I have two routers. One router (a Comcast modem/router) is connected to the Internet. The second router is running TomatoUSB and is in bridge mode, connected to the first router via its WAN port. Finally I have a PC, which is connected to the TomatoUSB router. DHCP is disabled on the second router; the PC gets its IP address from the first router. The setup (with IPs) looks like this:


This setup works in that I have Internet access on the PC. Now I want to allow VNC connections to the PC from the Internet, but only from whitelisted IP addresses. I can only do that type of filtering on the TomatoUSB router, which is why it's there.

I tried forwarding port 5900 from the modem/router to the TomatoUSB router (from WAN to and then from the TomatoUSB router to the PC (from to but that doesn't work. If I forward port 5900 from the Comcast modem directly to the PC, that does work, so it's like the TomatoUSB router isn't there at all.

I should mention that one limitation I have is that the PC's IP must be

Can anyone shed some light on this? This setup makes sense in my head but I'm sure I'm missing something fundamental to how this type of networking works. Thanks!


I think the tomato router cannot filter packets in Bridge mode. Since your PC have to be in 10.0.10.x subnet, you should change the subnet between both routers to another subnet such as 10.0.1.x, change the tomato router to Router mode, and configure port forwarding on both Routers.


I'm not familiar to the TomatoUSB system specifically, but in general, setting something to bridge mode turns off all "routing" functions, port forwarding, etc. included.

How rigid is your current setup? Can you set the Comcast router as the Bridge and accomplish your actual "routing" with the TomatoUSB device?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.