Port Forwarding or Network Address Translation (NAT) Introduction

Transcription

1 Introduction Port forwarding can be a very complex topic. TalkTalk's responsibility lies with ensuring that this facility works on their routers, they cannot be held responsible for your devices that you are trying to forward to. This document not only deals with how to configure port forwarding on most of the TalkTalk routers, but also deals with the complete end to end solution. A lot of of problems in this area are not the actual router configuration, but lay with the device on the local network that the ports are being forwarded to. These can be: application problems, personal firewall problems, or ports that need to be translated to other ports. An example of this is if you try to forward port 80. In some cases, the first device to see this & react to it is the web server within your router. This is particularly true if the router is the HG633. how the scenario is being tested. Note: you will not be able to test, or use port forwarding from a device on your local network making a connection to your WAN IP address, or DDNS URL. If you did, the connection attempt would be routed out to the internet and back in again to your router. Once it comes back into your router again, it will not be forwarded to the device your port mapping rules state, but will be blocked by the router. This is known as Loop back traffic, which most routers will discard those packets as an additional security measure. If you have a Smartphone temporarily disable the Wi-Fi and turn on Mobile Data, which will enable you to test access to the device via your mobile phone network. Please see next page for the order of the work to be carried out. Page 1 of 33

2 Basic order of work required: Add the port forwarding rule(s) to the router Reboot the router Add the required inbound rule(s) to the firewall Launch the application Test it locally from another device connected to your router's network (i.e. a device with a x address). 6. Test it with or Port checking websites must be accessed from a device connected to your router's local network. This allows them to obtain the router's WAN IP address. They then try to establish a new connection from their website to your router using the port you specified. This will have to run once for each port you are trying to use. Only go to step 7, if it reports ALL of the ports you have forwarded as OPEN. This can only work on TCP ports, not UDP ports as they work differently to TCP & will always show up as closed, even if they work OK. 7. If it works locally, but not via a port checking website, this might be down to the device in question having the wrong or no default gateway address allocated to its network adapter. This should normally be Test using other people on the internet. Please see the next page for the table of contents covered in this document. Page 2 of 33

3 Table of contents Huawei routers (not HG633 or HG635) Huawei HG633 & HG635 routers D-Link routers (prior to DSL-3780) D-Link DSL 3780 router D-Link DSL-3782 router Forwarding multiple ports Port Translation (where a port is intercepted by the router, e.g. Port 80) Windows firewall settings Test Locally Test from Internet DDNS HG633 being used as a modem & double port forwarding - complex Apple MACs running Windows applications Problems with the device you are forwarding to Page 3 of 33

4 Router login To do this work, you will need to log in to your router. To do this browse to your router at: At the prompt:- Enter your admin username & password. Unless you have changed this, the default is normally:username : admin password : admin Note: on the HG633 & DSL-3782 routers they use their own password unique to each router. This can be found by looking on the label on the rear. It is not the wireless password that is required, but the router or admin password:hg633 DSL-3782 Page 4 of 33

5 Huawei routers (not HG633/HG635) Log in to the router & go into advanced mode. From there go to:advanced > NAT > Port Mapping Either select an existing Application, or use the Customization option. In this case the FTP Server application can be used, but the IP address (maybe ) for the device hosting the FTP server will need to be added in the Internal host field:- If both external start & end ports are left at 21 this will work in passive mode OK. Continued on next page. Page 5 of 33

6 Note when adding this forwarding rule you will see this box:- Click OK to that. Click Submit & reboot the router. Page 6 of 33

7 Huawei HG633 & HG635 routers Prior to doing anything, login to the router. This is quite easy to setup on this router (but your scenario and your equipment may well complicate the end to end situation greatly), but there are two concepts that are slightly different on this router compared to others: Applications these can be software programs such as an FTP Server, or the Minecraft game in server mode that run on a PC/server. They can also be stand alone devices such as CCTV cameras, or a set top box for a TV installation. Most will need to be setup individually to match your requirements, please see the section called No suitable application. Internal Host - you do not forward to a device's IP address, but you forward to a LAN Device using its MAC address. This address stays constant, even if the IP address changes. So it works well with a DHCP (automatically assigned) allocated address. This may cause problems forwarding to devices connected to some wireless extenders. This is not a fault of this router, but a problem of some wireless extenders behaving incorrectly as a bridge & not forwarding the device's MAC address in an IP packet, but substituting its own one in its place. Do not use Port Triggering, in line with most other routers, this renders the port mapping to be very intermittent at best & at worst the rule will not work at all. Note 1: because these routers work on identifying the device by it's MAC address, beware of devices such as IP cameras, that might have both wired & wireless connections. Each connection type will have it's own MAC address. If you initially configure the camera with a wired connection to configure it's wireless connection, then make sure you set the port mapping rule to point to the wireless MAC address & not the wired connection's MAC address. Note 2: these routers can behave in an unexpected manner when trying to forward TCP ports 80 (HTTP), or 443 (HTTPS). The internal web server in these routers will intercept the incoming connection attempt & the router login screen will be seen, rather than the web server on the internal device you are trying to forward these ports to. There is a way around this by applying port translation. Page 7 of 33

8 Devices that do not appear within LAN Devices Any device that connects to the router, should appear in the LAN Devices display of the HG633/HG635, and must be shown as active. The easiest way to check if a device is active, is not be the colouring of its icon, but by setting the Status drop down to active. Then it will only show those devices that are active:- This is not a problem for basic internet use, but when it comes to port forwarding, I have found that if a device has to be manually added, ports will not be able to be forwarded to this device. This can be for several reasons, including:1. The device is not physically connected to either a LAN port, or the Wi-Fi network of the router, e.g. connected to a Wi-Fi extender. However, this should not happen if the extender behaves as a true bridge where the router sees packets coming in from the device, using the device's own MAC address as its source address. I have seen some extenders who forward the packets to the router from the device, using the MAC address of the extender, not the one belonging to the device itself. This is against the basic operation of a bridge & is the fault of the extender's design. You can get around this if the extender itself supports port forwarding, but this is very unlikely. The only other solution is to use a router that forwards to an IP address, not a MAC address. 2. This is a rare situation, but I have seen this none the less. The customer concerned misunderstood the way that DHCP IP address reservation worked. The device was configured with a static IP address on the device itself, rather than getting the address via DHCP, as well as reserving the address within DHCP. The router then sees a device connected to it that has the same IP address as it has to keep free for one of it's devices. Duplicate IP addresses on a network can cause serious problems, so I think that the router blocks the device with the same IP address & hence does not display it in LAN Devices. If you are using DHCP reserved addresses, always make sure that the device in question is still set to get its address allocated automatically from the DHCP server in the router. If a device appears in LAN Devices as an Unrecognised Device :- this might cause problems as well. Page 8 of 33

9 Port Mapping configuration page There are two routes to the port mapping page, either via the "Internet" tab followed by "Port Forwarding" on the left:- Alternatively click on "Home Network" and "LAN Devices" and click on one of the "Edit forwarding rules" links:- Page 9 of 33

10 Applying port forwarding Once in the "Port Forwarding" configuration area, click "New port mapping":- The first thing to bear in mind is the mapping name. The next concept here is to ensure there is an entry for you desired application that is running on the device that you want to forward to. This could be an FTP Server, SNMP Server etc. This contains all of the port numbers required. There are a certain amount of these pre-configured, so click the "Application" dropdown box to see the options:- Note: this is purely an example, the chances of it meeting your requirements are just about none. You will most likely need the section called No suitable application. Page 10 of 33

11 So in its simplest form, the rule can be done very easily. Supposing you need to forward SNMP Traps (don't worry what these are, it is only a very simple example) to a PC connected to a LAN port on the router. This is an easy example as there is already a pre-configured application for this. All you have to do in this case is: Allocate a name for this port mapping rule Select "SNMPTrap" from the "Application" dropdown box Select the desired PC to forward the traffic to from the "Internal Host" dropdown box. Reboot the router & job done! Page 11 of 33

12 No suitable application available In most cases there will be no suitable application existing in the "Application" dropdown box. This will require you to add your own application (e.g. Minecraft server, CCTV camera or DVR) to the port mapping application dropdown box. Before doing this you will need to know which ports need to be forwarded & ideally if they are TCP or UDP. You should be able to get this information from the vendor of the kit/software you are trying to use. Once you have added this new application, it is then automatically added to the dropdown box's list of applications. This new one is then ready for selection in the same way as the previous example. So first click the "Add port mapping application" link:- This will display the same list of applications, go down to the very bottom of the list, where an "Add port application" link will be found, click on that:- Page 12 of 33

13 Although there is a pre-configured application for an FTP server, this example was used to test the port forwarding functionality of this router and is used as an example here. Give the new application a suitable name, add the ports & select the protocol. If in doubt, set the protocol to "TCP/UDP":- You will now see your newly created application has been automatically added to the dropdown list of available applications:- Continued on next page. Page 13 of 33

14 Now all you you have to do once back in the add new rule screen, is give the rule a name, select your new application and finally select the target device to forward traffic to. Then click the "Save" button & reboot the router:- If the required device is not listed, click the "Add device" link above, you will need to know its MAC address. Page 14 of 33

15 D-Link DSL routers (prior to DSL-3780) Log in to the router, then click on the Advanced tab at the top and Port Forwarding on the left:- Try leaving the Connection as PVC0 but this could need changing to PVC1. There is no need to make any firewall changes within the router. Once the changes are complete, click Apply & then Reboot on the left. Page 15 of 33

16 D-Link DSL-3780 This is a bit of a weird router, in so much as some versions, once you get past the summary screens into "Advanced" mode have the Huawei "Look and feel" interface and some go into the more traditional D-Link interface. Port forwarding is set up under Virtual Servers. There is also talk that you have to configure the Applications section as well, but this is wrong. If the Applications are configured under the Special Application section, this makes the port forwarding operation very intermittent, often leaving the port closed when tested via various port testers such as Please also note that there are a number of these preconfigured in the router, unless you really need these I would disable them at the least. First login to the router, then select the edit function & setting the Special Application section above it:- Page 16 of 33

17 Virtual Servers Follow these instructions below taking particular notice of the interface option. This should not be left as WAN, but change it to PVC1. You can replace the Internal IP/port number with whatever ones you need. Click on the Advanced tab along the top and down the left hand side, click on Virtual Servers. The example below port forwards to an FTP server:- Add the required rule & click the Add/Apply button. Router reboot If the router is rebooted at this point you may lose some of your settings, so go to:maintenance > System Settings > Save & reboot the device:- Page 17 of 33

18 DSL-3782 This is very simple to add to this router. Any problems that are encountered with the end to end solution are therefore more likely to be on the device in question, or elsewhere, not the router. Do not use Applications with the DSL-3782, that is port triggering & will render port forwarding to be unreliable at best, or not to work at all. Procedure Login to the router & then create a static IP address for the device the port(s) are to be forwarded to. This can either be done on the device itself & excluded from the DHCP IP address range on the router, or via the DHCP reservations in the router. To configure the port forwarding, go to:features > Port Forwarding Leave the interface below to PVC1 & set the name & ports etc to match your scenario:- Note 1: if on fibre the interface may be set to PTM rather than PVC1. Note 2: unlike the HG633/635 when trying to forward TCP ports 80 or 443, there is no need to translate these ports, leave internal/external all as 80 or 443. Page 18 of 33

19 Forwarding multiple ports This example is based on the HG633 router. If for example you need to forward ports 2001 to 2003, as these are contiguous, so you can add them to the same application like this:- However, if you are using port translation with this, there is a slightly weird behaviour that certainly affects the HG633 running firmware V2.00 (I can't be sure about other firmware versions or other routers). In this example 2001 to 2003 are being translated internally to 91 through to 93:- When the external ports are tested, at least the first internal port (91) must be open on the device being forwarded to, otherwise will all remain closed. If only 91 is open internally & each of the external ports are tested one by one, then ports will all report as open. Obviously if something has connected to 91, then none of the external ports will report open, as 91 is busy. Therefore when trying to connect to any external port in the range, the router will try to open the first free internal port in the range, you cannot say that 2001 will always map to 91 or that 2002 maps to 92 & 2003 to 93. If you need exact mapping of 2001 to 91 etc, then create three separate applications one for each port translation. Continued on next page. Page 19 of 33

20 Non-contiguous port range If the two ports 8000 & 8500 are to be forwarded, as they are not contiguous they cannot use the same application. When creating the application, do not enter the port 8000 and then click New to add 8500, this will not work. If the application is configured like this, it will not work:- Continued on next page. Page 20 of 33

21 What is required is to add one application per port, this example will require two applications added like this:- They both now appear in the list of available applications thus:- Now use them in the port mapping rules accordingly, forwarding them both to the same internal host:- Page 21 of 33

22 Port Translation (where a port is intercepted by the router, e.g. port 80) This mainly affects the Huawei HG633/HG635 routers. It does not affect the DSL If a PC for example is hosting a web server, connected to the local network, it will use TCP ports 80 and/or 443. When trying to access either of these ports from the internet, normal port forwarding will fail. The web server is expecting an incoming connection on port 80 or 443.If a connection attempt is made from the internet to: where a.b.c.d is the external or WAN IP address of the router, it will fail. This is because the router's management system is also a web server & the connection attempt (as it is targeting port 80), will be intercepted by the router's web server. This is why the router's login screen might be seen & the desired connection never reaches the web server on the PC. What will need to be done to get this to work is choose an unused TCP port number above 1024 (for example port 8888). Then create a new port forwarding rule and translate the external port 8888 to the internal port 80 (called PAT or Port Address Translation) and point this to the PC running the web server within the port mapping rule (not shown here). Create an application in the HG633/HG635 like this:- Now test port 8888 via a port checking website & if open, then from the internet try a browser connection to: where again a.b.c.d is your router's WAN IP address or DDNS URL. Note the colon character ":" that separates the IP address from the port number. You will need to create another application to handle port 443 in the same way. Page 22 of 33

23 Windows Firewall settings The screenshots come from Windows 7, but the procedure almost identical on later versions of Windows. Always allow the server's main.exe file if possible, rather than the ports, because in some cases with if your reason to port forward was to an FTP server (as per my case study), you may not always have control over what ports are used. Go to:- Create a new inbound rule:- Click Next in the above screen, then on this next screen browse to the program's executable file. In the case of the FileZilla Server (as per my case study), allow the server application (not the interface to the server). Please see next page. Continued on next page. Page 23 of 33

24 Click Next, then on this screen tick Allow connection :- Then click next and on the next screen set as appropriate:- Continued on next page. Page 24 of 33

25 Click Next again, give it a unique name & click Complete :- It will now be displayed in the list of inbound rules under the name you allocated to it. Page 25 of 33

26 Test Locally The next thing is to test that the client when connected to the same subnet can access the device that is being forwarded to (e.g. an FTP Server as per my case study) & make sure it all works correctly. If all is OK, then setup the port forwarding on the router. Testing from internet Note: when testing, you must have your server software running (e.g. FTP or Minecraft server software etc). Otherwise the port will always be closed. Use a port checking website such as: or These websites must be accessed from a device connected to your router's local network. This allows them to obtain the router's WAN IP address. They then try to establish a new connection from their website to your router using the port you specified. This will have to run once for each port you are trying to use. This can only work on TCP ports, not UDP ports as they work differently to TCP & will always show up as closed, even if they work OK. Continued on next page. Page 26 of 33

27 Once that is OK finally test from a PC or phone that is not connected to your router's network (wired or wireless), but has access to the internet from another broadband connection or 3G or 4G etc. Note: most TalkTalk routers do not allow Loop Back access so you will need to access the device only from an external network when using the external internet address. You will not be able to access the external IP address from the internal IP address, when the external address is port forwarded to another local device. Most routers prevent Loop Back as an additional security measure. So if the device being forwarded to is and the device making the test is , this device will not be able to make a test to the router's WAN IP address. If you have a Smartphone temporarily disable the WiFi and turn on Mobile Data, which will enable you to test access to the device via your mobile phone network. Alternatively you could use a wireless hot spot. As far as this case study is concerned an FTP client called FTP Cafe was run on an Android phone via the 3G network. To test from a browser (if applicable) you must specify the port number e.g. port 81: DDNS Dynamic DNS provides a domain (URL web address) for your router's WAN IP address to allow remote access to your broadband router's local network, particularly important if you use port forwarding. The problem is, if you try & access the router's network by the WAN IP address directly, this changes from time to time. DDNS keeps track of the current IP address and if you just use the domain supplied by your DDNS provider. The domain will update itself via the DDNS protocol, when the WAN IP address on the router changes. DDNS will help you remotely access devices connected to your local router's wired or wireless connections, this could be PCs, DVR, webcam, camera system etc. However, this will also require port forwarding to have been correctly configured on the router as well. You will need to subscribe to a DDNS provider first. There are a number of free DDNS services available. Note: not all DDNS providers can be used on TalkTalk routers, for example No-IP can be used on a DSL-3750, 3780 & 3782, but not on an HG633. This is not a fault of NO-IP, but is down to some of the routers only supporting certain DDNS providers. Page 27 of 33

28 HG633 being used as a modem & double port forwarding This topic is complex & not for the faint hearted. It can be another way of using a second router as a Wi-Fi extender as well as being a way of getting around a problem where a 3rd party router was purchased that did not include an integral ADSL/VDSL modem. This has been fully tested via an HG633 connected to a DSL-3780 router, using DDNS on the HG633. The same has also been tried successfully from an HG633 to a Netgear R7000 router which did not have an integral modem. Using an HG633 just for it's ADSL/VDSL modem is a contradiction in therm though, because it cannot be put into a modem only mode. Any router that supports true modem only mode will take the WAN IP address assigned by the network & forward this on to the router (Router B) connected to it (via that router's Fibre or EWAN port). This would mean that Router B now has the same WAN IP address assigned to it, as the modem connected to the network. The HG633 working in router mode (this is the default configuration) will supply an address on the network to Router B, which will become that router's WAN IP address. In the scenario under test, Router B is a D-Link DSL-3780 an ethernet cable links the 3780's Fibre port to a LAN port on the HG633. There is no need to make any configuration changes to the DSL3780 other then adding a port forwarding rule (see later). However, the two routers must be on totally different IP networks to each other for this to work. The HG633 & most other domestic routers come as standard with an IP address of , hence they both use the network. It does not matter which you change, but as all of the local devices would be connected to the DSL-3780, I would recommend leaving that on the network and change the HG633 to use (for example) the network. Now logic would say to set the HG633's management IP address to , but there seems to be a bug in the HG633. Although it will accept that IP address, Router B may not work correctly when connected. If the HG633s management address is set to say , then it does work fine. Log on to the HG633 and go to:home Network > LAN Interface > LAN Interface Settings:- Once done, you must reboot the HG633. Page 28 of 33

29 Setting this address will automatically set the DHCP IP address range to go from to Once initially connected, check to see the 3780 router appears in the HG633's LAN Devices (via the Home Network tab), it will initially be identified by its MAC address via an ethernet connection & be categorised as an Unrecognised device & will be in grey. Click Edit against it, give it a suitable name & set its Device Type to something like Desktop Computer (there isn't a category of Router ):- To keep things neat & tidy on the HG633, it is worthwhile reserving an IP address for the DSL3780 via the DHCP Reservation. I have used for it, this can be set from:home Network > LAN Interface > DHCP Reservation Page 29 of 33

30 So this is what we have, the WAN IP address allocated to the HG633 of is purely an example:- HG633 internet status DSL-3780 internet status Routing between routers It would seem reasonable that you might need to add a static route from the HG633 to the network that hangs off the 3780, as well as a route back from the DSL-3780 to the HG633, but neither is required. This may be different on other routers. Limitations To do this properly I would always recommend a pair of commercial routers, due to there greater flexibility & configuration options, but the cost of which is probably far too great to make it viable. Therefore there are some limitations that you have to live with. These mainly refer to the combination of HG633 & DSL-3780 used in this test scenario. Of course, if you use different routers to the ones I tested, you may not suffer these limitations. You cannot really compare free ISP routers to advanced 3rd party routers, this scenario is not really what the free ISP ones are designed to cope with. Despite adding static, or dynamic routes between the & the networks, it was not possible to route between these subnets. Neither router gives a display of the current routing table, so it is difficult to troubleshoot this. The firewalls on the routers may block web access to manage the routers from anywhere remotely, but I cannot prove this. Currently a device must be physically connected to the HG633 via LAN or Wi-Fi to manage it. The same goes for managing the DSL-3780 from the other subnet. However, this was not the case when a Netgear R7000 was used as Router B. So the routing incompatibility or firewall is not the case here, with either router being able to be managed from either subnet. Page 30 of 33

31 Double Port forwarding If you wish to forward some ports to a device hanging off router B, you will need to employ double port forwarding, which is more complex than standard port forwarding. What this is involves basically is that you forward the ports required in the HG633, but not direct to the local device, as that will not be seen by the HG633, but to Router B, which will appear in the list of LAN Devices. Then in Router B, you do more port forwarding to go from the incoming Fibre or EWAN port (i.e. the internet) to the local device. So if you wanted to forward TCP port 21 to an FTP server locally connected to Router B, it might have an IP address of On the HG633 you would use something like:- The port mapping rule for it might look like this:- Continued on next page. Page 31 of 33

32 Then on Router B, you would setup something like this making sure that the interface that the ports are due to be arriving on from the HG633. If using a DSL-3780 router for example, the Interface would be set to the WAN interface. The Internal IP is set to , as that is the IP address of the PC hosting the FTP server application:- Of course what this screen will look like, is dependant on the make/model of router that is being used as Router B. DDNS & the HG633 when the HG633 is used in this manner, the DDNS configuration should be applied to the HG633 only, but again other routers may be different. You can use a free DDNS provider such as DuckDDNS for this if you wish with the HG633. If you use another router in place of the HG633, they may support other free DDNS providers (of course you can always use a paid for provider as an alternative, they are generally more widely supported across router makes & models). Double port forwarding with HG633 as slave or extender With the HG633 as the extender or slave router, double port forwarding will not work. This is because there is no way to change the interface that the forwarding rules listen on. It will still be listening on the broadband/internet interface, not the LAN port. Page 32 of 33

33 Apple MACs running Windows applications Apple MACs for sometime now have been able to run Windows applications via the Parallels Desktop software: There are problems running certain Windows applications (e.g. Minecraft server), because these applications may not open the ports correctly when using Parallels. This will mean that port forwarding might not work, unless this is done correctly. Problems with the device you are forwarding to There can be many reasons why port forwarding fails, that are nothing to do with the configuration of the router. Some of these include:static IP addressing Where the device has a static IP address, make sure that both the default gateway and the DNS server are set to the router's IP address (normally ). Default gateway wrong The device's network setting must have the default gateway setting configured to the same IP address as the router. Page 33 of 33