Port forwarding from one router to another

Question

I have two routers. One router (a Comcast modem/router) is connected to the Internet. The second router is running TomatoUSB and is in bridge mode, connected to the first router via its WAN port. Finally I have a PC, which is connected to the TomatoUSB router. DHCP is disabled on the second router; the PC gets its IP address from the first router. The setup (with IPs) looks like this:

COMCAST MODEM/ROUTER (10.0.10.1) -> TOMATOUSB ROUTER (10.0.10.2) -> PC (10.0.10.13)

This setup works in that I have Internet access on the PC. Now I want to allow VNC connections to the PC from the Internet, but only from whitelisted IP addresses. I can only do that type of filtering on the TomatoUSB router, which is why it's there.

I tried forwarding port 5900 from the modem/router to the TomatoUSB router (from WAN to 10.0.10.2) and then from the TomatoUSB router to the PC (from 10.0.10.2 to 10.0.10.13) but that doesn't work. If I forward port 5900 from the Comcast modem directly to the PC, that does work, so it's like the TomatoUSB router isn't there at all.

I should mention that one limitation I have is that the PC's IP must be 10.0.10.13.

Can anyone shed some light on this? This setup makes sense in my head but I'm sure I'm missing something fundamental to how this type of networking works. Thanks!

Answer 1

I think the tomato router cannot filter packets in Bridge mode. Since your PC have to be in 10.0.10.x subnet, you should change the subnet between both routers to another subnet such as 10.0.1.x, change the tomato router to Router mode, and configure port forwarding on both Routers.

Answer 2

I'm not familiar to the TomatoUSB system specifically, but in general, setting something to bridge mode turns off all "routing" functions, port forwarding, etc. included.

How rigid is your current setup? Can you set the Comcast router as the Bridge and accomplish your actual "routing" with the TomatoUSB device?