topic Re: Port Forwarding - ports closed in Broadband

Port Forwarding - ports closed

charliepaterson — Mon, 28 Aug 2023 14:22:33 GMT

I'm trying to set up port forwarding to my home server and struggling.

DNS is all working fine - pinging the domain gets rerouted to the router

I have set up port forwarding on the router to direct it to the (reserved) ip of the server

However nothing gets through to the server itself, and when using portchecker.co both 80 and 443 are reported as being closed. Is there something else I should be doing to get this working?

Re: Port Forwarding - ports closed

KeithFrench — Mon, 28 Aug 2023 14:50:27 GMT

There is nothing wrong with your rules. What sort of device is hosting your server? Does it have its own firewall (do not touch the router's firewall)? If so, have you allowed the two ports through that firewall? Is your web server bound to this 192.168.1.38?

Re: Port Forwarding - ports closed

charliepaterson — Mon, 28 Aug 2023 15:18:44 GMT

@KeithFrench

It's running TrueNAS Scale - no additional firewalls as far as I can tell

It has a static IP of 192.168.1.38 - and I can access the web UI on that ip address just fine from within the LAN

Re: Port Forwarding - ports closed

KeithFrench — Mon, 28 Aug 2023 17:01:14 GMT

What are the following set to on the network card of the NAS:-

Subnet mask
DNS server address
Default gateway address?

Re: Port Forwarding - ports closed

charliepaterson — Mon, 28 Aug 2023 17:13:00 GMT

Thanks for helping

Subnet mask: 255.255.255.0
DNS server address: 1.1.1.1 and 1.0.0.1 (cloudflare)
Default gateway address: 192.168.1.1 (router IP)

Re: Port Forwarding - ports closed

KeithFrench — Tue, 29 Aug 2023 07:39:17 GMT

Thanks for that, it is all OK. I think I know what the problem is, but I want to make sure I understand what you want to do.

Is this NAS a self contained unit, running it's own operating system, which you have no direct access to? You can only change certain things within its browser interface & it is this that you want to access remotely?

Re: Port Forwarding - ports closed

charliepaterson — Tue, 29 Aug 2023 08:00:19 GMT

The NAS is a self contained unit, I do have access to it (it's in the attic) and the web ui is pretty comprehensive in terms of things I can change - and includes a shell terminal for fiddling with the linux based OS directly.

It runs "apps" including Jellyfin/Plex which are what I'm more interested in accessing remotely than the web UI itself - it has an internal reverse proxy so if mydomain.com points to the server itself, jellyfin.mydomain.com will be rerouted to the jellyfin app and let me stream my movies outside of the house. Similarly with HomeAssistant so I can check my dashboard remotely, host a vpn so I can play LAN games with friends, stuff like that

Re: Port Forwarding - ports closed

KeithFrench — Tue, 29 Aug 2023 09:53:45 GMT

Thanks for that @charliepaterson.

I think that the NAS is blocking access to connections coming into it from any other IP network, apart from its local network of 192.168.1.0, by default. Is there anything in the NAS documentation and or support website to confirm or deny this? If it is disabled by default, you will need to find out how to enable access from other networks.

It is easy to find out if TCP ports 80 & 443 are open, but the NAS would appear to be going a stage further by checking the IP packet's source IP address as well. If you can install Wireshark on the Linux part, that would prove it.

Re: Port Forwarding - ports closed

charliepaterson — Tue, 29 Aug 2023 10:14:05 GMT

I haven't found anything that would suggest that and many others are able to do what I'm trying using the OS, their support suggested I checked with my ISP - that said I can look into it a bit deeper this evening when I get home from work and double check with them. Should be able to stick Wireshark on it and see if anything gets through.

I have had some success previously using Cloudflare "tunnels" which seem to be akin to a vpn between the NAS and cloudflare, unfotunately they are rate limited which made the usability a bit suspect, and acting like a vpn might be bypassing your suggested blocking.

Will update you when I get a chance to do some testing, if you have any other ideas I can check please let me know! 🙂

Re: Port Forwarding - ports closed

KeithFrench — Tue, 29 Aug 2023 10:25:25 GMT

The router works fine forwarding these ports, I have rechecked it this morning. I can analyse any Wireshark traces if required.

Re: Port Forwarding - ports closed

Piethorne — Tue, 29 Aug 2023 20:41:31 GMT

NAT Loopback ?

Re: Port Forwarding - ports closed

KeithFrench — Tue, 29 Aug 2023 20:46:59 GMT

No, it is not that @Piethorne the OP says:-

"when using portchecker.co both 80 and 443 are reported as being closed."

Re: Port Forwarding - ports closed

charliepaterson — Tue, 29 Aug 2023 21:04:47 GMT

Hmmm wierdness ensues. Wireshark showed nothing getting through at all on 80 and 443

I restarted the router and now portchecker.co now lists both 80 and 443 as open

This makes me think @Piethorne might be right in it being NAT loopback, I hadn't considered it because of the original port issue

Re: Port Forwarding - ports closed

KeithFrench — Tue, 29 Aug 2023 21:06:53 GMT

Well, I was just going on what you said originally. Still, if it is working now, that's great.

Re: Port Forwarding - ports closed

Piethorne — Tue, 29 Aug 2023 21:12:03 GMT

I've made and repeated many mistakes over and over when setting up webservers. The 2 most common I've made is not having the server up and running when doing a port check. The second is forgetting about NAT Loopback. After that is not opening the ports on the server and the firewall. As @KeithFrench has said - as long as it's working...

Re: Port Forwarding - ports closed

charliepaterson — Tue, 29 Aug 2023 21:27:11 GMT

Yeah it seems like I was running into a pair of issues simultaneously

Activating proxy on cloudflare bypasses the NAT loopback problem, but seems to have some of the rate limiting issues I was having with the tunnels earlier. Guess I need to get a new router if the TT one won't support it natively