0

I know, many a port forwarding question has been asked before... But I've been struggling with my router for days now, wasting too many hours, reading everything I can find online and failing to make any sort of progress. You are my last hope!! :D

My setup is simple: a Raspberry Pi (running Raspbian Stretch) behind a ZTE Speedport Entry 2i router. I want to be able to SSH into my Pi from outside, but also to run a little web server on it.

I made sure my Pi firewall (ufw) has ports 22 and 80 open and listening. No other firewall installed (I can SSH into the Pi from another computer on the same LAN without any problem).

I have found not 1 but 2 tutorials instructing precisely how to forward ports on a ZTE Speedport Entry 2i: https://portforward.com/zte/speedport-entry-2i/ and https://www.youtube.com/watch?v=XF4ZH9FU1ew. They recommend two slightly different ways of setting up the WAN IP Host Range (one says "Make sure that WAN Host IP Range is set to 192.168.1.1 ~ 192.168.1.1" and the other recommends leaving the range as 0.0.0.0 - 0.0.0.0 — I tried both solutions).

No matter what port I try forwarding to my RPi's IP, nothing goes through. Using https://www.ipfingerprints.com/portscan.php, I always get: "Host is up. State: Filtered."

I think the IP address I'm getting from my ISP is a public one (at least it doesn't start with 10 or 176).

I thought it might be my ISP blocking port forwarding for some reason. But even when I forward, say, port 8022 to port 22, still nothing happens.

In fact, even when I enable DMZ towards the Pi, nothing is forwarded.

So it seems that some kind of firewall is creating mischief somewhere. There is a firewall installed on the router; I set it to the lowest security level, which says "WAN host can directly access LAN host, but cannot access device itself (except echo-request)."

I tried all the advice listed there (http://www.pcwintech.com/common-problems-fixes-port-forwarding), including rebooting my router, but to no avail.

Any advice would be most welcome!

Cheers, D-

enter image description here enter image description here

  • Make sure that WAN Host IP Range is set to 192.168.1.1 ~ 192.168.1.1 - ignore that tutorial, 192.168.1.1 can never be a WAN IP – Jaromanda X Dec 14 '18 at 1:46
  • Have you tried actually connecting to your pi from OUTSIDE your LAN? Not many (practically none) routers support NAT loopback or hairpinning - i.e. you can't access the LAN using the WAN IP from within the LAN – Jaromanda X Dec 14 '18 at 1:49
  • have you tried removing the "Pi firewall" altogether? – Jaromanda X Dec 14 '18 at 1:50
  • @JaromandaX I've mostly stuck to the 0.0.0.0 ~ 0.0.0.0 IP range, since most tutorials advise to use this. Yep, I've tried connecting from outside my LAN... And as for the "Pi firewall", the only one there is (to my knowledge) is ufw, and yes, I've tried disabling it :| – killer_rabbit Dec 14 '18 at 1:57
  • At work we have ADSL which works fine when port forwarding ... but when it falls back to the "mobile data" fallback (when ADSL fails) no incoming connections get through - this may be a quirk of my provider, but it does seem like there are providers that block ALL incoming connections - that's something to consider anyway – Jaromanda X Dec 14 '18 at 2:20
0

ufw isn't installed by default on Raspbian Stretch. So for testing you should deinstall it. Instead of forwarding web server port 80 you should test with port 22 for ssh. With its debug option ssh -v you can better see what's going wrong. You should not use a demilitarized zone (DMZ). It complicates things a lot. Please disable it completely.

Your provider cannot block your port forwarding. It only sees the port you want to connect to. He cannot decide at this time that you will forward it later. But he can decide to block port 22 for ssh or port 80 for web server in general because he want to earn money with his own web server offers, maybe. So I suggest to use another port, for example 22022 to connect to the public ip address of your router.Then, of course, on your router you have to forward WAN Port Range 22022 ~ 22022 to LAN Host Port Range 22 ~ 22. Then with your management computer, I assume you are using a debian like operating system (Ubuntu?), you connect to the internet on an other path. For this I use my android mobile phone with USB tethering to the management computer where I have disabled wifi on the mobile phone and on the management computer and pulled out its ethernet cord.

Look at your router what it's current public ip address, maybe on its Status or WAN page? For this example I use user pi and public ip address 185.60.216.35. Then try to connect to your internal ssh server with:

mngmt ~$ ssh -v -p 22022 pi@185.60.216.35

If it works then just omit option -v for your next connections, otherwise edit your question, paste the output from ssh to it and give me a feedback. Check before if there are some compromising entries.

  • Fantastic, thanks to you I've solved my issue. It was twofold: 1. I didn't understand very well how iptables worked. Deactivating ufw, flushing everything in iptables and reconfiguring the firewall from scratch finally opened the ports; 2. I missed the fact that my WAN IP was actually assigned on a different network interface than the one I selected to forward my ports - which also created a problem.Thanks so much. – killer_rabbit Dec 15 '18 at 3:01
  • Glad to help you :-) Thank you for the feedback to know what went wrong – Ingo Dec 15 '18 at 10:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.