to-destination 192.168.0.151:18000 

Do this this for each combination of address and port that you want to receive data from. The destination and to-destination are the same for each command. You can leave the rule number (8) the same for each command, so each new entry pushes the previous entries up one value.

Then add each address/port combination to the "FORWARD" chain of the "filter" table. As before, add these rules after the existing forwarded ports and before the first "TRIGGER", as so:

iptables 
   -I FORWARD 13 
   -t filter 
   -p udp 
   -s 192.168.1.100 
   -d 192.168.0.151
  --dport 18000
   -j ACCEPT

And, as in the first command, doing this for each combination of IP address and port.

These rules should allow incoming messages to be received on the specified ports only if they come from the specified addresses.

---

The above answers the core of the question I actually asked. I don't actually have it working in this specific case yet, but I believe that's because Verizon has implemented some sort of check in their software to rule out forwarded packets as a way to prevent the set-top boxes from relaying streaming data directly from the internet.

Answer 2

Your FiOS Actiontec router connects to the ONT using a WAN MoCA signal and connects to the STBs using LAN MoCA signals. The coax port on the router can send and receive both WAN and LAN MoCA signals, but only the LAN MoCA signals are important for Media Manager. (In some cases, FiOS TV customers may have a WAN Ethernet connection between the FiOS router and the ONT, in which case no WAN MoCA signal will be present on the coax wiring in the home. But LAN MoCA signals will still be generated by the router and STBs to communicate.)

If you've set the Actiontec router's DMZ to the static IP address you've assigned to the WAN port of your DD-WRT router, all that will do is send incoming internet traffic directly to your DD-WRT router.

The STBs connect over the LAN MoCA signals to your Actiontec's LAN network. You don't need DMZ in the Actiontec router for Media Manager. You'd only want DMZ in the Actiontec if you are running other programs on your PCs or DD-WRT that need to receive incoming traffic from the internet.

I don't know exactly how Media Manager works, but I suspect when you go into the STB's Media Manager menu, it sends some sort of broadcast message to find all the PCs on the LAN that are running the Media Manager software.

You can try turning off the DMZ in the Actiontec and setting up port forwarding rules (or DMZ) in the DD-WRT to send incoming connections on the correct Media Manager ports to one PC on the DD-WRT LAN.

If it works at all, then only one PC can share media with the STBs. However, I'm not sure if the communication used in Media Manager will work across the network translation from the DD-WRT's WAN port to LAN ports.

Media Manager is designed to be used between STBs and PCs connected to the LAN network on the Actiontec.