Author Topic: Port forwarding (loopback) problems in dd-wrt? Using build 15778 or later? Try this code..  (Read 16391 times)

buddee

  • Big Bull
  • *****
  • Posts: 547

I have read several complaints in this forum lately about port forwarding not working properly, and just to clarify, port forwarding is from WAN to LAN which still works fine, most users are having problems with loopback (LAN to WAN to LAN or LAN to LAN). The way dd-wrt implements it currently will not work for most setups, to fix it, you can go to the webgui in dd-wrt under Administration > Commands and enter in this code, once the code is entered, click "Save Firewall" and restart the router.

 

iptables -t nat -I POSTROUTING -o br0 -s 192.168.1.0/24 -d 192.168.1.0/24 -j MASQUERADE

buddee

  • Big Bull
  • *****
  • Posts: 547

Of course if you use a different subnet than 192.168.1.1 you'll have to adjust the code to work for what subnet you use. Also, another great code, which i hope will soon be implemented into dd-wrt is..

 

 

insmod ipt_markinsmod xt_markiptables -t mangle -A PREROUTING -i ! `get_wanface` -d `nvram get wan_ipaddr` -j MARK --set-mark 0xd001iptables -t nat -A POSTROUTING -m mark --mark 0xd001 -j MASQUERADE

 

 

Which can also be saved in Administration > Commands enter the code then click "save firewall"

This code adds loopback for ALL interfaces regardless of how many different subnets you use.


bengalih

  • Calf
  • *
  • Posts: 5

Hey buddee... thanks for your post.  I had posted a couple of days ago in dd-wrt, but no answer so i thought I would come here.

 

My original post is here:

http://www.dd-wrt.com/phpBB2/viewtopic.php?p=612722#612722

 

The post basically explains a port forwarding issue to additional internal subnets.  As I saw this post of yours right when I visited the forums here I thought I would try it first.

 

I tried your first suggestion, modifying the subnet to 10.10.10.0 as that is my internal LAN that the router is on.  I fed the command via SSH, so I didn't think rebooting was necessary as IPTABLES should go into effect right away.  It didn't seem to work... I was still unable to access a port forward on the 10.10.20.0 network.

 

I then tried the commands from your second post.  For the two insmod commands I got:

 

 

root@homebase:~# insmod ipt_mark
insmod: ipt_mark.ko: module not found
root@homebase:~# insmod xt_mark
insmod: xt_mark.ko: module not found

 

The two IPTABLES commands took and then immediately I was able to access a port forward on my .20 network!

 

So, first off..thank you very much.  However, I am not content with a solution, I would like to better understand.  I am familiar with firewalls, but not IPTABLES (I am currently beginning my studies into it).

 

Can you explain to me the limitation in DD-WRT that makes this necessary, and what the two iptables commands you provide actually do.

Also, can you explain why the insmod errors?

And finally, do these command reduce security at all (other then the fact that a port forward is allowed, is there any other risk)?

 

Thanks so much!


buddee

  • Big Bull
  • *****
  • Posts: 547

This could perhaps explain better than me..

 

http://svn.dd-wrt.com:8000/ticket/1868


bengalih

  • Calf
  • *
  • Posts: 5

Thanks buddee...actually found that on my own.  Unfortunately it doesn't really explain the details...which I would like to understand the syntax a little better.

 

What's interesting (and I posted this on dd-wrt as well) is that although this is a posted fix for loopback problems it solved my issue as well.

 

The normal loopback issue is if you say forward port 25 on your mail server to your internal IP of 10.10.10.150.  If you try to access this from outside your LAN - no issues.  However if you try to access port 25 using your WAN address (instead of directly connecting to 10.10.10.150) from WITHIN your LAN you will have problems without this fix.

 

My issue isn't the same - my issue was not being able to access a port forward off of a secondary network (say 10.10.20.120) from either inside or outside the LAN via the WAN address.  I had configured two additional subnets in advanced routing and could route between them (via an intermediary router) without issue.  My port forwarding to these subnets worked fine on my old Tomato router, but not via dd-wrt.

 

Those two IPTABLES commands seem to have done the trick.

 

Anyway, maybe I will mail the guy who proposed the fix initially... thanks for pointing me in the right direction!


buddee

  • Big Bull
  • *****
  • Posts: 547

Well main thing with this is since you do not know iptables very well, i could explain all day, and you probably wouldn't understand what i am talking about, so my apologies there.

 

I will say this, loopback in general breaks certain functions of wireless, like WDS becomes broken with the old loopback code in place (before the 15778 change) and port forwarding is not loopback, port forwards work with WAN to LAN, which still works fine, loopback works with Lan to Lan or Lan to Wan to LAN, which without the input code i posted, will not work because its not letting the loopback pass by not masqurading the packets to the inner lan. Hope that  makes sense.

 

Also don't worry about the modules not found, the modules are mainly for broadcom units, Atheros does't need it but since phuzi0n came up with the code, i felt i needed to keep it fully intact, even if the mods aren't found, the code still works.


bengalih

  • Calf
  • *
  • Posts: 5

hmm...yeah.. Well I am going to research iptables in more detail...I'm pretty comfortable with routing and firewall concepts, just not coming from an iptables background.  I was interested in the syntax of the statement, as it's quite exotic compared to a standard iptables command.

 

Loopback/port forwarding should, in theory, have nothing to do with wireless functions... I have 0% insight into the code under dd-wrt, but allowing loopback functions and port forwards to internal networks are a common function on many routers.  I also had a Tomato router in previously which functioned with loopback, the port forwards I need, and WDS at the same time.  If it breaks these things in dd-wrt it's because it isnt designed well to begin with (of course...that's easy for me to say...i would have no idea how to code it better!  but then again, I'm the consumer...I provide the money, not the product).

 

My experience with dd-wrt so far hasn't been good, and I wish Tomato was supported on more devices.  It may only have 50% of the features that dd-wrt does, but those are the 50% of features that 95% of the community needs/wants, and they all work fantastically.  At least I should thank the dd-wrt developers for offering an alternate firmware supported on newer devices - even if it is buggy.

 

I think Buffalo is way out of line shipping units with dd-wrt though...as they don't offer any real support or documentation on their build of it.  I would go back to the stock firmware if only the QoS were better.  They shouldn't claim it as a feature - especially as it is cancels out the majority of the rest of the feature sets that they advertise (that only runs on their stock firmware).

 

Anyway, thanks again for pointing me in the right direction - my current situation only requires QoS and these port forwards.  I don't think I will play around with much more of the functionality of dd-wrt anyway as every one thing is bound to break something else.  I just hope at the least the router remains stable and can provide these basic functions without drop-offs.

 

cheers


windracer

  • Guest

Thanks so much for the loopback trick! It took me a while to realize port forwarding was working, it was just because I was trying to access the ports from the local LAN that made it seem like it wasn't working. It was driving me crazy!


JosephChild

  • Calf
  • *
  • Posts: 10

I've recently purchased a buffalo HighPower N300 Gigabit Wireless Router.. and I am having problems with the loopback port forwarding.  I tried the suggested lines in the firewall section.   The port forwarding seems to work for a few seconds, and then doesnt work any more.   The build that is on this router is 19438.  Do you have any suggestions for me to try?  Please let me know if you need any router information from me.


buddee

  • Big Bull
  • *****
  • Posts: 547

Which code are you using?


JosephChild

  • Calf
  • *
  • Posts: 10

sorry for the late response..  I am using the code thats showing at the top of this thread.  It doesnt seem to be working for me.  I can access everything using the local IP address, but not from my WAN IP.

 

insmod ipt_markinsmod xt_markiptables -t mangle -A PREROUTING -i ! `get_wanface` -d `nvram get wan_ipaddr` -j MARK --set-mark 0xd001iptables -t nat -A POSTROUTING -m mark --mark 0xd001 -j MASQUERADE


buddee

  • Big Bull
  • *****
  • Posts: 547

So remove that one, and try the first one i posted, make sure the 192.168.x.x matches whatever subnet you are using:

 

iptables -t nat -I POSTROUTING -o br0 -s 192.168.1.0/24 -d 192.168.1.0/24 -j MASQUERADE

JosephChild

  • Calf
  • *
  • Posts: 10

This code still wont work for me. I'm guessing I have something configured incorrectly. But everything else works fine.. and if you are outside the network, all the port forwarding works great. Here are some of the settings for my router off of the basic setup screen. Let me know if you would like to see any other information. Everything is pretty much default.

Local IP Address 192.168.1.1
Subnet Mask 255.255.255.0
Gateway 192.168.1.1
Local DNS 192.168.1.1
DHCP Type: DHCP Server
DHCP Server : enabled
Start IP Address 192.168.1.2
Max DHCP Users: 200
Client Lease Time: 1440 minutes
Static DNS 1: 0.0.0.0
Static DNS 2: 0.0.0.0
Static DNS 3: 0.0.0.0
WINS: 0.0.0.0
Use DNSMasq for DHCP: Checked
Use DNSMasq for DNS: Checked
DHCP-Authoritative: Checked


JosephChild

  • Calf
  • *
  • Posts: 10

Its interesting, no matter which code I use,  When I reboot my router (from the admin page)  for a few seconds the loopback works, then its off again.  Like something that loads late in the bootup, blocks it.


buddee

  • Big Bull
  • *****
  • Posts: 547

Before we go further with this, i want to know that you understand what loopback is, so my question to you: how are you checking to see if loopback is working? Because i can go on and on with this trying to troubleshoot something, but i want to know that you understand what you are talking about with this issue, because this all began with you just posting that you are having trouble with loopback, never did you state any details of whatever it is you are trying to do and how you are going about checking to see if loopback is working or not.