topic Re: Another NAT-Loopback Saga in Broadband & Landline

Another NAT-Loopback Saga

mattius001 — Tue, 27 Dec 2022 23:17:20 GMT

This post is my last ditch attempt before replacing the EE Smart hub.

Im trying to circumvent nat-loopback but having little success,

I've setup a local DNS server, and setup a static route for the problematic server ( synology NAS ),

Interestingly this works when i set the DNS on windows to the local DNS server and the ddns is routed to the internal ip, but when i set the DNS server in the EE Smart hub settings it fails to route it, its not even hitting the DNS server.

What i really don't understand, is according the the smart hubs own configuration, anything that doesn't get blocked by the firewall rules ( firewall is disabled ), will be routed to the DMZ host ignoring the NAT. Yet that isn't true, because it is blocking this.

Is there something im missing? or is replacing the EE smart hub the only option?

It really is a massive omission to not enable nat loopback on these routers, using an internal address is not really a convenient option, you are constantly having to change logins for applications depending on whether you are home or away, setting the DNS to a local one is quite an extreme option not really available to most users.

Re: Another NAT-Loopback Saga

bobpullen — Wed, 28 Dec 2022 12:21:20 GMT

@mattius001 wrote:
Im trying to circumvent nat-loopback but having little success,

What exactly is it you're trying to achieve?

I've setup a local DNS server, and setup a static route for the problematic server ( synology NAS ),

So, you're trying to access a NAS on your local network from another machine?

Interestingly this works when i set the DNS on windows to the local DNS server and the ddns is routed to the internal ip...

Given you're talking about DDNS, I'm assuming that you're trying to access a NAS on your local network where there is an externally accessible DDNS hostname pointed to your public IP (and port forwarded via the EE Smarthub to your local storage)? If so, I'm a bit confused as to why you would want to circumvent nat-loopback. I'd have thought that would be exactly what you want in this scenario?

... but when i set the DNS server in the EE Smart hub settings it fails to route it, its not even hitting the DNS server.

I suspect the Smarthub will allocate the custom/local DNS IP as part of the DHCP lease, rather than the assign it to the WAN interface. If so, you may need to renew the DHCP lease on the client device before testing the changes. Simplest thing is probably to reboot the hub so all devices are forced to renew.

What i really don't understand, is according the the smart hubs own configuration, anything that doesn't get blocked by the firewall rules ( firewall is disabled ), will be routed to the DMZ host ignoring the NAT. Yet that isn't true, because it is blocking this.

Should be the case, but unlikely to help if there's some inherent issue with nat-loopack that's preventing it. Port forwarding should be sufficient though. You shouldn't need to use the DMZ.

It really is a massive omission to not enable nat loopback on these routers

Bit confused. You opened saying you were trying to circumvent nat-loopback, but here you say it isn't enabled. Is there some oft-complained about issue with the EE Smarthub where nat-loopback doesn't work? I'm not overly familiar with the device but am inclined to agree that it's a bit of an odd ommission.

Re: Another NAT-Loopback Saga

mattius001 — Wed, 28 Dec 2022 12:40:02 GMT

Im trying to circumvent the lack of nat-loopback on the EE smart hub modems.

i.e. Accessing an externally accessible DDNS from the internal network.

This is not possible natively as the EE smart hub doesn't support nat-loopback.

The only current way of accessing the local device on the local network is by accessing it via its local IP. Externally everything works accessing it on the DDNS address. Which is just stupid, as it means any apps which connect to the server, then need two address' to access it ( one for internal, one for external ).

Its a very strange omission not having nat-loopback, most other suppliers i have tried have supported this ( SKY, PlusNet, Virgin ), its not really a security concern on a small scale network and a worst should be a configurable setting on the hub.

So to circumvent the lack of it, i implemented a local DNS server, which when queried for the DDNS returns the internal ip address of the device. As stated above, this works when configured on Windows as the DNS, so naively i thought this should then work if i replace the DNS servers on the EE smart hub with my local DNS.

But it appears the smart hub is still NAT'ing the requests and hence failing them. Which is why im doubly confused by the DMZ statement on the smart hub settings screen, it clearly states that the smart hub won't NAT unknown traffic to the DMZ, so i configured the server as the DMZ, yet it appears it still NAT the requests when they are loop back.

Re: Another NAT-Loopback Saga

bobpullen — Wed, 28 Dec 2022 12:46:03 GMT

Thanks, that's how I read the problem - but good to have confirmation.

It would be interesting to know why nat loopback isn't supported by The Smarthub. I assume you have the same problem if you use port forwarding, rather than putting the NAS into the DMZ? (which would be the recommended way to do things).

Assuming nat-loopback doesn't work, then what you're trying to do should be achievable if you have a local DNS entry configured on the internal DNS server, and it's being considered in favour of the public record. If the DDNS hostname > Internal IP lookup is happening, then the traffic should never leave your network and therfore shouldn't be subject to any NAT limitations.

Have you tried renewing the client DHCP lease as suggested in my last post? It would also be worth clearing any possible cached DNS records on the device you're trying to access the NAS from.

What DNS server are you using out of curiousity? Pi-hole?

Edit: rather than go to the trouble of running a local DNS server, could another option be to add some entries to the hostfile on the local machine you're trying to access the NAS from? Probably not practical if you need access from mobile devices, but for a laptop/desktop it should be achievable with minimal effort.

Re: Another NAT-Loopback Saga

mattius001 — Wed, 28 Dec 2022 13:06:04 GMT

Yeah i have port forwarding setup ( needs to be for external access ) and the DMZ setup ( in the hope it would do like the documentation states and not NAT the traffic ).

The Local DNS is synology's own DNS server, essentially with one rule (zone), forward the DDNS to the local ip, then just forward everything else onto googles DNS servers. This works a treat when configured in windows, just not when configured as the Smart Hub DNS.

Once configured i rebooted the smarthub ( in the hope of flushing its DNS ) then on clients flushed the DNS. and registered the DNS.

Editing the hosts file is not really possible, as its mobile clients which are the problematic ones and im trying to avoid having to constantly manually configure any new device added to the network.

Re: Another NAT-Loopback Saga

bobpullen — Wed, 28 Dec 2022 13:27:04 GMT

Personally, I'd disabled the DMZ as I doubt it's doing much to assist with resolution.

What clients have you tried from? Doesn't it work from any? What happens if you run a traceroute from an affected client to the DDNS hostname? Does the traffic route out of your network?

If you do something like this from a Windows command line, is the local IP of the NAS returned?

>nslookup <ddns_hostname>

Also worth querying the NAS directly to see what it's doing: -

>nslookup <ddns_hostname> <local_ip_address_of_nas>

In both cases, I'd expect the IP of your NAS to be returned.

Re: Another NAT-Loopback Saga

mattius001 — Wed, 28 Dec 2022 14:32:27 GMT

Yeah so thats where it gets confusing,

So nslookup mydomain.net returns the ip address of the router and cannot resolve

nsloopup mydomain.net 192.168.1.2 ( my dns ) returns the ip address of the server im trying to reach

So my DNS server is working correctly, but the Smart hub is ignoring the DNS server settings for some reason...

I have both primary and secondary DNS setup as my local

Re: Another NAT-Loopback Saga

bobpullen — Wed, 28 Dec 2022 14:39:35 GMT

Yeah, that suggests the custom DNS/DHCP from the router is not being picked up by the client device.

If you do an ipconfig, what DNS server addresses is assigned to the active Windows network interface?Presumably the router IP still? It should be the IP of your local DNS server.

>ipconfig /all

The above command will also give you details of when the DHCP lease was obtained which might offer some more clues.

What does the area of the hub manager look like where you can assign custom DNS? What menus do you navigate through to get to it? Just trying to reinforce my belief that the DNS is supposed to be dished out by the DHCP server.

Re: Another NAT-Loopback Saga

mattius001 — Wed, 28 Dec 2022 14:42:48 GMT

But given i have restarted the smart hub would it not have renewed the leases?

Re: Another NAT-Loopback Saga

bobpullen — Wed, 28 Dec 2022 14:51:24 GMT

Yes, but the output from the command will help confirm whether or not that's happened. If custom DNS genuinely didn't work on this hub then I'd expect there to be a fair few complaints about it.

Things can often be 'sticky', especially where DHCP/DNS caching etc. is concerned.

Re: Another NAT-Loopback Saga

XRaySpeX — Wed, 28 Dec 2022 15:03:14 GMT

@bobpullen wrote:

What does the area of the hub manager look like where you can assign custom DNS? What menus do you navigate through to get to it? Just trying to reinforce my belief that the DNS is supposed to be dished out by the DHCP server.

The DNS has nowt to with the DHCP & its leases. They are set for the whole time:

Re: Another NAT-Loopback Saga

mattius001 — Wed, 28 Dec 2022 15:10:28 GMT

Yeah releasing the DNS and renewing it had no effect.

Primary DNS is pointing to my local DNS ( now .200 ) I've tried everything in the secondary ( it doesn't like being blank ) currently set to an unknown ip address, have tried both pointing to my local DNS, but still nothing.

Looking at the clients, they all have the smart hub as their DNS

Doing an nslookup, its looking up using the Smarthub DNS, not my custom DNS, which is working

Re: Another NAT-Loopback Saga

bobpullen — Wed, 28 Dec 2022 15:13:53 GMT

Thanks @XRaySpeX - that addresses that aspect then.

Differs to the Smart Router that assigns custom DNS via DHCP, rather than assigning to the WAN connection: -

Re: Another NAT-Loopback Saga

XRaySpeX — Wed, 28 Dec 2022 15:19:32 GMT

@bobpullen wrote:

If you do an ipconfig, what DNS server addresses is assigned to the active Windows network interface?Presumably the router IP still? It should be the IP of your local DNS server.

It will be the router's IP:

Windows IP Configuration

Host Name . . . . . . . . . . . . : XRay's PC
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : XRayGroup
home

Ethernet adapter XRay Ethernet:

Connection-specific DNS Suffix . : XRayGroup
Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller
Physical Address. . . . . . . . . :
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : (Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.10(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : 16 December 2022 09:00:53
Lease Expires . . . . . . . . . . : 03 February 2159 21:40:51
Default Gateway . . . . . . . . . : 192.168.1.2
DHCP Server . . . . . . . . . . . : 192.168.1.2
DHCPv6 IAID . . . . . . . . . . . : 230718673
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1D-D6-7B-CF-C0-7C-D1-A1-2A-D1
DNS Servers . . . . . . . . . . . : 192.168.1.2
NetBIOS over Tcpip. . . . . . . . : Enabled

Re: Another NAT-Loopback Saga

mattius001 — Wed, 28 Dec 2022 15:21:28 GMT

So it does look like the EE Smart Hub is ignoring the DNS server settings

Re: Another NAT-Loopback Saga

bobpullen — Wed, 28 Dec 2022 15:23:13 GMT

@mattius001 - so, if the Smart Hub is only capable of attaching custom DNS to the PPP interface, and that's still not routing the internal traffic correctly for you, then there could be an alternative solution.

I don't know what model of Synology NAS you are using, but does it have the ability to act as a DHCP server as this suggests?

If it does, then you could disable DHCP on the Smart Hub (assuming it allows this), enable DHCP on your NAS (assuming it stays powered up all the time), and then configure the DHCP parameters on the NAS to issue itself as the primary/secondary DNS server addresses as part of the DHCP lease.

Re: Another NAT-Loopback Saga

XRaySpeX — Wed, 28 Dec 2022 15:30:04 GMT

@bobpullen wrote:

Differs to the Smart Router that assigns custom DNS via DHCP, rather than assigning to the WAN connection: -

It doesn't really! They are just configured on the same page (everything to do with IPv4) but are not otherwise connected.

Re: Another NAT-Loopback Saga

mattius001 — Wed, 28 Dec 2022 15:27:53 GMT

If i ditch DHCP from the Smart Hub, i might as well just ditch the Smart Hub as it will then effectively be doing nothing for me but adding a layer of obfuscation.

I already don't use it for Wifi, now DNS, now DHCP and its basically just a modem and not a particularly good one.

I think i will just give up and purchase a decent modem/router, at least then when i next switch providers i will have a consistent experience.

Re: Another NAT-Loopback Saga

bobpullen — Wed, 28 Dec 2022 15:30:35 GMT

@XRaySpeX wrote:
@bobpullen wrote:
Differs to the Smart Router that assigns custom DNS via DHCP, rather than assigning to the WAN connection: -
It doesn't really! They are just configured on the same page (everything to do with IPv4) but are not otherwise connected.

@XRaySpeX - are you sure about that?

The BT Smarthub 2 (and the Plusnet Hub Two for that matter) have a very similar interface, and for both of those, the custom DNS will be issued as part of the DHCP lease. In fact, when you have things configured this way, you can navigate to the Broadband Status when connected and see that the PPP interface is still assigned the DNS it has obtained from the PPP session. This is depspite all connected DHCP clients using the custom DNS that has been specified.

Re: Another NAT-Loopback Saga

bobpullen — Wed, 28 Dec 2022 15:30:15 GMT

@mattius001 wrote:
If i ditch DHCP from the Smart Hub, i might as well just ditch the Smart Hub as it will then effectively be doing nothing for me but adding a layer of obfuscation.
I think i will just give up and purchase a decent modem/router, at least then when i next switch providers i will have a consistent experience.

Fair enough. The solution is there if you need something in the meantime though and it doesn't look too tricky to enable.

If you do give it a go, let me know how you get on.