10

I have been trying to setup SoftEther for a while now but when I try to connect using TCP connection it is failing. So I tried to run a external scan to determine which ports are open and it seems all the ports which I have opened on my router for port forwarding is shown as closed. I was wondering could the ISP somehow disable port forwarding? If this is the case how can I verify it?

Running home OpenVPN server with ISP blocking port forwarding

--Edit 1--

This is done on the laptop running the VPN server. As you can see in the bottom port 5555 is open.

enter image description here

The image below is on the router which connects to the ISP. As you can see port 5555 is not showing

enter image description here

The screenshot below is for the port forwarding page in the router as you can see port 5555 is being forwarded. But I am not able to use any of the other ports which are forwarded as well. Also with turning off the firewall

enter image description here

However for example if I try to log on using a local IP I am able to log in but cannot log in when I try to log in from outside the network. My ISP says they are not blocking any ports.

Improve this question
11
  • Is the router ISP-issued or your own?
    – Bergi
    Nov 21, 2021 at 15:17
  • ISP issued. I did call them today to confirm if they are blocking ports with 'Carrier-Grade NAT' as mentioned in the answer below. They said no and will send someone out tommorow to check. Hopefully i will have some answers then
    – Slartibartfast
    Nov 21, 2021 at 16:55
  • 5
    How, and where from, did you scan? Also, instead of scanning, did you try just connecting to the specific ports you want? And are you sure your port forwarding actually sends to the right place, and that the destination computer actually accepts those connections? There are so many places this could go wrong that it's quite difficult to say it's at the ISP level at this point.
    – jcaron
    Nov 21, 2021 at 23:18
  • 5
    Still, you are scanning from the inside. Some routers do not behave the same when traffic comes from the inside, even if you target the external IP. Try connecting from the outside (I.e. from another computer/network).
    – jcaron
    Nov 22, 2021 at 8:29
  • 1
    +1 @jcaron, you need to scan from the outside. Also try connecting via basic netcat or such to double check. I doubt your ISP is blocking anything, most likely something is weird about your network.
    – user541686
    Nov 23, 2021 at 6:14

3 Answers 3

Reset to default
50

"Port forwarding" is the wrong thing to focus on. Port forwarding is done by your router, with packets that have already arrived at the router, and the ISP can't disable that – but what they can do is prevent the packets from reaching your router at all. If they do this, what your router would do with them is just irrelevant – it can't do anything with packets that never arrive.

There are two basic ways an ISP can prevent inbound connections from reaching you:

  • By setting up a stateful firewall that only allows inbound packets that belong to an already "known" connection, i.e. only replies but not new connections. (Home routers typically also have the same kind of firewall, for protecting your home network. It's unusual to see it done ISP-wide but certainly not impossible, e.g. an LTE operator here puts you behind a firewall unless you pay for a "static IP address".)

  • As a side effect of using Carrier-Grade NAT, in other words, simply not giving you a public IP address that you could receive the connections at. Due to the increasing scarcity of IPv4 addresses, many home and mobile ISPs have deployed CGNAT causing all customers to only have some form of "private" IP address.

Take a look at the "WAN IP address" shown by your router. Normally it should be a public IPv4 address – if it's not, that means your whole router is behind yet another layer of NAT, possibly ISP-level CGNAT. (Here keep in mind that 100.64.0.0/10 is also a private range, specifically for CGNAT.) If you have a router and a separate modem or ONT, the latter could also be acting as a router and doing NAT.

If the address is public, the next step is to somehow have your router itself tell you whether it's receiving the inbound packets. This really depends on what kind of router you have, e.g. some have a packet-logging feature in their firewall, OpenWRT-based routers might even have the tcpdump tool installed. (In most cases, unfortunately, you have nothing.)

Improve this answer
2
  • 1
    They can also just block ports, and then you end up having to forward 443 or similar.
    – mckenzm
    Nov 23, 2021 at 2:30
  • You could hook up a single machine directly to the cable modem or whatever, if it's not itself acting as a router. i.e. hook up a Linux box in place of your router, and run tcpdump or wireshark on it. Just as a way to test if packets are reaching it at all (and thus would reach your router.)
    – Peter Cordes
    Nov 24, 2021 at 11:18
8

Your ISP can disable a port. That is, they can have a rule in their networking equipment which prevents packets destined for certain ports from reaching your router.

Port-forwarding is a behavior of your router which maps between an external facing port and an internal address and port. To the outside world, your port forwarding is invisible.

The only way your ISP can interfere with port forwarding is if your router is actually their router: a piece of equipment under their administrative control that they remotely manage.

Improve this answer
6
  • 1
    We are behind a CGNAT, so that is the issue. I was wondering if IPS can open ports on their CGNAT
    – Slartibartfast
    Nov 22, 2021 at 17:34
  • 2
    @Slartibartfast: They can, they just won't. (It's actually more likely they'd give you a whole public IP address instead.)
    – user1686
    Nov 22, 2021 at 17:46
  • Of course there is nothing to stop you having another router under theirs. Ports would only be forwarded on the last leg.
    – mckenzm
    Nov 23, 2021 at 2:32
  • @mckenzm But then that router is effectively upstream equipment that is blocking the ports in the first place.
    – Kaz
    Nov 23, 2021 at 3:25
  • @Kaz In fact the port would need to be forwarded "unaltered" through the first router as well, I was tired when I wrote that.
    – mckenzm
    Nov 23, 2021 at 3:49
1

Not only CGNAT, but the ISP can technically force your endpoint to be client-only, e.g. block any TCP SYN 0 directed to your endpoint, or in case of UDP block all UDP messages if no UDP datagram was seen on the reverse direction first.

An aggressive ISP can technically implement this to prevent you from running any kind of server. In the era of HTTPS social media, little to no customers will ever care.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.