EE router DMZ not forwarding UDP 1194 (Self hosted OpenVPN server)

[bigbloke]

Hi Folks
Cutover from Vermin Media to EE FTTP today.

No changes to my internal systems have been made.

heres a high level layout of the network under test:

As depicted, I have given my firewall external interface a static IP of x.x.x.254 and in the EE router, that IP is set as the 
DMZ IP: 

As such, all unsolicited traffic arriving at my EE router WAN interface should be forwarded to x.x.x.254
Only a subset of ports are getting through (as verified using Wireshark in promiscuous mode from a laptop on the 
EE box LAN)  UDP port 1194 is not forwarded.

This is not correct DMZ operation!

My dynamic DNS services (client within firewall) have correctly updated since disconnecting virgin media
so that isn't the issue.

The two top level domains I host from this connection are both reachable on TCP 80/443. 

My VPN client (on my android phone) shows my correct EE V4 public IP. (which rules out a DNS issue)  It sends the connection initiation packet, but never receives a response from my firewall.

Looking in the Wireshark traffic logs the reason is obvious!
no UDP 1194 traffic is forwarded from my EE box to the DMZ host! 

I have cross checked this by tcpdumping the EE facing firewall interface and filtering for UDP 
no traffic arrives from the EE router 

Self hosted OpenVPN operation in this manner is a "must have" service here as I use it extensively for:

* SIP telephony
* Home Automation
* Remote Security / Telematics

The fault could be the configuration of an upstream firewall, or the capabilities of the EE Hub itself 

if the EE FTTP service are blocking these ports in DMZ mode , then the offering is not fit for purpose
under the 2015 consumer rights act  .

EE - what steps do you propose to fix this challenge please ?

regards 

BB

[XRaySpeX]

---

@bigbloke wrote:

As depicted, I have given my firewall external interface a static IP of x.x.x.254 and in the EE router, that IP is set as the DMZ IP: 

---

What's the REDACTED 'x.x.x'? Shouldn't it be on the same subnet as the router's local IP, i.e. '192.168.1'? In which your DMZ'ed firewall is on the same local IP as the router, i.e. '192.168.1.254'. Clash!

[bigbloke]

its redacted by me as I dont like details of my private network setups on public forums
they are all in the common /24 subnet
my router is .1
the internal firewall is .254
the DMZ  IP is .254

Either there is an upstream firewall issue, or the EE router DMZ function doesn't work correctly - I cannot even turn off the EE firewall to verify an upstream firewall issue - VERY frustrating ! 

Regards 

BB

[XRaySpeX]

OK, that avoids the hidden complication I envisaged.

[bigbloke]

given that there is no way to bypass the EE box Firewall and that I have a perfectly serviceable downstream industry grade firewall...

Does the ONT bind to the first MAC address its presented with  ?

If I plugged in my downstream firewall directly into the ONT and power cycled it [the ONT] , will it bind to the firewall MAC ?

where does the PPP connection terminate please? in the ONT ? or in the EE router ?

I either need to get this VPN back up or regress to vermin media as people are depending upon it 

Regards 

BB

[XRaySpeX]

I'm not sure I understand your Qs but as I see it ...

The ONT will service any router that has a WAN port fast enough for it.

PPPoE creds are handled by the router on its WAN side.

[bigbloke]

thanks for that XRaySpeX

I will try and bypass the EE box and bridge directly to the ONT as an interm measure 

failing that - back to Vermin until I get a formal response from EE on Monday

Regards 

BB

[Mustrum]

@bigbloke  with your VM setup did you have their router set up as a router or did you switch it to bridge mode?

If the latter can you not do away with the EE router and just connect your firewall/server  direct to the ONT. It just needs to be able to handle PPOE and use the standard BT settings.

[bigbloke]

Hi Mustrum

No, the Vermin router is DOCSIS on the WAN side and doesn't support PPPOE. I use the Vermin / EE box in router mode as it provides me with a "guest wifi" network for works devices and visitors that is outside of the domestic LAN segments .

I will look into a direct firewall to ONT connection tomorrow

Regards 

BB

[Mustrum]

Ah OK, that makes it a bit harder. But I guess you will have the same issue with many ISP's so maybe using your own router might be your best option. The EE/BT based ones tends to restrict things and tries to keep it simple for the average user, and restricts anything too far from what they thing is normal!