Today I had to split my LAN. My ISP does not let me control the NAT/gateway enough, so I just build my own NAT behind ISP NAT. And I am trying to make it work.

I currently need to access a Raspberry Pi's SSH server from outside.

  • is LAN offered by my ISP
  • is LAN offered by a wireless NAT router model TL-WR340G from TP-Link

Raspberry Pi has its static IP address and is ready to go. And MUST be connected to TP-Link router

I have already configured DMZ port forwarding from outside on my ISP gateway (luckily I can control it) and I have verified, changing the IP to my laptop connected directly to ISP modem, that port forwarding works on that side.


Then I went to TP-Link router admin and set up port forwarding to Raspberry IP address. I set up the usual: service port? 22, ip address? 192.168.9.x and double-check, protocol? tcp or both. enable? of course.

But the problem is that the wifi router will never ever forward anything to its LAN. I am sure of the cablings. I am capable of reaching Raspberry by its LAN address. I have determined that the router may be misconfigured because I connected my laptop to ISP modem, obtained a .8.x address and tried to ssh at .8.y where y is WAN IP address of TP-Link router. Crazy. Will always refuse connection.

I have tried to enable DMZ to Raspberry, so double-forwarding should occur to any port. No luck. Tried to reboot several times, but the router seems not going.

I am sure of cablings because when I did the migration I moved everything from ISP modem to the LAN ports of the TP Link and connected the WAN of TP Link to a LAN port of ISP modem. All devices behind TP Link get a correct .9.x address.

Is there something more to check on the router settings? Something I might have missed?

I am getting crazy because tomorrow I am leaving this place and need to reconnect in the future via OpenVPN. Cannot try another router, I have only this gear at this time of the day. Not controlling static routes on the ISP modem is the reason, otherwise having Raspberry on ISP modem with port forwarding made openvpn work too. But it has to work bidirectionally and transparently.


I'm making some assumptions here.

You see to be describing a doubly NATed network, when the ISP's router give you a private network of 192.168.8.xxx, to which you've added another NATing router that provides another private subnet numbered 192.168.9.xxx.

If you are going to be using port forwarding inword, it would be wise to assign static IP addresses to your TL-WR340 and your Raspberry Pi.

Yur ISP's router will have an outside internet address too. You'll need that to get there from the internet. Be aware that ISPs ofen do not give a static internet address unless one is paid for, so you likely have an address that can change. You may need to plan for that. Google "Dynamic DNS"

Lets assume your ISP router has an internet hostname of mypc.myisp.ru, and that you can administer port forwarding on it.

Pick a port number for A. for example 12345, as your ISP may prevent you from forwarding 22. It's a little bit of security by obsurity too. Not much protection, but some.

Your goal is to ssh to you Pi by ssh-ing to mypc.myisp.ru:12345. maybe by a command like

ssh pi@myisp.mysip.ru -p 12345

The ISP router needs to be set to forward to your TL-WR340G's outside IP address, the address on the subnet that you ISP's router fronts. It'll be easier if you make it static

Lets assume it is

Since this is your device, I'm going to assume it can forward port 22.

So on the ISP router, instruct it to forward port 12345 to port 22 on

Now your TL-340G would see an inbound connection on it's port 22.

So you need to go into your TL340G's adminstration pages, and instruct it to forward port 22 to the port 22 at an address you configured your Raspberry Pi to use, for example

So basically you need to set up port forwarding twice.

If you can't administer your ISP's router's port forwarding, you need to start looking at UPNP to get your inbound port.

  • Okay, I may haven't explained it all. I am focusing on the 2nd port forwarding because 1st works. And I already have dyn dns from long time. In fact today I plugged the Pi to ISP modem and worked like a charm from outside (vanity dns works too). But tonight I needed to change the entire setup because of a different story. And I still need to have that Raspberry Pi accessible from outside as it was this morning. So when I found that Pi was not getting connections from outside I tried to check inside the network by connecting directing to ISP modem outside the internal NAT and see – usr-local-ΕΨΗΕΛΩΝ Mar 19 '16 at 21:53
  • "So you need to go into your TL340G's adminstration pages, and instruct it to forward port 22 to the port 22 at an address you configured your Raspberry Pi to use, for example". Exactly what I did, unsuccessfully. I asked this question to get help about that device, because any other would work – usr-local-ΕΨΗΕΛΩΝ Mar 19 '16 at 21:55
  • I have no experience on that particular hardware. I suggest debugging the configuration by putting something on the 192.168.8.xx network that you can ssh from and try direct to the TL340G router. Maybe get a wireshark trace of what's going on. – infixed Mar 19 '16 at 21:59
  • Your TL340G is using a static 192.168.8.xxx address for its WAN port, right? – infixed Mar 19 '16 at 22:04
  • A DHCP reservation to be precise. But you are missing the point. It's the TL forwarding not working. I am debugging already from internal. Don't worry I have little time and if I can't fix I will simply have to cancel the activity – usr-local-ΕΨΗΕΛΩΝ Mar 19 '16 at 22:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.