double-NAT forwarding not working

[Mine Ong]

hi all,

I recently switched ISP and was given a VDSL modem that CANNOT be used in bridge mode. However, I still like to keep my asus router for its wifi and other enhanced capability. I also maintain a few servers behind the asus router (web/ssh) but could not get port-forwarding to work. I seek your help.

First of, my ISP setting.

This is Virgin Mobile Canada which provides VDSL service through Bell Canada's network. I was given the "Steve" modem, which I believe is a refurb of Bell's Home Hub 2000. It has router capability, providing dual-band wifi (2.4/5.0GHz). It has limited NAT capability but does have DMZ and port-forwarding.

I have to use Steve to establish VDSL connection. Its internal IP address is 192.168.2.1.

Local setting:
On my Asus router, I set the WAN IP address to be static: 192.168.2.2. The Asus router also serve as DHCP server for my internet work, providing address in the 192.168.1.xxx range. From my internal computer, I can access the Web GUI for both my asus router (192.168.1.254) as well as the Steve Modem (192.168.2.1).

My ssh server is 192.168.1.210. So on the Asus router I have port forwarding rule such as:

Service Name Port Range Local IP Local Port Protocol
ssh 22 192.168.1.210 22 BOTH

On the Steve Modem, I also set port-forwarding rule such as:

Name Status Protocol Internal port External port Local IP address

ssh On BOTH 22 22 192.168.2.2


However, if I tried to access my ssh server using its external IP address, it times out, suggesting that the port forwarding isn't working.

With my previous ISP I had its modem in the bridge mode and used the Asus router to establish the VSDL connection. Port forwarding from external IP to internal IP works. The only thing I have changed on the Asus router is to change the WAN setting (from PPPoE to static IP).

I also have tried to put the router (192.168.2.2) in the DMZ of the Steve Modem, but that does not help at all.

Can anyone shed some idea of what may be wrong?

 

[bbunge]

If you have the DMZ in Steve pointing to the Asus 192.168.2.2 WAN IP you only need to do port forwarding on the Asus as it will be exposed to all incoming traffic to Steve.
While it may not be necessary I like to keep my downstream router IPs higher than the router before. So you may want to set steve to a LAN ip of 192.168.0.1

Sent from my P01M using Tapatalk

 

[Mine Ong]

looks like the DMZ and port-forwarding is completely broken in the Steve Modem, and virgin mobile tech support (4 of them) are completely unwilling to help. I connect a small linux box (raspberry pi) with ssh server directly to the LAN ports of the Steve model and 1) put it on the DMZ and/or 2) port forward port 22. Either worked.

So my problem wasn't double NAT but rather the Steve modem can't do port forwarding nor DMZ.