topic Re: Smart Router port forwarding in DMZ randomly stops working in Archived Posts

Smart Router port forwarding in DMZ randomly stops working

c2r — Sun, 16 May 2021 18:48:23 GMT

Hello,

I've recently been upgraded to FTTP with the white Smart Router, and all the discs to provide wifi around the house. The discs are brilliant, and I'm generally really happy with the router - however, every day or so, it just decides that it doesn't fancy doing port forwarding anymore.

I'm running Smart Router DX

Software version is: v0.04.01.05202-EE

Board version: R01

Boot loader; 0.1.7-EE (20.09.2019)

Firewall is on

I've got a device called "dmz.local" which is detected and has private IP 192.168.1.208

I've set this device to be the DMZ device and have a rule for sftp to forward a high numbered port, say 19888 to 22 for TCP and UDP

I'm also forwarding port 80 to this device.

ShieldsUp reports no vulnerabilities on common ports.

The device, dmz, has its own firewall, which I've disabled for testing purposes. The device is at all times able to be accessed from the local network, and is able to be accessed via the public facing IP address initially. However, after, perhaps a day or so of use, it stops being able to be accessed from the externally facing IP address, the connection just times out with nothing in the ssh logs on the device itself. It can still be accessed from the internal network.

The internet itself is still up, as outgoing connections/requests work, and the device is still up and working (as above, it can be accessed directly on the local network).

Following a reboot of the router it's again immediately available. I travel for work and need a reliable connection back to my home network so rebooting the router every day isn't an option.

Port forwarding worked fine with the old brightbox router and I didn't have this problem - but I don't want to go back to using the old router as the new one has all the wifi discs which now I need for wifi calling without the landline.

Has anyone got any suggestions on anything I can try to fix this issue?

Thanks

Chris

Re: Smart Router port forwarding in DMZ randomly stops working

XRaySpeX — Sun, 16 May 2021 19:46:05 GMT

Just some odd Qs:

@c2r wrote:

ShieldsUp reports no vulnerabilities on common ports.

Not even on port 80 which you've opened?
What does ShieldsUp! report on your custom port 19888?
Why does this device need to be in the DMZ?

Re: Smart Router port forwarding in DMZ randomly stops working

c2r — Sun, 16 May 2021 19:55:07 GMT

Thanks for the quick reply.

Sorry, I should have been more clear, 80 and 19888 report as open, because I've opened them, similarly ShieldsUp also reports that it's able to ping my public facing IP.

But other than that there's no vulnerabilities listed.

19888 specifically states: Unknown Protocol for this port Unknown Application for this port

The device doesn't need to be in the DMZ for any particular reason - I just put it there because I thought that the router's firewall could be causing the issue (the issue occurred before I moved the device to the DMZ), and for obvious reasons I didn't want to disable the router's firewall.

Thanks again

Chris

Re: Smart Router port forwarding in DMZ randomly stops working

mikeliuk — Sun, 16 May 2021 20:51:28 GMT

Apologies if I'm being an idiot but I thought a host in the DMZ is supposed to by-pass the router firewall and that all traffic reaching the router's IPv4 IP address which is not NATed traffic for another host (an established connection) should be forwarded to the DMZ host.

It sounds like there's a chance that the router is behaving as configured and established connections are forwarded by NAT and new connections go to the DMZ host.

To test, one can disable the DMZ to see the port-forward works as expected. The DMZ can be reenabled to see new connections arrive to the DMZ host. The port-forward can then be removed to see all externally-initiated traffic hits the DMZ host. 🤓

Re: Smart Router port forwarding in DMZ randomly stops working

c2r — Sun, 16 May 2021 22:01:34 GMT

ah, ok, I hadn't realised that was how the router was treating the DMZ.

I'll try disabling the port forwarding and seeing what happens and will report back.

Thanks for your help

Chris

Re: Smart Router port forwarding in DMZ randomly stops working

mikeliuk — Mon, 17 May 2021 07:49:27 GMT

A quick aside for anyone else that comes across this thread that obviously all debugging of port-forwarding and DMZ needs to be done from a host external to your network which accesses the internet using a different IP address from your router.

For example, you can tether or hotspot to a second SIM in a mobile phone to give you your external host.

Once things work from an external host, careful configuration can often get everything working transparently inside the network too. For example, by ensuring external hostnames resolve to internal IP addresses instead etc.

Re: Smart Router port forwarding in DMZ randomly stops working

XRaySpeX — Mon, 17 May 2021 10:50:34 GMT

@mikeliuk : All you need for testing of open ports is an external site, like ShieldsUP!, which you can reach from your BB network, just like OP did.

Re: Smart Router port forwarding in DMZ randomly stops working

mikeliuk — Mon, 17 May 2021 10:59:29 GMT

Completely agree. In my case, I was configuring an OpenWRT VPN https://openwrt.org/docs/guide-user/services/vpn/start so indeed used an external service to check my ports were open, but needed to put my laptop onto another network to check the configuration actually worked.

Obviously I'm not going to provide my credentials to an external service to check they can access my VPN. That would defeat the purpose of setting up the VPN! 😂

Edit: the thing was I was trying to head off is that many times an engineer will test a particular service (not just whether a port is open) to see it works inside their network and be surprised that another user cannot get something to work because they are testing from outside the network.

Edit2: there are also services such as wireguard that cannot be detected as an open port so only a test of functionality will verify it works. 🤓

Re: Smart Router port forwarding in DMZ randomly stops working

c2r — Mon, 24 May 2021 07:00:42 GMT

Hello, I've brought the device back out of the DMZ and have the port forwarding set up as before - however, remote connections have failed again this morning - the router log gives me the follow, repeating several times:

24 May. DoS(Port Scanning): IN=ppp0 OUT=br0 MAC= src=<REMOTE IP> DST=192.168.1.208 LEN=52 TOS=0x00 PREC=0x00 TTL=114 ID=43399 DF PROTO=TCP SPT=59005 DPT=23 WINDOW=65535 RES=0x00 SYN URGP=0 MARK=0x8000000

However, all I'm trying to do is connect remotely using the SRC IP address using sftp public/private key authentication (I've checked that it isn't a genuine DoS attack) .

The device itself is still accessible via ssh from other devices on the internal network, it's only if I try and get in from outside that it just appears to have blocked access.

Does anyone have any ideas about what's going on here as it's really quite frustrating!

Thanks in advance

Chris

Re: Smart Router port forwarding in DMZ randomly stops working

mikeliuk — Mon, 24 May 2021 08:41:00 GMT

I'm assuming your router receives a publicly routable IPv4 address so that it can be reached from outside at all.

Have you already accounted for the fact your public-facing IPv4 address could change or have you verified that it has not changed?

Does a simple re-run of the remote command re-establish the connection? On your remote side, are you able to add options so that the command automatically sends heart-beat packets to keep the connection open, and so that a connection drop is automatically detected and re-established as required?

Re: Smart Router port forwarding in DMZ randomly stops working

c2r — Mon, 24 May 2021 08:48:13 GMT

Hello,

Thanks, yes, the pi emails me my external IP address every time it changes, also it updates a dynamic dns provider. My external facing IP address hasn't changed for some time.

Attempting to reconnect (either by ip address or external name) does not re-establish the connection, unless the router is restarted, after which it works immediately.

It's not therefore possible to reestablish the connection remotely, which means if I'm not at home I need to get someone else in the house to restart the router (from the router's admin screen), after which it can be accessed remotely again.

Cheers

Chris

Re: Smart Router port forwarding in DMZ randomly stops working

mikeliuk — Mon, 24 May 2021 09:00:14 GMT

It does sound a lot like a service or daemon in the router is falling over and or for some other reason the port-forward functionality is simply stopping.

One step to debug may be monitor two simultaneous port-forwards perhaps one on a low numbered port below 1000, and one on a high numbered port (e.g. five digits), and check if they drop at the same time and no longer forward packets (connections don't re-establish if manually forced). The next step may be to consider disabling IPv6 (speculative) or swapping out the router to debug with another router.

Re: Smart Router port forwarding in DMZ randomly stops working

c2r — Mon, 24 May 2021 09:14:51 GMT

Cheers, it's annoying that there's no better logging that I can see on the router to determine what's going on...

* it did used to work on the old brightbox2 router; the issue has only started since moving to the white smart router - which otherwise is brilliant with all its discs for mesh wifi.

* when it goes down, if I try and connect from a third location (e.g. tethered SIM card or work VPN) then it is inaccessible - almost like the firewall gets overloaded or something and then opts not to play anymore at all.

* I've opened a second low numbered port to see if that also stops working next time it goes down. As above, I'm running a high numbered port to serve ssh/sftp

* Router IPv6 status= enabled currently, network status=disabled; ipv6 wan details=not available; ipv6 lan details=not available; ULA disabled, allocation mode=off, no pinholes

Cheers

Chris

Re: Smart Router port forwarding in DMZ randomly stops working

mikeliuk — Mon, 24 May 2021 10:09:22 GMT

Typically I do not recommend making more than one change before observing the impact when debugging but in this case I don't think that opening an additional port counts as a change.

I also generally do not recommend disabling IPv6 support but in the case of this service provider, which shall not be named, there is anecdotal evidence that disabling of IPv6 support can result in better stability. My hypothesis is that enabling IPv6 functionality may cause attempts to obtain a valid configuration by DHCPv6 but if the network does not have IPv6 functionality enabled this may always fail and eventually cause an error condition and various restarts leading to loss of functionality such as port-forwards.

As you see that no IPv6 configuration is received anyway, I would suggest to disable IPv6 functionality to see if this results in any improvement of port-forwarding behaviour. I would also suggest that you record the interval between occurrences of the port-forwarding issue as it may happen at a regular time interval which would be indication of some sort of timeout or limit being hit. It's possible disabling IPv6 functionality could result in better stability of the port-forward so you would just need to make a note in case the service provider ever enables IPv6 functionality on their network so you would want to re-enable to match to be future-proofed.

It's possible you would only need to disable and re-enable the port-forwarding functionality to bring it back up (potentially this may imply a router reboot as the last step, but possibly the change can be made without reboot which would be more informative) and this is also indicative of discrete services causing the problem and not a wider network or router issue.

Re: Smart Router port forwarding in DMZ randomly stops working

XRaySpeX — Mon, 24 May 2021 10:15:14 GMT

@mikeliuk : The anecdotes you read about IPv6 are regarding the mobile network only. There is no IPv6 on the fixed BB network.

Re: Smart Router port forwarding in DMZ randomly stops working

mikeliuk — Mon, 24 May 2021 10:54:47 GMT

It is *because* there is no IPv6 functionality on the fixed line network that I suggest to disable the functionality in the router.

Edit: worst case it will be a completely harmless change.

Edit2: the purpose of the proposed change is to rule out my hypothesis. The scientific method is to propose a hypothesis and then attempt to falsify it, which will be done if IPv6 is disabled in the router but port-forwarding functionality still drops.

Edit3: browsing the related discussions at the bottom of this thread, I see that port-forwarding should just work (most issues being the firewall on the target) although there is one example of a suspected faulty router https://community.ee.co.uk/t5/Broadband-home-phone/New-EE-Smart-Hub-amp-Port-Forwarding-or-lack-of/m-p/690883

Edit4: I'm completely open to debugging an alternative hypothesis that might explain the issue and symptoms observed. It's possible the intervention might also be more simple than unchecking a tick box.

Re: Smart Router port forwarding in DMZ randomly stops working

XRaySpeX — Mon, 24 May 2021 10:26:05 GMT

Edit3: It's pointless & nowt to do with the issue.

I've never seen so many red herrings as in your posts. You'd be better off heeding Occam's Razor.

Re: Smart Router port forwarding in DMZ randomly stops working

c2r — Thu, 08 Jul 2021 10:14:50 GMT

Hello,

I'm still getting this issue - some further information;

* the low numbered port is also inaccessible so it isn't just the high numbered port that it has opted close

The log when this occurs is pretty much immediately full and truncated, so it's never possible to get back to the detail around the initial messages on the firewall log.

Has anyone got any other suggestions?

Cheers

Chris

Re: Smart Router port forwarding in DMZ randomly stops working

mikeliuk — Thu, 08 Jul 2021 17:03:48 GMT

Hi @c2r ,

As you await an expert opinion, I thought I would mention that your original idea of putting a secured host in the DMZ is a good one.

You could remove all port-forwards from your router, ensure your DMZ host is properly firewalled with firewalld, or a similar software firewall, and open the ports you require directly on the host.

Any incoming, unsolicited traffic which hits your WAN interface would then be forwarded on to your DMZ host. If you find that even this functionality fails (i.e. DMZ functionality fails), it would then be time to consider a new router.