Is my router not port forwarding? or is it my ISP?

Question

I know, many a port forwarding question has been asked before... But I've been struggling with my router for days now, wasting too many hours, reading everything I can find online and failing to make any sort of progress. You are my last hope!! :D

My setup is simple: a Raspberry Pi (running Raspbian Stretch) behind a ZTE Speedport Entry 2i router. I want to be able to SSH into my Pi from outside, but also to run a little web server on it.

I made sure my Pi firewall (ufw) has ports 22 and 80 open and listening. No other firewall installed (I can SSH into the Pi from another computer on the same LAN without any problem).

I have found not 1 but 2 tutorials instructing precisely how to forward ports on a ZTE Speedport Entry 2i: https://portforward.com/zte/speedport-entry-2i/ and https://www.youtube.com/watch?v=XF4ZH9FU1ew. They recommend two slightly different ways of setting up the WAN IP Host Range (one says "Make sure that WAN Host IP Range is set to 192.168.1.1 ~ 192.168.1.1" and the other recommends leaving the range as 0.0.0.0 - 0.0.0.0 — I tried both solutions).

No matter what port I try forwarding to my RPi's IP, nothing goes through. Using https://www.ipfingerprints.com/portscan.php, I always get: "Host is up. State: Filtered."

I think the IP address I'm getting from my ISP is a public one (at least it doesn't start with 10 or 176).

I thought it might be my ISP blocking port forwarding for some reason. But even when I forward, say, port 8022 to port 22, still nothing happens.

In fact, even when I enable DMZ towards the Pi, nothing is forwarded.

So it seems that some kind of firewall is creating mischief somewhere. There is a firewall installed on the router; I set it to the lowest security level, which says "WAN host can directly access LAN host, but cannot access device itself (except echo-request)."

I tried all the advice listed there (http://www.pcwintech.com/common-problems-fixes-port-forwarding), including rebooting my router, but to no avail.

Any advice would be most welcome!

Cheers, D-

Answer 1

ufw isn't installed by default on Raspbian Stretch. So for testing you should deinstall it. Instead of forwarding web server port 80 you should test with port 22 for ssh. With its debug option ssh -v you can better see what's going wrong. You should not use a demilitarized zone (DMZ). It complicates things a lot. Please disable it completely.

Your provider cannot block your port forwarding. It only sees the port you want to connect to. He cannot decide at this time that you will forward it later. But he can decide to block port 22 for ssh or port 80 for web server in general because he want to earn money with his own web server offers, maybe. So I suggest to use another port, for example 22022 to connect to the public ip address of your router.Then, of course, on your router you have to forward WAN Port Range 22022 ~ 22022 to LAN Host Port Range 22 ~ 22. Then with your management computer, I assume you are using a debian like operating system (Ubuntu?), you connect to the internet on an other path. For this I use my android mobile phone with USB tethering to the management computer where I have disabled wifi on the mobile phone and on the management computer and pulled out its ethernet cord.

Look at your router what it's current public ip address, maybe on its Status or WAN page? For this example I use user pi and public ip address 185.60.216.35. Then try to connect to your internal ssh server with:

mngmt ~$ ssh -v -p 22022 [email protected]

If it works then just omit option -v for your next connections, otherwise edit your question, paste the output from ssh to it and give me a feedback. Check before if there are some compromising entries.