topic Re: Switched to Full Fiber - SSH/VPN traffic not working, other port forwards fine? in Broadband & Landline

Switched to Full Fiber - SSH/VPN traffic not working, other port forwards fine?

james_s60 — Tue, 30 Dec 2025 14:38:04 GMT

Hi,

Just switched from Virgin Media (FTTP into a media converter to take it back to DOCSIS) to EE Full Fiber. I am using an OPNSense router connected directly to the ONT.

I have an SFTP server and a Wireguard VPN Server, both of which worked fine with Virgin, both of which no longer work after the switch to EE. Other traffic (eg HTTP over any port) seems to work fine.

There have been no LAN side or router config changes with the exception of enabling PPPoE on the WAN interface.

nmap shows port 22 or 52222 as filtered, canyouseeme.org shows as open, yet I cannot connect via SSH. Wireguard is also unable to establish a connection from EE mobile data. I'm on an 86.xx.xx.xx/32 subnet so no CGNAT either. I ran tcpdump on the sftp server, no packets hit the server. I ran tcmpdump on the wan interface of my router, also no traffic.

I called EE and got escalated to someone in the technical team, apparently EE do not block or filter anything by default, but I dont see how its possible that they arent blocking this traffic?

Any ideas?

Re: Switched to Full Fiber - SSH/VPN traffic not working, other port forwards fine?

james_s60 — Tue, 30 Dec 2025 17:24:53 GMT

Updates:

Just for the hell of it, I plugged in the EE supplied router again, made zero changes apart from a port forward rule, set up an ssh server on my laptop, sure enough - still no dice.
Called EE, they reluctantly-ish agreed to open a case with openreach after mentioning that this was a dealbreaker enough issue to take me back to VM.
Tried SSH on common ports like 80 and 443 to see if I could trick the port filter, no dice.
Nord VPN works via NordLynx protocol, but not via openvpn. Both work on EE 4G.
ICMP also appears to be blocked as I cannot even ping my own WAN addr, even with a temporary any any rule on my firewalls wan interface. My mother is also EE, stock router stock settings, also cannot ping her WAN addr.

Waiting on callback from Openreach, however, I suspect the blocking would be EE side as it would be commercially advantageous for them.

Re: Switched to Full Fiber - SSH/VPN traffic not working, other port forwards fine?

JimM11 — Tue, 30 Dec 2025 18:56:14 GMT

@james_s60 VM move is your better choice don't waste time waiting on EE to sort anything out, should have done your homework before switching!

Re: Switched to Full Fiber - SSH/VPN traffic not working, other port forwards fine?

james_s60 — Tue, 30 Dec 2025 19:12:39 GMT

Well, lets see what openreach come back with. Theres a whole list of reasons Ive been keen to move away from VM and cityfiber isnt in my area yet.

I did ensure no CGNAT before signing up and couldn't see anything to imply EE block anything (as the official stance is that they dont). On paper it should work.

Re: Switched to Full Fiber - SSH/VPN traffic not working, other port forwards fine?

JimM11 — Tue, 30 Dec 2025 19:15:57 GMT

@james_s60 Then just keep the supplied EE Router on the wan connection, anything else you will have NO support!

Re: Switched to Full Fiber - SSH/VPN traffic not working, other port forwards fine?

james_s60 — Tue, 30 Dec 2025 19:18:07 GMT

Issue persists with the EE router too though, its clearly filtering the packets somewhere upstream. Seemingly anything bar HTTP HTTPS DNS isnt playing ball.

Re: Switched to Full Fiber - SSH/VPN traffic not working, other port forwards fine?

JimM11 — Tue, 30 Dec 2025 19:21:10 GMT

@james_s60 It's your choice, put your opnsense router on and watch everyone walk away!

Re: Switched to Full Fiber - SSH/VPN traffic not working, other port forwards fine?

XRaySpeX — Tue, 30 Dec 2025 19:28:28 GMT

You'll get no callback from OR. Your contract is with EE. OR don't talk to end-users other than regarding any visit when they are acting on behalf of EE.

Re: Switched to Full Fiber - SSH/VPN traffic not working, other port forwards fine?

james_s60 — Tue, 30 Dec 2025 19:28:23 GMT

Not a helpful response though is it.

The opnsense router was a non issue with virgin and there have been zero config changes. EE do not forbid third party routers, they have support articles for such on their own website. But most importantly of all - the issue persists on the EE router!

Re: Switched to Full Fiber - SSH/VPN traffic not working, other port forwards fine?

james_s60 — Tue, 30 Dec 2025 19:31:57 GMT

Thanks for the comment - I did think this strange, but thats what the EE guide said.

Ultimately EE are leasing the OR back haul, but still have their own ISP infra, so while they may have an escalation team for issues outside of their control (eg line damage), im surprised they don't have an internal tech team that would investigate first (especially considering that logically, the issue would most likely lay with them).

Even with the EE router in place, they had a very "dont care" first line attitude towards it with no offer of escalation past logging a fault with openreach.

The guide did seem a bit "first line" - do you think its worth calling again?

Re: Switched to Full Fiber - SSH/VPN traffic not working, other port forwards fine?

bobpullen — Wed, 31 Dec 2025 17:57:36 GMT

@james_s60 - doesn't help your case any but FWIW, I have both a Wireguard and SSH server on my LAN running over an EE FTTP connection. Both work fine and are accessible from outside. Likewise, if I use a third party router (EE kit blocks incoming ping), then I can get an ICMP response too 🤷

Shot in the dark, but I wonder if it's worth you powering your kit off for an hour or two to see if you can get assigned a WAN IP from a different subnet. Perhaps the issue is something to do with how you're currently routed?

@james_s60 wrote:
I ran tcmpdump on the wan interface of my router, also no traffic.

On the WAN interface or on the virtual PPPoE interface? Not the same thing as I understand it.

Edit: also, what machine are your servers running on? Guessing it's not, but if it's Windows then have you ensured the network is set to 'private' and not 'public'? It has a tendency to sometimes default back to public when switching routers etc.

Re: Switched to Full Fiber - SSH/VPN traffic not working, other port forwards fine?

james_s60 — Tue, 06 Jan 2026 21:27:26 GMT

Hi Bob,

Thanks for the reply and apologies for the slow response, only just clocked it - same wavelength so good stuff 🙂

Great to hear yours works, thats genuinely promising as it does lean more towards a fault as opposed to malicious/intended blocking. Still waiting to hear back from EE's internal 3rd line networking team... As it happens, it seems ANY protocol bar plain HTTP, HTTPS, DNS are not working.

Tempted to disable DHCP6 on my wan interface entirely and remove the AAAA record from my domain to rule out any IPV 4<->6 Xnatting weirdness.

RE tcmpdump, both interfaces simultaneously

Servers are running a mix of Debian and Redhat so no firewalling or zone weirdness. This is a windows-free household 😉

Cheers 🙂

Re: Switched to Full Fiber - SSH/VPN traffic not working, other port forwards fine?

james_s60 — Tue, 06 Jan 2026 22:09:46 GMT

Gentlemen, it was FU**ING DNS...

Time to hang up my sysadmin hat in shame and swallow myself in 27 beers, maybe even some silkroad philosophy rock. A truly unacceptable error on my behalf.

EE - I owe you flowers and an apology. Please contact me to arrange this.

Re: Switched to Full Fiber - SSH/VPN traffic not working, other port forwards fine?

JimM11 — Tue, 06 Jan 2026 23:25:49 GMT

@james_s60 Enjoy all the beers, and one more step to keeping your VM return at bay!

Re: Switched to Full Fiber - SSH/VPN traffic not working, other port forwards fine?

james_s60 — Thu, 08 Jan 2026 22:07:26 GMT

Indeed haha!

@bobob @JimM11 - Do you guys have any idea how frequently your WAN IPV4 changes?

The other day I felt like a right idiot for discovering it was DNS, before later discovering that my IPV4 had changed almost every 12 hours! (forgive me for thinking it would last a little longer than that... lol)

I called EE to ask if they sell a static address, got a firm no.

Current solution is the Opnsense dynamic dns plugin + a cloudflare dns zone edit api. Seems to be holding so far, but that frequency of address change is silly! In theory DNS propagation is upto 48hrs so it borderline might not be possible to keep up. (I feel for those trying to get anything done on the stock router!)

Tonnes of brownouts in my area this week so wondering how sensitive the ONT is to power dips - possibly loosing its lease on reboot? - May be worth moving the ONT to my UPS when I get chance.

Re: Switched to Full Fiber - SSH/VPN traffic not working, other port forwards fine?

JimM11 — Thu, 08 Jan 2026 23:16:39 GMT

@james_s60 I am no longer an EE customer, but the wan IP was very sticky when the EE Smarthub+ was on and connected, think the longest in monitoring the Router for another reason not wan IP but at least 60Day's it had not changed and do think a straight on/off it did hold the wan IP fairly well, cannot say what a third party device would do probing the DHCP for a new wan IP would do though!

Re: Switched to Full Fiber - SSH/VPN traffic not working, other port forwards fine?

XRaySpeX — Fri, 09 Jan 2026 00:03:06 GMT

No, I've had my current IP for 41 hours & counting. That's just a snapshot taken when I saw you mention it. It has gone much longer in the past, at least 7 days.

Re: Switched to Full Fiber - SSH/VPN traffic not working, other port forwards fine?

bobpullen — Fri, 09 Jan 2026 17:32:25 GMT

@james_s60 wrote:
@bobob @JimM11 - Do you guys have any idea how frequently your WAN IPV4 changes?

@james_s60 - it will only change on PPP disconnect/reconnect and will stay the same as long as your Internet stays up. The IP is assigned to your router's WAN interface, not the ONT.

From what I understand of the BT network, IP's are assigned by MSE equipment that is scattered around the country. Which you connect to will depend on your geographic location. Each MSE has a 'pool' of IPs and they are assigned one by one as customers connect/disconnect from the Internet. If your Internet goes down and comes back v.quickly then there's a good chance of retaining the same IP. The longer it's offline for though, the higher the probability that somebody in your region 'nabs' your previously assigned address.

DNS propogation shouldn't be a problem as long as you use a sensibly configured dynamic DNS service. Personally, I have ddclient running on a Raspberry Pi on my network that updates one of my DNS records with Cloudflare. This takes minutes whenever my IP changes. One less involved solution would just be to use one of the free DDNS providers that are supported by the EE hub's built in Dynamic DNS feature.

Edit: ignore that last suggestion; completely negelected to remember that you were using OPNSense 🙄