Forwarded port disappears after a some time (MODBUS, port 502)

Installing and Using OpenWrt
1

Hey guys,
I have a problem with my OpenWRT configuration. I used the port forwarding feature for Huawei's inverter to connect to Modbus (from IP). I am connected as a client using OpenWRT to inverter's WiFi but after some time the forwarded port (502) disappears and is no longer visible from the external IP from the OpenWRT router. When I restart the router I get the port back for a while.

My router: D-Link DWR-116 A1/A2, OpenWrt 19.07.8.

The inverter's configuration:

  • gateway: 192.168.200.1,
  • DHCP.
**root@XYZ:~# cat /etc/config/firewall**

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config include
        option path '/etc/firewall.user'

config zone
        option name 'solarnik'
        list network 'solar'
        option input 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'
        option output 'ACCEPT'

config forwarding
        option dest 'lan'
        option src 'solarnik'

config forwarding
        option dest 'solarnik'
        option src 'lan'

config redirect
        option dest_port '502'
        option name 'Forward_NOW'
        option src_dport '502'
        option target 'DNAT'
        option dest 'lan'
        option src 'lan'
        option dest_ip '192.168.200.1'

**root@XYZ:~# /etc/init.d/firewall restart**
Warning: Unable to locate ipset utility, disabling ipset support
Warning: Section @zone[1] (wan) cannot resolve device of network 'wan'
Warning: Section @redirect[0] (Forward_NOW) does not specify a protocol, assuming TCP+UDP
Warning: Section @zone[1] (wan) has no device, network, subnet or extra options
 * Flushing IPv4 filter table
 * Flushing IPv4 nat table
 * Flushing IPv4 mangle table
 * Flushing IPv6 filter table
 * Flushing IPv6 mangle table
 * Flushing conntrack table ...
 * Populating IPv4 filter table
   * Rule 'Allow-DHCP-Renew'
   * Rule 'Allow-Ping'
   * Rule 'Allow-IGMP'
   * Rule 'Allow-IPSec-ESP'
   * Rule 'Allow-ISAKMP'
   * Redirect 'Forward_NOW'
   * Forward 'lan' -> 'wan'
   * Forward 'solarnik' -> 'lan'
   * Forward 'lan' -> 'solarnik'
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'solarnik'
 * Populating IPv4 nat table
   * Redirect 'Forward_NOW'
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'solarnik'
 * Populating IPv4 mangle table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'solarnik'
 * Populating IPv6 filter table
   * Rule 'Allow-DHCPv6'
   * Rule 'Allow-MLD'
   * Rule 'Allow-ICMPv6-Input'
   * Rule 'Allow-ICMPv6-Forward'
   * Rule 'Allow-IPSec-ESP'
   * Rule 'Allow-ISAKMP'
   * Forward 'lan' -> 'wan'
   * Forward 'solarnik' -> 'lan'
   * Forward 'lan' -> 'solarnik'
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'solarnik'
 * Populating IPv6 mangle table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'solarnik'
 * Flushing conntrack: 192.168.200.100
 * Set tcp_ecn to off
 * Set tcp_syncookies to on
 * Set tcp_window_scaling to on
 * Running script '/etc/firewall.user'

I noticed two things too:
1a) When I still have the working port forwarding:
1a

1b) And when port forwarding is not working (port 502 is not available):
1b

2a) When I still have the working port forwarding:
2a

2b) And when port forwarding is not working (port 502 is not available):
2b

Thanks in advance!

2

From a first glance it seems that the wlan interface has lost its IP, which could explain the interruption of the port forward.
Post also the following to have a better idea.
uci export network; uci export wireless; uci export dhcp
remove any sensitive data, like passwords, mac, etc

1 Like
3

Ok, I did it.
There are some more inforrmation:

1) root@XYZ:~# uci export network
package network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd82:632c:80f6::/48'

config interface 'lan'
        option type 'bridge'
        option ifname 'eth0.1 eth0.2'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option gateway '10.6.0.5'
        option ipaddr '10.6.0.20'
        list dns '10.6.0.5'
        list dns '1.1.1.1'

config device 'lan_eth0_1_dev'
        option name 'eth0.1'
        option macaddr '6c:XX:XX:XX:XX:7e'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0 1 2 3 4 6t'

config interface 'solar'
        option proto 'dhcp'
        option defaultroute '0'
				
				
				
2) root@ZAJAC:~# uci export network
package network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd82:632c:80f6::/48'

config interface 'lan'
        option type 'bridge'
        option ifname 'eth0.1 eth0.2'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option gateway '10.6.0.5'
        option ipaddr '10.6.0.20'
        list dns '10.6.0.5'
        list dns '1.1.1.1'

config device 'lan_eth0_1_dev'
        option name 'eth0.1'
        option macaddr '6c:XX:XX:XX:XX:7e'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0 1 2 3 4 6t'

config interface 'solar'
        option proto 'dhcp'
        option defaultroute '0'



3) root@XYZ:~# uci export wireless
package wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option channel '11'
        option hwmode '11g'
        option path 'platform/10180000.wmac'
        option htmode 'HT20'
        option country 'PL'

config wifi-iface 'wifinet1'
        option device 'radio0'
        option mode 'ap'
        option network 'lan'
        option key 'KEYXXXXXXXXXXXXXXXXX'
        option ssid 'QXXXXXX'
        option encryption 'psk2+ccmp'

config wifi-iface 'wifinet2'
        option ssid 'SUN2000-HVXXXXXXXXX4'
        option device 'radio0'
        option mode 'sta'
        option key 'KEYXXXXXXXXX'
        option network 'solar'
        option encryption 'psk2'



4) root@XYZ:~# uci export dhcp
package dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'

config dhcp 'lan'
        option interface 'lan'
        option ignore '1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'
4

The signal of the wifi client is quite marginal, which means there might be packet loss which can lead to dhcp not being able to renew. Use static IP better.

5

Ok, I check this signal issue. But where can I enter the static IP in OpenWRT GUI as client WiFi?

6

Network/Interfaces click on edit button for the solar interface, change protocol from dhcp client to static.