Cudy WR3000P v1 won't open ports

Installing and Using OpenWrt
1

Hi Forum!
I am installed a new OpenWRT version to Cudy WR3000P (24.10.5) and I can't open ports neither from "Port Forwarding" nor "Traffic rules"
I have a static IP address from my ISP and before installing a new version it worked fine.
Ports: 25565, 51820

Π‘Π½ΠΈΠΌΠΎΠΊ экрана 2025-12-26 144319
Π‘Π½ΠΈΠΌΠΎΠΊ экрана 2025-12-26 144319931Γ—681 67.7 KB

Π‘Π½ΠΈΠΌΠΎΠΊ экрана 2025-12-26 144337
Π‘Π½ΠΈΠΌΠΎΠΊ экрана 2025-12-26 1443371118Γ—788 58.7 KB

By the way, I have UPnP IGD PCP installed, can it cause problems with firewall?

2

Please, share the config files, not screenshots in Russian.

1 Like
3

Remove destination zone in port forward, minecraft supports upnp, the forward would not even be needed.

4

Sorry. There is a Firewall config:


config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option src 'wan'
	option dest 'lan'
	option name 'Wireguard'
	list proto 'udp'
	option target 'ACCEPT'
	option family 'ipv4'
	option dest_port '51820'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'VPN'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option masq '1'
	option mtu_fix '1'
	list network 'JessyaWireguard'

config forwarding
	option src 'VPN'
	option dest 'lan'

config forwarding
	option src 'VPN'
	option dest 'wan'

config forwarding
	option src 'lan'
	option dest 'VPN'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'Minecraft-Laptop'
	option src 'wan'
	option src_dport '25565'
	option dest_ip '192.168.1.10'
	option dest_port '25565'
5

Sadly but newer versions of Minecraft doesn't do upnp by yourself. I creating a game and the port still unreachable until I open the port manually, maybe upnp was misconfigured. It was before installing a new version of OpenWRT

6

I asked my ISP about closed ports, but they doesn't see any problem on their side. All ports are opened

7

How are you verifying they're closed ?

Tried tcpdump:ing traffic on those ports?

Tried https://www.grc.com/shieldsup ?

8

If I enable a log from WAN, i can see this messages:
Fri Dec 26 15:16:36 2025 kern.warn kernel: [48500.728879] reject wan in: IN=pppoe-wan OUT= MAC= SRC=(the other PC with diffrenet ISP) DST=(my router) LEN=60 TOS=0x10 PREC=0x60 TTL=119 ID=46944 DF PROTO=TCP SPT=59424 DPT=51820 WINDOW=65535 RES=0x00 SYN URGP=0

9

Shouldn't your WG rule allow access to the VPN fw zone, not lan?

10

I have changed now to VPN fw zone, no effects
But before updating, the fw rule was allowed to "this device" and it worked fine

11

So.... am I right that the firewall blocks ports because he doesn't see the rules?

12

Post your network file too.

13 

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option packet_steering '2'
	option steering_flows '128'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'
	option ipv6 '0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ipv6 '0'

config interface 'wan'
	option device 'wan'
	option proto 'pppoe'
	option username '1'
	option password '1'
	option ipv6 '0'
	option delegate '0'

config device
	option name 'wan'
	option macaddr '80:AF:CA:C0:58:20'
	option ipv6 '0'

config interface 'JessyaWireguard'
	option proto 'wireguard'
	option private_key '1'
	option listen_port '51820'
	list addresses '192.168.2.1/24'

config wireguard_JessyaWireguard
	option description 'd3nteoomph'
	option public_key 'R1'
	option private_key 'S1'
	option preshared_key 'H1'
	option route_allowed_ips '1'
	option endpoint_host '1'
	option endpoint_port '51820'
	option persistent_keepalive '25'
	list allowed_ips '192.168.2.2/32'

config wireguard_JessyaWireguard
	option description 'jessya-phone'
	option public_key 'H1'
	option private_key 'A1'
	option route_allowed_ips '1'
	option endpoint_host '11'
	list allowed_ips '192.168.2.3/32'
	option preshared_key 'l1'
14

The firewall rule to allow wire ward connections is wrong, because the destination is not LAN, it's the router itself.

15

My problem was solved. I use "Zapret" and its configuration was wrong, which caused that problem. Sorry
Thanks all for helping!

16

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.