Port forwarding stopped working after moving DHCP from router to a server

[JuniorJr]

Hi.

I have had remote desktop ports working fine through our router (from the Internet) for years actually.

When I changed the DHCP server from the router to a internal Windows server... now I can't seem to 'publish' anything through the router anymore. Not even my remote desktop entries work anymore.  They're still there and configured the samw and the desktops have the same IPs, etc.

This doesn't really make sense to me which is why I'm posting.  Does the router NEED to be the DHCP server in order to pass ports through it???

Thanks!

There is a cable modem in front of the router (this hasn't changed). The router has always been setup to get a DHCP IP address from the modem.

So, we've got (and always have had....):

Cable Modem > Router > Internet wired and wireless network.

Only thing that has changed was I moved the DHCP 'duties' from the router to a server on the Internal network.  I've also copied over the same reservations that were setup on the router over to the server.

Any help/advice would be appreciated. 

[antinode · Accepted solution]

> The R6300 gets a 192.168.0.3 address from the LAN side of the cable
> modem. [...]

   Then that's not a cable modem; it's a cable modem+router, you are
cascading two routers, and the resulting "double NAT" is defeating your
attempts at port forwarding (on the inner router).

> [...] The cable modem on the Internet side gets the public IP. [...]

   Because it's a modem+router, not a simple modem.

   With only one NAT router, this stuff could work (with changes).  The
obvious choices are (1) disable the router in the cable modem+router,
making it a modem-only, and use the R6300 as the router; or (2) do the
port forwarding on the router of the cable modem+router, in which case,
it might be better to configure the R6300 as a wireless access point.

> [...] It has worked for years and now nothing "port forwards". [...]

   I can believe that it worked if you had one router, and not two
routers.  Now that you have two routers, you're approximately doomed,
until you return to an arrangement with only one router.

   So, nothing to do with any DHCP server anywhere.  (Although, a
one-router/one-subnet configuration may change your DHCP server
requirements from what they are now to something simpler.)

[antinode]

> Model: R6250|Smart WiFi Router (AC1600)

   Firmware version?

> [...] When I changed the DHCP server from the router to a internal
> Windows server... [...]

   Sounds harmless.

> [...] now I can't seem to 'publish' anything through the router
> anymore. [...]

   I don't know what that means.  Access to servers on the LAN from the
outside world now fails?  (Anything other than remote desktop?)

> [...] Not even my remote desktop entries work anymore.  They're still
> there and configured the samw [...]

   "entries"?  Are you talking about port-forwarding rules?  What are
they?  Copy+paste is your friend.

> [...] and the desktops have the same IPs, etc.

   Reserved addresses?  What are the actual address reservations?
(Copy+paste is your friend.)  Assuming that these are Windows systems,
actual output from "ipconfig" would demonstrate that these systems'
addresses really agree with the addresses in the port-forwarding rules.
(Again, copy+paste is your friend.)

> Does the router NEED to be the DHCP server in order to pass ports
> through it???

   I don't see why it would matter.  Around here (D7000,
V1.0.1.64_1.0.1), port forwarding works to systems with static LAN IP
addresses, and they have no interaction with any DHCP server.

> There is a cable modem in front of the router (this hasn't changed).

   What is this "a cable modem"?  Is it a simple modem or a
modem+router?

> The router has always been setup to get a DHCP IP address from the
> modem. [...]

   Is it getting "a DHCP IP address from the modem", or from your ISP,
_through_ the modem?  What is the WAN/Internet address of the R6250?
(The first two octets of your public IP address ("a.b" out of "a.b.c.d")
will do, if you don't want to reveal the whole thing.)

> Only thing that has changed was I moved the DHCP 'duties' from the
> router to a server on the Internal network. [...]

   I suspect that something else changed, too.

[JuniorJr]

Hi.

Firmware: V1.0.2.80_1.0.59.  It's actually a R6300

Yes, publish = port forwarding

There is remote desktop, 2 web pages (two different servers), but that's about it. (all stopped working)

Verified the IPs on the devices indeed match the IP reservations on the DHCP server.

My assumption is that the devices just need the router as the gateway?  And that is what I have set in the DHCP scope options... the router IP is the gateway in the DHCP scope options. And verified in the device's IPConfig.

The R6300 gets a 192.168.0.3 address from the LAN side of the cable modem.  The cable modem on the Internet side gets the public IP. My port forward for example, for a remote desktop is incoming port of 3389 and goes to the internal IP of a desktop:

Service Name My Remote Desktop

External Start Port 3389

External End Port 3389

Internal Start Port 3389

Internal End Port 3389

Internal IP address 10.0.0.177

The R6300's LAN address is 10.0.0.1 (and all devices have that as the gateway of course).

That's an example port forward rule. It has worked for years and now nothing "port forwards".

I also verified the firewalls on the devices have the needed ports open - for example 3389 on the one listed above.  I've also tried to disable the PC's firewall as a test - same result.

[antinode · Accepted solution]

> The R6300 gets a 192.168.0.3 address from the LAN side of the cable
> modem. [...]

   Then that's not a cable modem; it's a cable modem+router, you are
cascading two routers, and the resulting "double NAT" is defeating your
attempts at port forwarding (on the inner router).

> [...] The cable modem on the Internet side gets the public IP. [...]

   Because it's a modem+router, not a simple modem.

   With only one NAT router, this stuff could work (with changes).  The
obvious choices are (1) disable the router in the cable modem+router,
making it a modem-only, and use the R6300 as the router; or (2) do the
port forwarding on the router of the cable modem+router, in which case,
it might be better to configure the R6300 as a wireless access point.

> [...] It has worked for years and now nothing "port forwards". [...]

   I can believe that it worked if you had one router, and not two
routers.  Now that you have two routers, you're approximately doomed,
until you return to an arrangement with only one router.

   So, nothing to do with any DHCP server anywhere.  (Although, a
one-router/one-subnet configuration may change your DHCP server
requirements from what they are now to something simpler.)

[JuniorJr]

And there you have it.  I asked them today (I'm never on-site there)  if the ISP put in a new device.  "Oh yeah, they did actually".

Granted, I should have spotted it.... but you did.

Thanks. Will have to sort this out now.

[antinode]

> [...] if the ISP put in a new device.  "Oh yeah, they did actually".

   Trust no one, I always say.

> [...] Will have to sort this out now.

   What could go wrong?

   The usual problems with this stuff are:

   1. Wrong external IP address (different from the port-forwarding
router's WAN/Internet IP address).  (An intermediate NAT router, for
example.)

   2. Bad port-forwarding rule (wrong port(s), wrong target address --
including a wandering target).

   3. Server not listening on the port-forwarding target system.

   4. External influences: ISP blocking, other firewalls, ...