Troubleshooting connections to gamer servers

Installing and Using OpenWrt
#1

Hello my setup is a inalabric router (3G-LTE) and it is getting throught an raspb3 via wireless, then connects the PC via cable.
Then I tried to forward ports but still server comunication error.

ubus call system board 

        "kernel": "5.4.137",
        "hostname": "OpenWrt",
        "system": "ARMv7 Processor rev 4 (v7l)",
        "model": "Raspberry Pi 3 Model B Plus Rev 1.3",
        "board_name": "raspberrypi,3-model-b-plus",
        "release": {
                "distribution": "OpenWrt",
                "version": "21.02.0-rc4",
                "revision": "r16256-2d5ee43dc6",
                "target": "bcm27xx/bcm2709",
                "description": "OpenWrt 21.02.0-rc4 r16256-2d5ee43dc6"

-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

root@OpenWrt:~# uci export network; uci export firewall
package network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd69:7e56:5748::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.2'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option gateway '192.168.1.234'
        option defaultroute '0'
        list dns '192.168.1.234'

config interface 'wwan'
        option proto 'dhcp'
        option device 'wlan0'

package firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'
        list network 'wwan'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Support-UDP-Traceroute'
        option src 'wan'
        option dest_port '33434:33689'
        option proto 'udp'
        option family 'ipv4'
        option target 'REJECT'
        option enabled '0'

config include
        option path '/etc/firewall.user'

config redirect
        option target 'DNAT'
        list proto 'tcp'
        option src 'wan'
        option src_dport '27015-27030'
        option dest 'lan'
        option dest_port '27015-27030'
        option name 'Rocket League'

config redirect
        option target 'DNAT'
        list proto 'tcp'
        option src 'wan'
        option src_dport '27036-27037'
        option dest 'lan'
        option dest_port '27036-27037'
        option name 'Rocket League'

config redirect
        option target 'DNAT'
        list proto 'udp'
        option src 'wan'
        option src_dport '4380'
        option dest 'lan'
        option dest_port '4380'
        option name 'Rocket League'

config redirect
        option target 'DNAT'
        list proto 'udp'
        option src 'wan'
        option src_dport '27000-27031'
        option dest 'lan'
        option dest_port '27000-27031'
        option name 'Rocket League'

config redirect
        option target 'DNAT'
        option src 'wan'
        option src_dport '27036'
        option dest 'lan'
        option dest_port '27036'
        list proto 'udp'
        option name 'Rocket League'

config redirect
        option target 'DNAT'
        list proto 'tcp'
        option src 'wan'
        option src_dport '80'
        option dest 'lan'
        option dest_port '80'
        option name 'Rocket League'

config redirect
        option target 'DNAT'
        list proto 'tcp'
        option src 'wan'
        option src_dport '443'
        option dest 'lan'
        option dest_port '443'
        option name 'Rocket League'

config redirect
        option target 'DNAT'
        option name 'Rocket League'
        list proto 'udp'
        option src 'wan'
        option src_dport '7000-9000'
        option dest 'lan'
        option dest_port '7000-9000'

-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

root@OpenWrt:~# head -n -0 /etc/firewall.user
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.
#iptables -P INPUT DROP
#iptables -A INPUT -p tcp –dport 443 -j ACCEPT
#iptables -A INPUT -p tcp –dport 80 -j ACCEPT
#iptables -A INPUT -p tcp –dport 27015-27030 -j ACCEPT
#iptables -A INPUT -p tcp –dport 27036-27037 -j ACCEPT
#iptables -A INPUT -p udp –dport 4380 -j ACCEPT
#iptables -A INPUT -p udp –dport 7000-9000 -j ACCEPT
#iptables -A INPUT -p udp –dport 27000-27031 -j ACCEPT
#iptables -A INPUT -p udp –dport 27036 -j ACCEPT


# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.

-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

root@OpenWrt:~# iptables-save -c -t nat
# Generated by iptables-save v1.8.7 on Tue Sep 14 02:28:52 2021
*nat
:PREROUTING ACCEPT [736:73459]
:INPUT ACCEPT [8:1262]
:OUTPUT ACCEPT [218:16271]
:POSTROUTING ACCEPT [22:1847]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
[736:73459] -A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
[731:72793] -A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
[5:666] -A PREROUTING -i wlan0 -m comment --comment "!fw3" -j zone_wan_prerouting
[777:51838] -A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
[20:1705] -A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
[755:49991] -A POSTROUTING -o wlan0 -m comment --comment "!fw3" -j zone_wan_postrouting
[20:1705] -A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
[731:72793] -A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
[755:49991] -A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
[755:49991] -A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
[5:666] -A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
[0:0] -A zone_wan_prerouting -p tcp -m tcp --dport 27015:27030 -m comment --comment "!fw3: Rocket League" -j REDIRECT --to-ports 27015-27030
[0:0] -A zone_wan_prerouting -p tcp -m tcp --dport 27036:27037 -m comment --comment "!fw3: Rocket League" -j REDIRECT --to-ports 27036-27037
[0:0] -A zone_wan_prerouting -p udp -m udp --dport 4380 -m comment --comment "!fw3: Rocket League" -j REDIRECT --to-ports 4380
[0:0] -A zone_wan_prerouting -p udp -m udp --dport 27000:27031 -m comment --comment "!fw3: Rocket League" -j REDIRECT --to-ports 27000-27031
[0:0] -A zone_wan_prerouting -p udp -m udp --dport 27036 -m comment --comment "!fw3: Rocket League" -j REDIRECT --to-ports 27036
[0:0] -A zone_wan_prerouting -p tcp -m tcp --dport 80 -m comment --comment "!fw3: Rocket League" -j REDIRECT --to-ports 80
[0:0] -A zone_wan_prerouting -p tcp -m tcp --dport 443 -m comment --comment "!fw3: Rocket League" -j REDIRECT --to-ports 443
[0:0] -A zone_wan_prerouting -p udp -m udp --dport 7000:9000 -m comment --comment "!fw3: Rocket League" -j REDIRECT --to-ports 7000-9000
COMMIT
# Completed on Tue Sep 14 02:28:52 2021

-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

root@OpenWrt:~# ip -4 addr ; ip -4 ro li tab all ; ip -4 ru
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
3: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP qlen 1000
    inet 192.168.8.150/24 brd 192.168.8.255 scope global wlan0
       valid_lft forever preferred_lft forever
4: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    inet 192.168.1.2/24 brd 192.168.1.255 scope global br-lan
       valid_lft forever preferred_lft forever
default via 192.168.8.10 dev wlan0  src 192.168.8.150
192.168.1.0/24 dev br-lan scope link  src 192.168.1.2
192.168.8.0/24 dev wlan0 scope link  src 192.168.8.150
broadcast 127.0.0.0 dev lo table local scope link  src 127.0.0.1
local 127.0.0.0/8 dev lo table local scope host  src 127.0.0.1
local 127.0.0.1 dev lo table local scope host  src 127.0.0.1
broadcast 127.255.255.255 dev lo table local scope link  src 127.0.0.1
broadcast 192.168.1.0 dev br-lan table local scope link  src 192.168.1.2
local 192.168.1.2 dev br-lan table local scope host  src 192.168.1.2
broadcast 192.168.1.255 dev br-lan table local scope link  src 192.168.1.2
broadcast 192.168.8.0 dev wlan0 table local scope link  src 192.168.8.150
local 192.168.8.150 dev wlan0 table local scope host  src 192.168.8.150
broadcast 192.168.8.255 dev wlan0 table local scope link  src 192.168.8.150
0:      from all lookup local
32766:  from all lookup main
32767:  from all lookup default
#2

You have two potential causes here -- only one of them is within your control.

  1. You appear to have a device upstream of your OpenWrt system that is acting as a router and supplying a NAT'd network. You need to configure that system in one of three ways to make it possible to port-forward to hosts behind your OpenWrt router. Therefore, on the upstream device, look for the following options
  • Bridge mode - this allows the modem to pass the IP address from the ISP to your OpenWrt router's WAN, thus making the OpenWrt router the only router in the network.
  • DMZ - if you cannot put the device in bridge mode, you may be able to set a DMZ. You'd specify the IP address that you see on the WAN of your OpenWrt system, and it would basically open all ports to the OpenWrt WAN, which allows your OpenWrt port forwards to work
  • Port forwarding - much like what you see on the OpenWrt router, you may be able to port forward from the modem > OpenWrt > Host/server. Like the DMZ, you'd specify the IP address on the WAN of your OpenWrt router.
  1. This may be a deal breaker...

Many cellular/WISP ISPs work with NAT or CGNAT, and thus do not give you a publicly routable IP address. If that is the case with your ISP, you will not be able to achieve your goals unless you can get a real public IP from the ISP (you would need to ask them if they can provide a public IP to you). If you cannot get a public IP, it is basically game over. There are some creative ways to get around this, but it involves complex setups with VPNs and you would need to subscribe to a VPN or VPS service that supplies public IPs and then tunnel your traffic through that... this wouldn't be a good plan for gaming that is latency sensitive, though.

1 Like