RT-AC86U - simple port forward ....?!

[steef84]

Hi folks,

for days trying to simply forward a port to a service running on port 35000 on my local server 10.0.0.86.
The port stays locked for me. I want to forward this port to my ISP IP address, not my vpn client IP.

I opened a port in the gui and enabled the service:

Im using the following things on merlinwrt:

Merlinwrt latest stable RT-AC86U
VPN client 1 - policy rules strict. By putting the router via wan I believe the router should be accesable via the ISP ip right?

VPN server 1, to connect my local lan from wan, this is working good.
Yazfi - working good
Skynet - think its (might) working (too) good!
Diversion - working good

I thought Skynet might the the port locker, so disabled it, still it the ports isnt opening. The client im trying to forward the port to is not running over wan in policy rules, and thats how I like it to be. Any hints for me how to find my culprit?

 

[ColinTaylor]

I want to forward this port to my ISP IP address, not my vpn client IP.

You don't forward a port to your ISP (WAN) address, you forward it from your WAN address.

VPN client 1 - policy rules strict. By putting the router via wan I believe the router should be accesable via the ISP ip right?

Wrong. Policy rules effect outgoing traffic not incoming. Therefore you need to create an exception for 10.0.0.86 so that its traffic goes through the WAN interface instead of the VPN.

https://github.com/RMerl/asuswrt-merlin/wiki/Policy-based-routing

 

[steef84]

thanks for your reply

You don't forward a port to your ISP (WAN) address, you forward it from your WAN address.

So true. But you get the point. Thanks for the clarification and correction.


Wrong. Policy rules effect outgoing traffic not incoming. Therefore you need to create an exception for 10.0.0.86 so that its traffic goes through the WAN interface instead of the VPN.

I certainly don't want to expose my 10.0.0.86 service to my wan interface by excluding the ip. I thought that by enabling the router ip to wan in policy rules that I could reach my ISP ip on port 23154. And the port forward rule would forward it to my local port 35000 on 10.0.0.86. But that was too simple thinking I suppose? Are there any custom portforward rules neccesary if you are aware off?


https://github.com/RMerl/asuswrt-merlin/wiki/Policy-based-routing

 

[ColinTaylor]

I certainly don't want to expose my 10.0.0.86 service to my wan interface by excluding the ip. I thought that by enabling the router ip to wan in policy rules that I could reach my ISP ip on port 23154. And the port forward rule would forward it to my local port 35000 on 10.0.0.86. But that was too simple thinking I suppose? Are there any custom portforward rules neccesary if you are aware off?

As stated in the wiki, policy rules work on a "per IP address" basis and is not port based. If you want to create exceptions per port you'll need to write a script.

https://github.com/RMerl/asuswrt-merlin/wiki/Policy-based-routing

You CANNOT configure a policy that will be based on a port through the webui - only on IPs (or subnets). If you need more flexibility in your rules, you can look at this alternate manual method. Note that this method might interfere with other features, such as Adaptive QoS.