LAN to LAN port forwarding

My setup is that all traffic with src port 32976 TCP should be redirected to lan ip 192.168.0.50 on port 32976 TCP. The src device can be any device in my lan or from an external network (wan). In the default tp-link firmware, this worked fine.

In OpenWRT, if the src device is from an external network, it works fine but if the src device is from my lan, it doesn't get redirected. Below is what I did to get the wan side working.

config redirect
        option target 'DNAT'
        option src 'wan'
        option dest 'lan'
        option proto 'tcp'
        option src_dport '32976'
        option dest_ip '192.168.0.50'
        option dest_port '32976'
        option name 'test1'

For the lan side, I tried creating a new redirection with everything the same except src is 'lan' but it still doesn't work. Any suggestion on how to solve this issue?

Traffic from LAN to LAN in a subnet is switched by its internal ethernet switch, it won't even hit CPU.

2 Likes

In the wan to lan case: the device will attempt to connect to my public ip at 32976 and it will get redirected to ip 192.168.0.50 with port 32976

In the lan to lan case: the device will attempt to connect to my public ip at 32976 and it should get redirected to ip 192.168.0.50 with port 32976

I am aware that I can type in 192.168.0.50 to get to the device directly in the lan to lan case but that would require me to keep swapping around two IPs in the application depending on whether the laptop is in my internal network or an external one.

In the default tp-link firware of the router, this worked fine when I forwarded the port (it had src port, dest port and dest ip). This should be doable in openWRT with way more options available.

br_netfilter and net.bridge.bridge-nf-call-iptables should work for this. See https://ebtables.netfilter.org/br_fw_ia/br_fw_ia.html

I see. So it is not switched internally.
Did you enable NAT Loopback?

4 Likes

Local DNS also provides a “clean” solution to this general scenario. My public DNS for mail.example.com resolves to a public IP, but my internal DNS resolves it to an internal IP.

4 Likes

Yes I have it enabled. It is not working.

That is not an option in my case. The application I am using doesn't use a standard public DNS or dynamic DNS to resolve the public IP.

Hmm..

You may try tcpdump to debug.
Install it on your router and run tcpdump -n -i br-lan tcp port 32976 then retry your connection.

What OpenWrt version are you using?

OpenWrt 18.06.2 r7676-cddd7b4c77.

Below is what I get from the tcpdump. I replaced my public IP with MY_PUBLIC_IP.

01:44:50.650578 IP 192.168.0.90.57857 > MY_PUBLIC_IP.32976: Flags [S], seq 418888024, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
01:44:50.650766 IP MY_PUBLIC_IP.32976 > 192.168.0.90.57857: Flags [R.], seq 0, ack 418888025, win 0, length 0
01:44:51.152230 IP 192.168.0.90.57857 > MY_PUBLIC_IP.32976: Flags [S], seq 418888024, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
01:44:51.152430 IP MY_PUBLIC_IP.32976 > 192.168.0.90.57857: Flags [R.], seq 0, ack 1, win 0, length 0
01:44:51.655075 IP 192.168.0.90.57857 > MY_PUBLIC_IP.32976: Flags [S], seq 418888024, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
01:44:51.655269 IP MY_PUBLIC_IP.32976 > 192.168.0.90.57857: Flags [R.], seq 0, ack 1, win 0, length 0

Above is in case I use the lan side. In the wan side, I get the traffic between my external public ip and 192.168.0.50:32976.

EXT_PUBLIC_IP.65290 > 192.168.0.50.32976
192.168.0.50.32976 > EXT_PUBLIC_IP.65290

You got an RST/ACK from your router itself. The DNAT rule is not working at all.

Yes but in the case I connect from an external device, the DNAT rule works!

192.168.0.90 is a device in my internal network trying to connect to the public IP at port 32976. It should get redirected to 192.168.0.50:32976 but it is not.

Please post here the output of the following command:

iptables -t nat -L -vn

Please use "Preformatted text </>" for logs, scripts, configs and general console output.
grafik