topic Re: EE router DMZ not forwarding UDP 1194 (Self hosted OpenVPN server) in Broadband & Landline

EE router DMZ not forwarding UDP 1194 (Self hosted OpenVPN server)

bigbloke — Thu, 11 Apr 2024 13:16:10 GMT

Hi Folks
Cutover from Vermin Media to EE FTTP today.

No changes to my internal systems have been made.

heres a high level layout of the network under test:

As depicted, I have given my firewall external interface a static IP of x.x.x.254 and in the EE router, that IP is set as the
DMZ IP:

As such, all unsolicited traffic arriving at my EE router WAN interface should be forwarded to x.x.x.254
Only a subset of ports are getting through (as verified using Wireshark in promiscuous mode from a laptop on the
EE box LAN) UDP port 1194 is not forwarded.

This is not correct DMZ operation!

My dynamic DNS services (client within firewall) have correctly updated since disconnecting virgin media
so that isn't the issue.

The two top level domains I host from this connection are both reachable on TCP 80/443.

My VPN client (on my android phone) shows my correct EE V4 public IP. (which rules out a DNS issue) It sends the connection initiation packet, but never receives a response from my firewall.

Looking in the Wireshark traffic logs the reason is obvious!
no UDP 1194 traffic is forwarded from my EE box to the DMZ host!

I have cross checked this by tcpdumping the EE facing firewall interface and filtering for UDP
no traffic arrives from the EE router

Self hosted OpenVPN operation in this manner is a "must have" service here as I use it extensively for:

* SIP telephony
* Home Automation
* Remote Security / Telematics

The fault could be the configuration of an upstream firewall, or the capabilities of the EE Hub itself

if the EE FTTP service are blocking these ports in DMZ mode , then the offering is not fit for purpose
under the 2015 consumer rights act .

EE - what steps do you propose to fix this challenge please ?

regards

BB

Re: EE router DMZ not forwarding UDP 1194 (Self hosted OpenVPN server)

XRaySpeX — Thu, 11 Apr 2024 13:42:42 GMT

@bigbloke wrote:

As depicted, I have given my firewall external interface a static IP of x.x.x.254 and in the EE router, that IP is set as the DMZ IP:

What's the REDACTED 'x.x.x'? Shouldn't it be on the same subnet as the router's local IP, i.e. '192.168.1'? In which your DMZ'ed firewall is on the same local IP as the router, i.e. '192.168.1.254'. Clash!

Re: EE router DMZ not forwarding UDP 1194 (Self hosted OpenVPN server)

bigbloke — Thu, 11 Apr 2024 14:00:55 GMT

its redacted by me as I dont like details of my private network setups on public forums
they are all in the common /24 subnet
my router is .1
the internal firewall is .254
the DMZ IP is .254

Either there is an upstream firewall issue, or the EE router DMZ function doesn't work correctly - I cannot even turn off the EE firewall to verify an upstream firewall issue - VERY frustrating !

Regards

BB

Re: EE router DMZ not forwarding UDP 1194 (Self hosted OpenVPN server)

XRaySpeX — Thu, 11 Apr 2024 14:05:38 GMT

OK, that avoids the hidden complication I envisaged.

Re: EE router DMZ not forwarding UDP 1194 (Self hosted OpenVPN server)

bigbloke — Thu, 11 Apr 2024 14:56:13 GMT

given that there is no way to bypass the EE box Firewall and that I have a perfectly serviceable downstream industry grade firewall...

Does the ONT bind to the first MAC address its presented with ?

If I plugged in my downstream firewall directly into the ONT and power cycled it [the ONT] , will it bind to the firewall MAC ?

where does the PPP connection terminate please? in the ONT ? or in the EE router ?

I either need to get this VPN back up or regress to vermin media as people are depending upon it

Regards

BB

Re: EE router DMZ not forwarding UDP 1194 (Self hosted OpenVPN server)

XRaySpeX — Thu, 11 Apr 2024 16:09:23 GMT

I'm not sure I understand your Qs but as I see it ...

The ONT will service any router that has a WAN port fast enough for it.

PPPoE creds are handled by the router on its WAN side.

Re: EE router DMZ not forwarding UDP 1194 (Self hosted OpenVPN server)

bigbloke — Thu, 11 Apr 2024 15:46:55 GMT

thanks for that XRaySpeX

I will try and bypass the EE box and bridge directly to the ONT as an interm measure

failing that - back to Vermin until I get a formal response from EE on Monday

Regards

BB

Re: EE router DMZ not forwarding UDP 1194 (Self hosted OpenVPN server)

Mustrum — Thu, 11 Apr 2024 18:25:19 GMT

@bigbloke with your VM setup did you have their router set up as a router or did you switch it to bridge mode?

If the latter can you not do away with the EE router and just connect your firewall/server direct to the ONT. It just needs to be able to handle PPOE and use the standard BT settings.

Re: EE router DMZ not forwarding UDP 1194 (Self hosted OpenVPN server)

bigbloke — Thu, 11 Apr 2024 21:35:35 GMT

Hi Mustrum

No, the Vermin router is DOCSIS on the WAN side and doesn't support PPPOE. I use the Vermin / EE box in router mode as it provides me with a "guest wifi" network for works devices and visitors that is outside of the domestic LAN segments .

I will look into a direct firewall to ONT connection tomorrow

Regards

BB

Re: EE router DMZ not forwarding UDP 1194 (Self hosted OpenVPN server)

Mustrum — Thu, 11 Apr 2024 22:10:53 GMT

Ah OK, that makes it a bit harder. But I guess you will have the same issue with many ISP's so maybe using your own router might be your best option. The EE/BT based ones tends to restrict things and tries to keep it simple for the average user, and restricts anything too far from what they thing is normal!

Re: EE router DMZ not forwarding UDP 1194 (Self hosted OpenVPN server)

bigbloke — Fri, 12 Apr 2024 07:07:18 GMT

Picking up on your comment:

The EE/BT based ones tends to restrict things and tries to keep it simple for the average user, and restricts anything too far from what they thing is normal!

Whilst I take your point, If they offer a device with a capability , and that capability doesn't work as advertised , then the device is not "fit for purpose" under consumer law , and the issue needs to be resolved.

If no one pulls then up on it , we all continue to get ripped off.

A sad state of affairs but it seems to be the way of the world today

Regards

BB

Re: EE router DMZ not forwarding UDP 1194 (Self hosted OpenVPN server)

XRaySpeX — Fri, 12 Apr 2024 10:25:27 GMT

We've all pulled them up on it since its inception in Oct '23 on various detailed points on its missing or non-working functionality.

Re: EE router DMZ not forwarding UDP 1194 (Self hosted OpenVPN server)

bigbloke — Fri, 12 Apr 2024 10:31:13 GMT

Well I can now confirm, beyond reasonable doubt, that
the fault is the DMZ function in the EE router isn't working correctly!

In fact I am currently typing this reply via the OpenVPN connection as "Demonstrable proof" .

The workaround was indeed to use another router which quite simply, I shouldn't have to do as DMZ is supposed to be a supported feature of the EE (not so) smart Hub

In the spirit of giving back to the community, here is my workaround:

In my junk box I found a c***py old Linksys ACM3200 router which I re-flashed with OpenWRT (because I trust it and its better than the stock firmware)

I logged in and configured the LAN subnet to my desired range;
The DHCP IP address range to my desired range;
I configured the V4 WAN manually for PPPoE using the details on EE's website:

This setup , to the best of my knowledge, only works for Full fibre. Fibre to the Cab (FTTC) requires additional
VLANs on the WAN side which out of the box this device doesn't appear to support.

Having saved the config and confirmed the LAN changes worked I plugged it in place of the EE router:

within seconds the ONT activity light was flashing so the Internet was "Up"

I went into the Linksys' GUI and under :

Network > DHCP and DNS > Static Leases

In there , I found the currently assigned firewall external interface, and set its IP address
to my preferred one (avoiding all clashes) and applied it

Unplugging and re-plugging the firewall ethernet from the Linksys forced the setting of the
required static IP.

I was now ready to tell the Linksys that the firewall was the DMZ host.

In the linksys under Network > Firewall > Port forwards I clicked [ADD] and created the
following rule:

[SAVE] and [APPLY] buttons then pressed

From my 4G phone I started the VPN client - it worked instantly - thus proving the blocker was the EE provided
router DMZ function not working correctly.

my SIP phone works , home assistant can be accessed , everything appears spot on .

I haven't cancelled the EE visit on Monday as there is a minimum contracted downlink speed issue as well , and I need their guy to see the VPN / DMZ issue with their own eyes so it gets reported to seniors for the good of everyone - not just me.

Hope this helps someone else dig themselves out of the same hole until EE upgrade their routers to fix their shortcomings.

Regards

BB

Re: EE router DMZ not forwarding UDP 1194 (Self hosted OpenVPN server)

bigbloke — Fri, 12 Apr 2024 10:38:17 GMT

I wont mark my previous post (one up) as a solution - because it is only a work around.

The solution is for EE to update their hub to fix the DMZ feature

regards

BB

Re: EE router DMZ not forwarding UDP 1194 (Self hosted OpenVPN server)

Mustrum — Fri, 12 Apr 2024 16:46:23 GMT

@bigbloke thanks for the update, glad you got it working, and handy you had a better spec router to use. 😉

Re: EE router DMZ not forwarding UDP 1194 (Self hosted OpenVPN server)

bigbloke — Sat, 13 Apr 2024 09:06:21 GMT

The Linksys ACM3200 is the second least reliable router I have ever owned ! (the least reliable being a netgear that was so bad I gave it a sacrificial burning in a Chiminea before sending it back to Netgear with a covering letter 🙂 )

I originally bought the 3200 to use with Openwrt as I wanted a second router to bridge house to garden shed on 5.8GHz and re-broadcast the house network on 2.4 GHz. However, it suffers from memory corruption when above room temperature, and also has a wonky 5.8GHz 3rd wifi radio, but lasted long enough to prove the point about the EE router (hence it was in my junk box).

Ordered a Draytek via amazon to serve as its long term replacement (hopefully here today) . Draytek in my experience were like when Datsun became Nissan or Skoda was bought by VAG. Whilst Draytek's early products were nothing to write home about, their current range are sensibly put together good menu systems and work exceptionally well - albeit at a higher price point.

regards

BB