2

A picture of my network topology is included below.

I have a few servers I want exposed to the internet. These are behind a Linksys router/firewall with a public IP and a LAN address of 192.168.11.1 (Router 1 in the image). I have my home network that I want isolated from the internet, and not visible to the hosts on the 192.168.11.0/24 subnet. I'd also like the home network to be behind the Linksys firewall (not in a DMZ). I have the WAN port of a NetGear R7000 (Router 2 below) plugged into a LAN port of the Linksys router. The R7000 has a WAN address of 192.168.11.10, and a LAN address of 192.168.1.1.

The Linksys router forwards ports successfully to the servers and the R7000 router. e.g., I set up a port forward for port 8080 to 192.168.11.10. If a server is at this address it receives connections on that port. Now I put the R7000 at that address, and I have it set up to forward port 8080 through to 192.168.1.3. The problem is that the host at 192.168.1.3 never sees traffic on port 8080. To the outside world nothing appears to be listening on that port.

As I understand it, this setup should be working. I assume there's an issue with the R7000 that's preventing this (or a setting that I'm missing). Are there any routers that are known to forward ports correctly in this configuration?

enter image description here

11
  • 1
    I don't understand why "Router 3" has WAN and LAN addresses from the same subnet. If you had fully configured it as an AP, then it would only have one (LAN) IP address (and it wouldn't be a router anymore). Jun 23, 2018 at 20:10
  • 2
    @Bill: Can you clarify whether 192.168.1.3 is in the "LAN clients" section or the "Wi-Fi clients" one? If it's the latter, can you also check whether computers in "LAN clients" are able to reach 192.168.1.3? Jun 23, 2018 at 20:24
  • Also in addition to grawity's questions - can a 192.168.11.xxx server reach 192.168.11.10 on TCP port 8080 ? Which should be translated to 192.168.1.3 TCP port 8080
    – Ross
    Jun 24, 2018 at 8:19
  • @grawity: 192.168.1.3 is in the LAN clients section, though since Router 3 is really just an AP, all 192.168.1.0/24 clients (WAN and LAN) can reach each other. No problems there. Jun 24, 2018 at 21:15
  • 1
    @Bill: If it truly were an AP, it wouldn't have a "WAN/LAN" distinction at all is my point... Jun 24, 2018 at 21:17

2 Answers 2

1

There are a number of possibilities this is not working. The first thing to look at is to ensure the netmask are set to 255.255.255.0 and not 255.255.0.0 - which could be the cause of the issue - the traffic not getting back to the host.

Another possibility may be that the port forwarding is requiring NAT to work, and because all IP's are RFC1918 the router might not be doing that NAT. The solution could be to disable NAT on Router-2 with IP 192.168.11.10 and 192.168.1.1 to go via WAN IP (192.168.11.10) on Router-1 with LAN IP 192.168.11.1 - and then port forward on the 192.168.1.1 router straight to the desired machine.

6
  • All netmasks are set to 255.255.255.0. Regarding your possible solution, wouldn't that essentially be bridging the networks, putting everything on one network? One point of this setup is to isolate the 192.168.1.xxx subnet from the subnet exposed to the internet. Jun 24, 2018 at 21:38
  • It would allow the networks to talk to each other - but this is not the same as bridging. If the router allows it you can put firewalling in place as all traffic goes through the router.
    – davidgo
    Jun 24, 2018 at 23:30
  • 1
    @tim_Stewart - yes, but I'm not sure what is unclear - please feel free to edit my post as you believe appropriate to better convey my meaning.
    – davidgo
    Jun 26, 2018 at 3:53
  • I understand what you mean regarding RFC1918. I'd be disappointed if that's the case, but not totally surprised. If you are suggesting using iptables to set up the routing on Router 1, that's conceivable because it's running DD-WRT. But I'm not familiar enough with iptables to be sure I'm not unknowingly opening up my network. I'd rather find a router that would just work in place of the R7000. Jun 26, 2018 at 4:38
  • @bill Brooks, you can use NMAP after creating iptables rules to see what's open/accepting connections. Jun 26, 2018 at 12:10
1

This is to complement Davidgo's answer.

I think what davidgo was mentioning is this.

Router-1 --> Setup --> Advanced routing

Routing You can either setup a static route or use dynamic routing to inform router-1 how to reach the second sub-net. (I personally use RIPv2)


Router-2 -> LAN Settings

R2 RIP Enable RIPv2 in both directions for router-2. Check the routing tables to make sure they are receiving the advertisements & updating the tables. Test connectivity from both sub-nets(both directions), then try creating the port-forward again.


IPtables is a very flexible firewall/filter utility, if you are going to continue to use dd-wrt for more advanced tasks than the average user, you should familiarize yourself with it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .