1

A picture of my network topology is included below.

I have a few servers I want exposed to the internet. These are behind a Linksys router/firewall with a public IP and a LAN address of 192.168.11.1 (Router 1 in the image). I have my home network that I want isolated from the internet, and not visible to the hosts on the 192.168.11.0/24 subnet. I'd also like the home network to be behind the Linksys firewall (not in a DMZ). I have the WAN port of a NetGear R7000 (Router 2 below) plugged into a LAN port of the Linksys router. The R7000 has a WAN address of 192.168.11.10, and a LAN address of 192.168.1.1.

The Linksys router forwards ports successfully to the servers and the R7000 router. e.g., I set up a port forward for port 8080 to 192.168.11.10. If a server is at this address it receives connections on that port. Now I put the R7000 at that address, and I have it set up to forward port 8080 through to 192.168.1.3. The problem is that the host at 192.168.1.3 never sees traffic on port 8080. To the outside world nothing appears to be listening on that port.

As I understand it, this setup should be working. I assume there's an issue with the R7000 that's preventing this (or a setting that I'm missing). Are there any routers that are known to forward ports correctly in this configuration?

enter image description here

  • 1
    I don't understand why "Router 3" has WAN and LAN addresses from the same subnet. If you had fully configured it as an AP, then it would only have one (LAN) IP address (and it wouldn't be a router anymore). – grawity Jun 23 '18 at 20:10
  • 2
    @Bill: Can you clarify whether 192.168.1.3 is in the "LAN clients" section or the "Wi-Fi clients" one? If it's the latter, can you also check whether computers in "LAN clients" are able to reach 192.168.1.3? – grawity Jun 23 '18 at 20:24
  • Also in addition to grawity's questions - can a 192.168.11.xxx server reach 192.168.11.10 on TCP port 8080 ? Which should be translated to 192.168.1.3 TCP port 8080 – Ross Jun 24 '18 at 8:19
  • @grawity: 192.168.1.3 is in the LAN clients section, though since Router 3 is really just an AP, all 192.168.1.0/24 clients (WAN and LAN) can reach each other. No problems there. – Bill Brooks Jun 24 '18 at 21:15
  • 1
    @Bill: If it truly were an AP, it wouldn't have a "WAN/LAN" distinction at all is my point... – grawity Jun 24 '18 at 21:17
1

There are a number of possibilities this is not working. The first thing to look at is to ensure the netmask are set to 255.255.255.0 and not 255.255.0.0 - which could be the cause of the issue - the traffic not getting back to the host.

Another possibility may be that the port forwarding is requiring NAT to work, and because all IP's are RFC1918 the router might not be doing that NAT. The solution could be to disable NAT on Router-2 with IP 192.168.11.10 and 192.168.1.1 to go via WAN IP (192.168.11.10) on Router-1 with LAN IP 192.168.11.1 - and then port forward on the 192.168.1.1 router straight to the desired machine.

  • All netmasks are set to 255.255.255.0. Regarding your possible solution, wouldn't that essentially be bridging the networks, putting everything on one network? One point of this setup is to isolate the 192.168.1.xxx subnet from the subnet exposed to the internet. – Bill Brooks Jun 24 '18 at 21:38
  • It would allow the networks to talk to each other - but this is not the same as bridging. If the router allows it you can put firewalling in place as all traffic goes through the router. – davidgo Jun 24 '18 at 23:30
  • 1
    @tim_Stewart - yes, but I'm not sure what is unclear - please feel free to edit my post as you believe appropriate to better convey my meaning. – davidgo Jun 26 '18 at 3:53
  • I understand what you mean regarding RFC1918. I'd be disappointed if that's the case, but not totally surprised. If you are suggesting using iptables to set up the routing on Router 1, that's conceivable because it's running DD-WRT. But I'm not familiar enough with iptables to be sure I'm not unknowingly opening up my network. I'd rather find a router that would just work in place of the R7000. – Bill Brooks Jun 26 '18 at 4:38
  • @bill Brooks, you can use NMAP after creating iptables rules to see what's open/accepting connections. – Tim_Stewart Jun 26 '18 at 12:10
0

This is to complement Davidgo's answer.

I think what davidgo was mentioning is this.

Router-1 --> Setup --> Advanced routing

Routing You can either setup a static route or use dynamic routing to inform router-1 how to reach the second sub-net. (I personally use RIPv2)


Router-2 -> LAN Settings

R2 RIP Enable RIPv2 in both directions for router-2. Check the routing tables to make sure they are receiving the advertisements & updating the tables. Test connectivity from both sub-nets(both directions), then try creating the port-forward again.


IPtables is a very flexible firewall/filter utility, if you are going to continue to use dd-wrt for more advanced tasks than the average user, you should familiarize yourself with it.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.