Open ports on WAN for service running on the router

[trec74]

Hello! I'm trying to allow incoming connections on port 5201 (iperf3) on my AC86U from the WAN port. I can't seem to find a way to do this. Iperf3 is installed on the router (using Entware) and running as a server/daemon (iperf3 -s -D). I am able to connect to it from the LAN/WIFI, but not from WAN.
I tried doing this via:
1. WAN > Virtual Server/Port Forwarding - for Internal IP address I tried both 192.168.0.1 and 127.0.0.1 - it didn't work.

2. Firewall > General > Inbound Firewall Rules - did basically the same, tried Local IP 192.168.0.1, 127.0.0.1 or blank, also didn't work.

I have successfully allowed Ping from WAN and Remote Web UI access from WAN (on port 8443/httpds), so I know my ISP is not blocking inbound connections. But can't seem to find a way to do the same for Iperf and port 5201.


Just as an experiment, I installed Iperf3 on a computer on the LAN and port forwarded to it, and it worked just fine, but I want to be able to run it on the router itself.

 

[dave14305]

That looks like the IPv6 inbound firewall rules section. The IPv4 section should be above it, with fewer columns.

Edit: However, this section only adds FORWARD rules, so if you really need an INPUT rule to open a service on the router, you probably will want to use firewall-start script.

 

[trec74]

It does appear under section "IPv6 Firewall", but there is no other section for IPv4 specifically. Here's a screenshot of the entire page:

At the same time, under Advanced Settings - IPv6 seems to be completely disabled:

 

[dave14305]

Sorry, I missed the fact you have an AC86U with 386 firmware. My 388.7 firmware has this extra useless firewall section:

 

[ColinTaylor]

As Dave said, you'll have to use a firewall-start script and add a rule to the INPUT chain.

iptables -I INPUT -p tcp --dport 5201 -j ACCEPT

 

[trec74]

As Dave said, you'll have to use a firewall-start script and add a rule to the INPUT chain.

iptables -I INPUT -p tcp --dport 5201 -j ACCEPT

That did it. Thank you both!

Can I sneak another question here or should I open a new topic - how can I start iperf3 automatically with the router start? Currently I'm manually starting it with iperf3 -s -D in Putty. I tried adding this string to the services-start script but that didn't work. Other stuff in the same script are executing as expected. I also tried providing the full path to iperf3, tried copying it to the /jffs folder, made sure the iperf3 permissions are 777 - all to no avail

 

[ColinTaylor]

Does your firmware include a copy of iperf (/usr/bin/iperf3)? It was added in recent firmware versions, but maybe not the 386.x branch.

If you only have the Entware version you'll have to start it after Entware is mounted from the USB drive. Have a look in /jffs/scripts/post-mount for Entware stuff and add your command after that.

 

[trec74]

Does your firmware include a copy of iperf (/usr/bin/iperf3)? It was added in recent firmware versions, but maybe not the 386.x branch.

If you only have the Entware version you'll have to start it after Entware is mounted from the USB drive. Have a look in /jffs/scripts/post-mount for Entware stuff and add your command after that.

It is indeed the Entware version. And your suggestion worked. Thanks again!
For the record, this is how my /jffs/scripts/post-mount looks like:

#!/bin/sh
. /jffs/addons/amtm/mount-entware.mod # Added by amtm
/jffs/addons/wireguard/wg_manager.sh init "" & # WireGuard Manager
/mnt/KINGSTON8GB/entware/bin/iperf3 -s -D

 

[ColinTaylor]

It is indeed the Entware version. And your suggestion worked. Thanks again!
For the record, this is how my /jffs/scripts/post-mount looks like:

#!/bin/sh
. /jffs/addons/amtm/mount-entware.mod # Added by amtm
/jffs/addons/wireguard/wg_manager.sh init "" & # WireGuard Manager
/mnt/KINGSTON8GB/entware/bin/iperf3 -s -D

Thanks for the update. You might want to change that hard-coded path just in case you decide to use a different device label in the future.

/opt/bin/iperf3 -s -D