A picture of my network topology is included below.

I have a few servers I want exposed to the internet. These are behind a Linksys router/firewall with a public IP and a LAN address of (Router 1 in the image). I have my home network that I want isolated from the internet, and not visible to the hosts on the subnet. I'd also like the home network to be behind the Linksys firewall (not in a DMZ). I have the WAN port of a NetGear R7000 (Router 2 below) plugged into a LAN port of the Linksys router. The R7000 has a WAN address of, and a LAN address of

The Linksys router forwards ports successfully to the servers and the R7000 router. e.g., I set up a port forward for port 8080 to If a server is at this address it receives connections on that port. Now I put the R7000 at that address, and I have it set up to forward port 8080 through to The problem is that the host at never sees traffic on port 8080. To the outside world nothing appears to be listening on that port.

As I understand it, this setup should be working. I assume there's an issue with the R7000 that's preventing this (or a setting that I'm missing). Are there any routers that are known to forward ports correctly in this configuration?

enter image description here

  • 1
    I don't understand why "Router 3" has WAN and LAN addresses from the same subnet. If you had fully configured it as an AP, then it would only have one (LAN) IP address (and it wouldn't be a router anymore). – user1686 Jun 23 '18 at 20:10
  • 2
    @Bill: Can you clarify whether is in the "LAN clients" section or the "Wi-Fi clients" one? If it's the latter, can you also check whether computers in "LAN clients" are able to reach – user1686 Jun 23 '18 at 20:24
  • Also in addition to grawity's questions - can a 192.168.11.xxx server reach on TCP port 8080 ? Which should be translated to TCP port 8080 – Ross Jun 24 '18 at 8:19
  • @grawity: is in the LAN clients section, though since Router 3 is really just an AP, all clients (WAN and LAN) can reach each other. No problems there. – Bill Brooks Jun 24 '18 at 21:15
  • 1
    @Bill: If it truly were an AP, it wouldn't have a "WAN/LAN" distinction at all is my point... – user1686 Jun 24 '18 at 21:17

There are a number of possibilities this is not working. The first thing to look at is to ensure the netmask are set to and not - which could be the cause of the issue - the traffic not getting back to the host.

Another possibility may be that the port forwarding is requiring NAT to work, and because all IP's are RFC1918 the router might not be doing that NAT. The solution could be to disable NAT on Router-2 with IP and to go via WAN IP ( on Router-1 with LAN IP - and then port forward on the router straight to the desired machine.

  • All netmasks are set to Regarding your possible solution, wouldn't that essentially be bridging the networks, putting everything on one network? One point of this setup is to isolate the 192.168.1.xxx subnet from the subnet exposed to the internet. – Bill Brooks Jun 24 '18 at 21:38
  • It would allow the networks to talk to each other - but this is not the same as bridging. If the router allows it you can put firewalling in place as all traffic goes through the router. – davidgo Jun 24 '18 at 23:30
  • 1
    @tim_Stewart - yes, but I'm not sure what is unclear - please feel free to edit my post as you believe appropriate to better convey my meaning. – davidgo Jun 26 '18 at 3:53
  • I understand what you mean regarding RFC1918. I'd be disappointed if that's the case, but not totally surprised. If you are suggesting using iptables to set up the routing on Router 1, that's conceivable because it's running DD-WRT. But I'm not familiar enough with iptables to be sure I'm not unknowingly opening up my network. I'd rather find a router that would just work in place of the R7000. – Bill Brooks Jun 26 '18 at 4:38
  • @bill Brooks, you can use NMAP after creating iptables rules to see what's open/accepting connections. – Tim_Stewart Jun 26 '18 at 12:10

This is to complement Davidgo's answer.

I think what davidgo was mentioning is this.

Router-1 --> Setup --> Advanced routing

Routing You can either setup a static route or use dynamic routing to inform router-1 how to reach the second sub-net. (I personally use RIPv2)

Router-2 -> LAN Settings

R2 RIP Enable RIPv2 in both directions for router-2. Check the routing tables to make sure they are receiving the advertisements & updating the tables. Test connectivity from both sub-nets(both directions), then try creating the port-forward again.

IPtables is a very flexible firewall/filter utility, if you are going to continue to use dd-wrt for more advanced tasks than the average user, you should familiarize yourself with it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.