Hub 2 Port forwarding not working

[#1]

Hi,
I have been trying to open ports so I can remotely connect to my home pc. I tried opening a few combinations of ports in various ranges (22, 11000-11002, 20000-20005) for applications like wireguard, ssh, even iperf, but nothing works. I can access all services from within the LAN. I have also used canyouseeme.org, and it shows all ports are closed. I even tried putting the computer in the DMZ, which did not help, and also tried restarting the router a few times. Could anyone help with this issue? Many thanks!

[#2]

what does your port forwarding rule look like? Have you set the IP to be static in the hub interface on the device your trying to connect to?

I have PF for SSH and my PS5 all working fine.

[#3]

@stavros1 

When the Hub Two receives an inbound port forward connection you will see an entry similar to this in the event log, the example is for UDP. event log is location

Hub Two Home >Advanced settings >Technical log >Event log

07:54:19, 12 Mar. FWL Port Forward Server(192.168.1.64) UDP 53262 accepted a new connection from 85.255.236.88

The associated port forward rule for this connection.

HTH

[#4]

What is your home PC running? Windows? Is the network connection within the Windows OS set to 'Private', rather than 'Public'? If we're talking a *nix machine, then are you confident you're not inadvertently firewalling something?

[#5]

Hi dvorak,

The device IP is set to static ("Always use this IP address: Yes").

All non-UPnP port forwards are set to this device:

[#6]

Hello Dan_the_Van,

I can see the connection attempts in the event log. I have tried SSH again, and the log contains multiple entries of:

FWL Port Forward Server(<LAN IP>) TCP 22 accepted a new connection from <WAN IP of ssh client>

But the connection times out when the client is trying to connect from outside the LAN (mobile data). As soon as I connect to the hub wifi and use the LAN IP/hostname, the connection works fine.

iperf has the same behaviour, so it's not an authentication issue with SSH.

[#7]

Hello bobpullen,

The pc is running Linux. I checked iptables, all chains except docker-specific ones have default policy ACCEPT. No service-specific rules exist, and there are no relevant DROP rules - only 2 in chain DOCKER which does not have any packets going to it.

[#8]

The log shows that the port forwarding is working,. It looks like the client is not accepting the connection. Have you checked that the client is configured to accept SSH from outside the LAN subnet ?

[#9 · Accepted solution]

@stavros1 

Using a raspberry pi I have tested ssh on port 22 and I get a successful connection

16:06:31, 14 Mar. FWL Port Forward Server(<pi-w2 IP) TCP 22 accepted a new connection from <vodafone mobile data IP>

16:03:55, 14 Mar. FWL Port Forward Server(pi-w2 IP) TCP 22 accepted a new connection from 52.202.215.126 

52.202.215.126 is can you see me IP

The fact the event log reports the connection but can you see me reports as closed there must be something blocking (firewall) external connections to the device running ssh

Edit: have you considered hosting a VPN server as that provide a securer method for remote connections. I use Wireguard

[#10]

Hi Dan_the_Van,

Turns out, an existing outbound Wireguard connection was the issue, that was set to route all traffic through it. I am not an expert in networking, but I believe that incoming packets were routed to the pc just fine, and then wrongly routed out through the VPN. This had not crossed my mind as LAN connections worked while the config file has the line "AllowedIPs = 0.0.0.0/0". I assumed that routing must be working fine, but no.

I have fixed this issue by adding these lines to the wireguard config:

PostUp = ip rule add from <LAN IP of pc> table 128
PostUp = ip route add table 128 to 192.168.1.0/24 dev eth0
PostUp = ip route add table 128 default via 192.168.1.254

PreDown = ip route del table 128 to 192.168.1.0/24 dev eth0
PreDown = ip route del table 128 default via 192.168.1.254
PreDown = ip rule del from <LAN IP of pc> table 128

This was taken from https://askubuntu.com/questions/991004/iptable-rule-to-route-only-outbound-traffic-through-vpn/99114...

For completeness, 192.168.1.0/24 is the Hub's subnet, and 192.168.1.254 is the gateway IP. LAN IP of pc is eg. 192.168.1.x

In reply to your VPN server suggestion, this is my goal actually. But for troubleshooting I opted for iperf and SSH, as wireguard fails silently and would make it harder to investigate the problem.

[#11]

Pleased all good now

I have Wireguard VPN running on a raspberry pi 2 using the instructions found here https://www.pivpn.io/ 

[#12]

Wireguard on a RPI is a very reliable VPN server. I have been running once continuously for a number of years without any issues.