Buffalo N300 refuses to forward ports for Debian laptop

Question

I currently own a Buffalo N300 wireless router. I also have a small G3 Lombard laptop hooked up to it via ethernet cable.

With my previous router, port-forwarding was straight forward and worked flawlessly. However, with this router it's just as easy, but it absolutely refuses to forward the ports.

If I disable the firewall, no dice. If I create a static lease for an IP and assign it to the MAC address of the laptop and try, no dice. If I do that along with setup the DMZ for the IP address of the static lease to the laptop, no dice as well.

The laptop's iptables are setup to allow any and all requests to and from any client. So that is not the issue; it worked perfectly fine with the previous router.

What is concerning is that it will forward it's own remote web interface no problem on port 8080. With my previous router I could forward ports: 21, 22, 80, and 9091 no problem at all. This one seems to simply ignore whatever I ask it in terms of port-forwarding.

If anyone can help me out on why exactly this is happening I'd appreciate it.

EDIT: Also, the router came with the latest version of DD-WRT available for its model (build 17135).

Answer 1

You are testing from inside your own network. You have to test port forwarding from outside your network.

Port forwarding only rewrites the destination address. If you test from the inside, the reply packets will go directly to the destination and the router won't have an opportunity to rewrite the source address of the reply packets.

It works for the router forwarding its own ports because then the reply doesn't have to go back through the router to be NATed because it's already at the router.

If you are expecting this to work from inside your own network, you need to loopback NAT (sometimes called hairpin NAT), a form of double NAT that can rewrite both the source and destination address. This ensures the reply packets go back through the router and can be rewritten as well.

Here's what happens:

1) Inside machine sends a packet to your public IP address. The source address is the inside machine's address. Since the machine has no route to the public IP address, it sends it along its default route, to the router.

2) The router gets the packet and sees that it matches a port forwarding rule. It rewrites the destination address to the server's inside address and forwards the packet to the server. The packet still has the inside machine's source address.

3) The server forms a reply to the packet. Since the packet had the inside machine's source address, the reply has the inside machine's destination. The source of the reply is the server's inside address. Since the destination is local, the packet is not forwarded to the router but directly to the local machine.

4) The originating machine receives the reply. But the reply's source address is the server's inside address, not the address the machine sent the original packet to (your public IP address). So the originating machine discards the reply.