Port forwarding behind wireless router client for n00bz

Installing and Using OpenWrt
#1

Rather than go through the various config changes I've tried, I'd rather start with the desired configuration because I'm clearly lacking some basic conceptual understandings:

I have OpenWRT 19.07.4 installed on two devices.

The Linksys device is connected to the cable modem through the ethernet WAN port.

The Buffalo device is connected to the Linksys device as a WiFi client.

My preference is for the Buffalo device to manage its network as a router rather than simply bridging the networks.

Using the LUCI GUI, what steps should I be taking?

When I want to configure port forwarding from behind the Buffalo device, again using the LUCI GUI, what steps should I be taking?

Note that the client I am using to test port forwarding is Transmission from Linux Mint (and, no, this not for illegal file sharing).

I realize this all is likely very basic setup steps, but the last hour or so I have only discovered posts that involve more complex configurations than I am seeking or involve configuring non-OpenWRT hardware (i.e., I haven 't discovered effective search terms or don't understand what I'm reading).

#2

2 Likes
#3

While those articles are helpful, they aren't quite getting me to a port forwarding configuration.

It isn't clear to me how, exactly, static routes are intended to be configured, which my understanding is that static routes are used when there is a router behind the network gateway, but maybe I don't understand this correctly.

At the moment, I have configured:

The Buffalo device with a static IP address on WWAN and masquerading is disabled. The LAN interface network gateway and custom DNS are set to the IP address of the Linksys device.

The Linksys device with a static route configured with the target network set to the Buffalo LAN network and the IPv4 gateway set to the Buffalo static IP address.

No matter what I set in the port forwarding, Transmission always reports the port is closed. I also disabled port forwarding rule and enabled UPnP and NAT-PMP for testing and the only device that reports a port being open is the Buffalo device.

#4

Using static routes instead of NAT, the upstream router (Linksys) holds a static route to the downstream router's LAN (Buffalo) using that router as a gateway. This tells that router's kernel that for example 192.168.3.0/24 is not to use the overall default gateway, but forward it back to the Buffalo router at 192.168.2.2 for example. (This works not only for the Linksys router itself, but also for any device on the 192.168.2.0 network, since the Linksys router is their default gateway. Those devices think that 192.168.3.10 is somewhere on the Internet (default) so they send the packet to 192.168.2.1. When the Linysys router sees a packet for 192.168.3.0 it will forward it to the Buffalo.)

Once that is working-- you can be on either LAN and reach the other LAN-- then you would configure the Linksys to forward ports from the Internet to an IP on the Buffalo's LAN, and it will just work without any additional configuration of the Buffalo.

The typical routed client uses NAT on the client router, so the upstream router need not be aware of the downstream router's LAN. If you run it that way you have to configure a forward from the Internet through both routers. The upstream forwards to the downstream router on its LAN, then the downstream Buffalo would forward again from its WAN to the IP of the LAN server.

#5

Should I have created any NAT rules to make port forwarding work properly? I feel like I have tried both of those solutions and Transmission continues to tell me the port is closed (I restart both wired network and Transmission each time I make a change). Configuring the forwarding rules with both devices and NAT enabled is what I initially attempted to make work.

#6

First of all you didn't specify that you want to use static routes, nor did you clarify where the NAT/port forwarding will be configured. I presumed that you want a double NAT.
Since you want just routing, the static and a redirect on the Linksys are all you need.
If it still doesn't work, verify with ping from Linksys that you can reach the Mint and post iptables-save -c -t nat

1 Like
#7

Actually, the static route isn't a requirement. I had initially started out with the recommended configuration in the linked article for WiFi client, but I hadn't been able to get port forwarding to work, so I thought I needed static routes, and that is why I had tried that. I just reconfigured for double NAT and used the configuration recommended by @mk24 and getting the same results as before with Transmission telling me the port is closed.

I'm feeling like there is something else somewhere I've either misconfigured or not configured.

#8

Yes, post the iptables-save -c -t nat to verify that, after you try to reach the port.

#9

Do you have a public IP, or CGNAT? Does your ISP allow incoming connections?

Try with a different protocol like ssh.

#10

I pinged from an outside device without any issue.

This issue is now resolved, and I'm not sure why. Best I can figure is that I had some incomplete configuration when I was first configuring, but using double NAT with forwarding now works fine.

I think the only changed from the original configuration is that I assigned the Buffalo device a static IP and previously it was dynamic, but I can't imagine why that would change anything.