2

I wondered if I can get some clever ideas here.

I have this setup currently working for 4G internet in our home:

  • A Moto E from Cricket
  • Connected by USB to a raspberry pi (tethered)
  • Connected to an old cradelpoint MBR900 router (The WAN port in the router connects to the Pi's ethernet port)
  • The Pi is running Raspbian and using bridge-utils to bridge usb0 to eth0.

Currently, this works great for internet access. We have several devices connected wirelessly to the router and they all get a signal. Browsing works great, even gaming isn't awful.

The problem is with external access. We had a small security system installed, and the provider says they need to program it by connecting remotely in to port 7700. I have port 7700 forwarded from the router to their device internally, but they can't access it.

I'm not able to successfully forward something like 8080 to my laptop either. My external IP address is actually not even ping-able. All requests timeout. 100% packet loss.

So... any suggestions on which rabbit hole I should go down?

5
  • @goldilocks Well, that's what I'm trying to determine I guess. The router accesses the internet through the pi. The pi accesses the internet through the phone. So... How do I go about determining if my problem is at the phone, the pi, or the router?
    – Cody Crumrine
    Feb 9, 2016 at 20:13
  • Whoops, I misread this initially. So it is the Moto E which has an external IP. That's a problem unless your 4G provider will give you a stable IP -- probably not cheap! The other option is to get a "noip" type service; you have to pay for that too but it will likely be cheaper.
    – goldilocks ♦
    Feb 9, 2016 at 20:20
  • I've gotten around the need for a static IP before with just ddclient and a namecheap domain name. But that's not really a huge issue.. They just need access in once, to program the system. On an ongoing basis, the system just needs to be able to connect out to them, which it can currently do.
    – Cody Crumrine
    Feb 9, 2016 at 20:46
  • You should look into this stuff with wireshark. Otherwise you are just going to have people thowing darts. You probably want to learn to do that anyway if you are maintaining this kind of setup. Beware that for it to work on wifi nodes (not counting the tether), you need to disconnect them/shut down the WLAN, start wireshark, restart the WLAN. If all the relevant devices are connected to a pi with a cable it does not matter.
    – goldilocks ♦
    Feb 9, 2016 at 20:50
  • thanks for the tip @goldilocks , will be checking that out
    – Cody Crumrine
    Feb 9, 2016 at 20:51

3 Answers 3

Reset to default
1

No, there's no rabbit hole. Your ISP may be using private IP addresses and NATing everyone's traffic.

In short, you and everyone using your ISP is behind a giant firewall.

I recommend you call them. The may either provide you the ports you need and a public IP address for free, or they'll offer you a "business-class" connection with a public IP address and all the ports you want.

1

To access a specific port on your Raspberry Pi behind a complicated multi-tier firewall you could use a service like ngrok. For one port it's free, it should only take about 5 minutes to sign-up and configure it on your Pi.

For a one time thing or for a single device behind a very dynamic connection (3G for example) that does need to be 100% secure it works perfectly and it's free and easy to set up. There are other similar solutions also.

For a long term solution you should definitely work out your firewalls and configure a tunnel.

For a non-Raspberry Pi solution, but it should be enough for your use case, you could also start up TeamViewer on your laptop and they can connect using your PC.

1

Sharing the eventual solution: I have a small Digital Ocean VPS that I use to host a few websites.

On the Pi, I create a tunnel from my VPS to the router with:

ssh -R 7700:[router_local_ip]:7700 [email protected]

That gets a request to 7700 on my VPS inside to the router, from there the router's normal port forwarding options let me pass that on to 7700 on the security company's device.

The only thing that's unsatisfactory about this solution is that it won't be helpful to anyone trying to manage a similar set up who doesn't want to rent a VPS. I have one for my work anyway, but if I didn't I'd hate to pay an extra $5 a month for this solutions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.