Port forwarding doesn't work on TL-WR940N

Installing and Using OpenWrt Network and Wireless Configuration
1

Hi all,

I'm trying to get my TL-WR940N running with activated port forwarding. But it doesn't work.
My actual configuration is:

  • List item WAN: 10.42.25.XXX
  • List item LAN: 192.168.0.1

Port forwarding for the defined port 8080 is configured to internal IP 192.168.0.100 port 80 - but it doesn't work.
If I directly connect to the internal network and open 192.168.0.100:80 in my web browser -> it works.
If I connect to the external (WAN) network and open 10.42.25.XXX:8080 in my web browser -> I get an timeout.

Has anyone an idea, why it doesn't work?
I have reset the router to default and only configured the WAN, LAN and Port Forwarding.

Thanks a lot!

2

Just one interessting information: if I'm connected to the internal LAN, I can open the web page from my device by using the 10.42.25.XXX:8080 address ...

My network adapter for the internal network is configured to DHCP.

3
1 Like
4

Yes, you are right. The IP 10.42.25.XXX belongs to a private LAN.
But I have a private LAN on the WAN side and also a private LAN on the LAN side. I'm not connected to the internet!

5

Please post the output of:
iptables-save -c -t nat
in preformatted text (the </> button).

1 Like
6 
# Generated by iptables-save v1.6.2 on Thu Feb 27 22:11:53 2020
*nat
:PREROUTING ACCEPT [289:24669]
:INPUT ACCEPT [62:3445]
:OUTPUT ACCEPT [168:11032]
:POSTROUTING ACCEPT [290:15912]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
[289:24669] -A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
[195:16990] -A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
[290:15912] -A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j ostrouting_rule
[122:4880] -A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
[122:4880] -A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j ostrouting_lan_rule
[195:16990] -A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
[0:0] -A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
[0:0] -A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
[0:0] -A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
[0:0] -A zone_wan_prerouting -p tcp -m tcp --dport 8080 -m comment --comment "!fw3: PLC_WEB" -j DNAT --to-destination 192.168.0.100:80
[0:0] -A zone_wan_prerouting -p udp -m udp --dport 102 -m comment --comment "!fw3: PLC" -j DNAT --to-destination 192.168.0.100:102
COMMIT
# Completed on Thu Feb 27 22:11:53 2020
7

The rule is there, but there are no hits.
Make sure that you are indeed connecting from wan and that you are using the right protocol and port.

1 Like
8

Now I'm connected by using the WAN port:

# Generated by iptables-save v1.6.2 on Thu Feb 27 22:22:27 2020
*nat
:PREROUTING ACCEPT [98:10623]
:INPUT ACCEPT [38:2016]
:OUTPUT ACCEPT [12:794]
:POSTROUTING ACCEPT [17:994]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
[98:10623] -A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
[14:1022] -A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
[17:994] -A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
[5:200] -A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
[5:200] -A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
[14:1022] -A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
[0:0] -A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
[0:0] -A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
[0:0] -A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
[0:0] -A zone_wan_prerouting -p tcp -m tcp --dport 8080 -m comment --comment "!fw3: PLC_WEB" -j DNAT --to-destination 192.168.0.100:80
[0:0] -A zone_wan_prerouting -p udp -m udp --dport 102 -m comment --comment "!fw3: PLC" -j DNAT --to-destination 192.168.0.100:102
COMMIT
# Completed on Thu Feb 27 22:22:27 2020
9

No difference, hits are still 0.

1 Like
10

Sorry, I don't understand what you mean ...

11

These numbers at the beginning of the line show the packets:bytes for each rule. Zero means that nothing matched this rule.

You need to verify that you are trying to connect to the wan interface, correct protocol (tcp) and port (8080).

1 Like
12

I'm definitely connected to the WAN port and I try to open the page 10.42.25.232:8080 in my web browser.

13 
opkg update
opkg install tcpdump
tcpdump -evn -i any tcp port 8080
2 Likes
14

What makes me a bit nervous is, that I can connect to the IP 10.42.25.232:8080 when I'm connected to the LAN interface with the local address 192.168.0.150 ....

15

I think I found it. The wan zone is empty. Post uci export firewall to verify.

2 Likes
16 
package firewall

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option network 'lan'

config zone
        option name 'wan'
        option output 'ACCEPT'
        option masq '1'
        option mtu_fix '1'
        option input 'ACCEPT'
        option forward 'REJECT'
        option network 'wan wan6'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config include
        option path '/etc/firewall.user'

config redirect
        option target 'DNAT'
        option src 'wan'
        option dest 'lan'
        option proto 'tcp'
        option src_dport '8080'
        option dest_ip '192.168.0.100'
        option dest_port '80'
        option name 'PLC_WEB'

config redirect
        option target 'DNAT'
        option src 'wan'
        option dest 'lan'
        option dest_ip '192.168.0.100'
        option name 'PLC'
        option proto 'tcp'
        option src_dport '102'
        option dest_port '102'

config forwarding
        option dest 'wan'
        option src 'lan'
17

That is correct. What about uci show network.wan ?

18 
network.wan=interface
network.wan.ifname='eth0'
network.wan.proto='static'
network.wan.ipaddr='10.42.25.232'
network.wan.netmask='255.255.252.0'
network.wan.gateway='10.42.24.1'
network.wan.dns='10.42.24.1'
19

Looks good too, try to restart the firewall and post the output.
fw3 restart

1 Like
20 
Warning: Unable to locate ipset utility, disabling ipset support
 * Flushing IPv4 filter table
 * Flushing IPv4 nat table
 * Flushing IPv4 mangle table
 * Flushing IPv6 filter table
 * Flushing IPv6 mangle table
 * Flushing conntrack table ...
 * Populating IPv4 filter table
   * Rule 'Allow-DHCP-Renew'
   * Rule 'Allow-Ping'
   * Rule 'Allow-IGMP'
   * Rule 'Allow-IPSec-ESP'
   * Rule 'Allow-ISAKMP'
   * Redirect 'PLC_WEB'
   * Redirect 'PLC'
   * Forward 'lan' -> 'wan'
   * Zone 'lan'
   * Zone 'wan'
 * Populating IPv4 nat table
   * Redirect 'PLC_WEB'
   * Redirect 'PLC'
   * Zone 'lan'
   * Zone 'wan'
 * Populating IPv4 mangle table
   * Zone 'lan'
   * Zone 'wan'
 * Populating IPv6 filter table
   * Rule 'Allow-DHCPv6'
   * Rule 'Allow-MLD'
   * Rule 'Allow-ICMPv6-Input'
   * Rule 'Allow-ICMPv6-Forward'
   * Rule 'Allow-IPSec-ESP'
   * Rule 'Allow-ISAKMP'
   * Forward 'lan' -> 'wan'
   * Zone 'lan'
   * Zone 'wan'
 * Populating IPv6 mangle table
   * Zone 'lan'
   * Zone 'wan'
 * Set tcp_ecn to off
 * Set tcp_syncookies to on
 * Set tcp_window_scaling to on
 * Running script '/etc/firewall.user'