Port Forwarding with ISP Router as Bridge

Hi,
I'm trying to make port forwarding work with my new setup. ISP Tenda GPon is set as bridge (dhcp, wifi disabled), with static ip 192.168.100.1. It's connected to openwrt router through WAN (Lan1 on Tenda to Wan on Openwrt - 192.168.100.2). This was done from a guide here, for the purpose to access the ISP router interface. On Tenda's DMZ setting, I also added 192.168.100.2. Openwrt is the dhcp server with its usual 192.168.1.1 lan

I'm testing with RDP port 3389, did the usual port-forwarding setup on Openwert but nothing was coming up when checking with open-port-check-tool online.

So, I also enabled port-forwarding on Tenda for every remote IP (0.0.0.0) port 3389 to 192.168.100.2 port 3389 for TCP. Still it is not showing up as opened port.

If you have any idea or need more config let me know please. I have to say that I never tested port-forwarding alone with the Tenda Gpon router not in bridge mode (when I didn't have openwrt yet), but I would guess if they wanted to prevent this they would have disabled that option from their own router (they have disabled other options from the menu, like flashing firmware, saving config, WAN settings etc.)

A 192.168 IP on the OpenWRT device's WAN port doesn't sound very public ?

I guess its ironic, but i don't get it so you are welcomed to be more direct. That's just an ip for me to access the ISP router on my lan, following a guide on this forum (how to access the ISP router from same WAN cable connection, something like that). It had to be different from 192.168.1.1/24 subnet so i went 192.168.100.1/24

Misunderstood, but the question remains, is there a public IP on the WAN port ?

Did you try to move RDP to a different port (I believe 3389 is the default?), or simply open ssh access directly to the router, just for 2 sec, to verify you're actually getting through?

Finally how are you testing this ?

If your ONT is truly bridge, OpenWrt should be able to DHCP a public IP into its wan interface.

DMZ mode forwards all ports which can also work but some ISPs use CGNAT (the wan IP of the ONT is NATdn not public) or they have a firewall which will block any incoming traffic.

1 Like

So on the pppoe-wan interface the IP is IPv4: 10.27.xxx.xxx/32 NOT set by me, of course.
On the Interface created to access ISP router, its 192.168.100.2

Isn't 10.27 CGNAT ?

Its true brdige mode cause I asked them and they set it that way. On Tenda:

Even though it is bridged, it appears that your ISP is providing only a NAT'd address. Therefore, you'll need to ask your ISP if there is an option for you to be issued a public IP. This may or may not be possible, and may or may not involve extra costs or changes to your ISP service details.

First time I even hear about CGNAT lol. So in layman's terms, port forwarding will not work. right?

On ipv4 it won't, but you can always ask them, or try to bypass using applications like tailscale or zerotier.

Oh well I'm not bothering at this point. IF they don't upgrade my location to 1Gbps like they promised me I will move to another provider, and maybe they will assign me public IP, whatever.

So 10.27.xxx.xxx/32 is my CGNAT IP, but 79.106.xxx.xxx (as in what's my ip check) is my external/public IP?

You're sharing it with other users, but yes, that's the IP sites see when you access them.

What if i have a VPN with dedicated IP (I still do for a couple of days). I can easily set it up with OpenVPN (thought suffer limited bandwidth of course). But in theory, could it work this way or it still won't matter?

If the endpoint have a public IP in some way mapped to your user, and allows inbound connections, it should work.

they assigned me 193.149.xx.xxx so public range i guess, but since whole thing looks not efficient i will let it go

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.