I have addtional routers behind the Modem/Router supplied by my ISP. This configuration was created to deal with a number of issues, such as port forwarding of connections entering from the internet that need to be directed to a Windows Server connected to the 2nd Router.

The layout looks like this:

  • ISP Modem/Router - receives incoming internet traffic (DHCP enabled) including On Demand TV, passing it to a TV Set Top Box and to the 2nd Router.
  • 2nd Router - receives internet traffic from ISP Modem/Router, configured with as Default Gateway and (DHCP enabled) serving all WiFi and Ethernet LAN traffic, including the Windows Server configured as

I use an MS-SQL based App, running on this Server and on a companion desktop PC (, to enable database synchronisation from within the LAN and from the internet. The LAN PC Sync with the Server works fine, the external (internet) Sync can't connect to the Server. But the external PC can ping the Server which has a DDNS Domain up and running.

I've tried configuring open ports on the Server's Firewall, no luck. Disabled the Firewall, no luck.

Between the 2 routers, I have configured port forwarding as follows:

  • Router 1 ( - forward ports 80, 65100, 1433, 1434 etc to
  • Router 2 ( - forward ports 80, 65100, 1433, 1434 etc to Server (

My main purpose in separating the 2 LANs is to keep the internet TV and associated hardware separate from the Windows and Android devices that come and go.

Is there something I'm missing, or is there a better way to approach this?

  • You will get a better response if you don't have a wall of text. I'm probably qualified to answer your question, but could not be bothered to go wade through it. (I'm not the downvoter though) – davidgo Jul 11 '18 at 4:43
  • Are you sure the external PC is pinging your server, and not just your ISPs server(s)? Can you run e.g. Wireshark on your server and verify the ping packets arrive? Because most ISPs today use carrier grade NAT, which means you won't get port forwarding to work, not matter what you try. Another way to test is to temporarily remove the second router, and see if port forwarding works without the second router. If it doesn't, the second router and the two subnets are not the problem... – dirkt Jul 11 '18 at 6:19

In general this should work. There are two situations:

  1. Router 1 doesn't have a route towards the 2nd subnet (, I assume).

    In this case, all port forwardings on Router 1 must use Router 2's external (WAN) IP address, i.e. 192.168.100.x, because it doesn't know how to reach the internal one.

  2. Router 1 does have a static route towards the 2nd subnet.

    In this case, port forwardings on Router 1 can point directly to your Server's IP address, and Router 2 does not need any port forwardings at all. (However, router 2 does need firewall rules allowing incoming connections.)

(I would say 2nd is a more direct approach.)

You did not mention anything about whether you tested the individual components. The connections take quite a few hops, so it's not a black & white "it works / it doesn't work".

  1. Do connections from the internet, to TCP port 80, arrive at your external router?

    This might be difficult or impossible to test if it's a locked-down, combo modem/router. (If you're lucky, it'll have telnet access and tcpdump installed.)

    But do note that some ISPs actually block incoming connections on certain ports, either because they're risky (MS-SQL in particular had serious worms at some point) or because the ISP wants more sales for their business plan (thereby blocking website hosting on consumer plans).

  2. Does the external router correctly forward them to whatever is specified in the port-forwarding rules? In other words, does router 2 receive the packets?

    If router 2 doesn't have any method to test this (no telnet/tcpdump), change the forwarding rules to point to a computer in the 192.168.100.x network, and run Wireshark on that computer to confirm that it is receiving the packets. (Then change the rules back.)

  3. Does the internal router correctly forward packets to the server?

    This time, the server can have Wireshark or tcpdump installed easily, so you just need to start a capture and watch for the packets.

    The capture is unaffected by the server's own firewall, so it'll show packets coming in even if the OS doesn't react to them. (If that happens, you can assume the server's firewall is the problem.)

  4. Does the server respond?

  5. Do the responses travel all the way back?

  • Thanks for your response, here's my best info: 1. .90.0 IP I don't know about or what /24 means. Is that to point .100.1 IP to R2? 2. R2 f/wall is disabled, no need to configure port rules on R2 Others: 1. Don't know. It's Huawei HG8245H. The DDNS service (Dyn) shows my external IP active, translated to my ISP IP 2. Don't know. Possibly a log in R2, not sure 3. Don't know. The Server runs WServer2008R2. Where do I find that? I'll download Wireshark when I run a test 4. The Server responds to a LAN PC running Sync 5. I suspect Sync updates the subscriber if data has been added – Geoff Whiteley Jul 11 '18 at 8:57
  • Um, what do you mean by "my external IP ... translated to my ISP IP"? – user1686 Jul 11 '18 at 9:46
  • Sorry abot the lack of clarity there, I had run out of characters for my response. WhatI was trying to say is I use a Dynamic DNS service (Dyn.org) which translates my ISP assigned IP address to provide my domain name server address. So, even if my ISP IP address changes (as it will if I have to reconnect), they update my domain IP adress automatically - it's just as though I had my own registered domain name and server, anybody connecting to my Domain doesn;t need to know the IP address. – Geoff Whiteley Jul 11 '18 at 10:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.