First off, thanks in advance for the assistance! I am at a total loss. I feel like I am missing some small detail that lets this work properly and I've searched everwhere and watched every YT video I could find on the topic. This has been plaguing me for literally MONTHS now!
I can forward ports from WAN to LAN IPs all day long on IPv4. I can accept ports from WAN directly on the router (docker container published ports) on IPv6 and those work fine, too. However, the moment I attempt to reach an open port on the router on IPv4, no dice.
Since I can forward the exact same ports to an IP within the LAN (Port Forward), this would indicate this is not an ISP problem (AT&T 2.5GBit Fiber using IP Passthrough). I just can't get a normal accept directly on the router via IPv4 to work (Traffic Rules).
I have a docker container on the OWRT router running and publishing port 8443 (HTTPS). I can see this on IPv4 and IPv6 internally just fine on the LAN directly (port published correctly). I can see it outside across the WAN via IPv6 just fine (port accepted on IPv6 correctly). However, if only IPv4 is available to the external device as is the case with some ISPs, it can't reach 8443 via the WAN (long timeout, apparently dropped). Indeed, if I change the Rule to IPv4 only, no one can reach 8443 on the router via WAN anymore at all.
Masquerading is enabled on both IPv4 and IPv6; I'm not sure why one is working and the other isn't when both are in the accept rule.
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone 'lan'
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
list network 'OpenVPN'
config zone 'wan'
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option mtu_fix '1'
option masq '1'
option masq6 '1'
list network 'wan'
list network 'wan6'
list network 'wanb'
list network 'wanb6'
config zone 'docker'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option name 'docker'
list network 'docker'
config forwarding
option src 'lan'
option dest 'wan'
config forwarding
option src 'docker'
option dest 'lan'
config forwarding
option src 'lan'
option dest 'docker'
config forwarding
option src 'docker'
option dest 'wan'
config rule
option name 'Allow-inbound-8443'
option dest_port '8443'
option target 'ACCEPT'
option src 'wan'
Can anyone tell me why I can reach the docker container on the router over IPv6 but not IPv4? Again, if I configure as a redirect to a different server on my LAN, like this, it works:
config redirect
option target 'DNAT'
option name 'Forward-inbound-8443'
option family 'ipv4'
option src 'wan'
option src_dport '8443'
option dest 'lan'
option dest_ip '10.10.0.2'
option dest_port '8443'
It even works if I point from a different WAN port to the correct port on the LAN side like this (the router's LAN IP is 10.10.0.1), but this means a different port whether I'm inside or outside the network and is not suitable (plus the unnecessary flip to the LAN zone):
config redirect
option target 'DNAT'
option name 'Forward-8444-inbound-8443'
option family 'ipv4'
option src 'wan'
option src_dport '8444'
option dest 'lan'
option dest_ip '10.10.0.1'
option dest_port '8443'
What am I missing here? Why is OWRT not accepting specific port IPv4 traffic directly from the WAN side when it should be perfectly matching the Rule? With my luck, it's a simple checkbox somewhere. haha I'm presently accepting any and all theories anyone might have at this point.