X6 R7900 Port Forwarding Not Working at all

[capperrice]

Running into a peculiar problem!

Windows 10 PC

Switched off Windows Defender and Antivirus - ALL OFF

Netgear Router Firmward - V1.0.3.18_10.0.42

NO VPN

I am not able to get it to work for my Windows 10 PC.  Assigned it static IP (192.168.1.8), created a custom service with both internal and external ports the same - 52007.

I started "Simple TCP Listener" program on the desktop. https://canyouseeme.org cannot see me at the port.  Looks like Router is blocking it somehow.

Not sure if I am missing something obvi - word borrowed from NCIS Los Angeles 

[capperrice · Accepted solution]

Summarizing all the steps on how to resolve this!

1. You should have something listening on the port to check if it is open or closed.  If nothing is listening, it will show as closed.

2. If you have a Router and a Wireless Modem, you should either

   a. Make Router as a "Transparent Bridge" (Frontier FIOS term) and Port Forward in the Wireless Modem. 

   b. OR Port Forward in the Router AND Wireless Modem.

3. You should make a hole in your Firewall - Windows Defender in my case - I modified in Advanced Options -> Inbound Rules and Outbound Rules.

The software I used to test

a. Simple TCP Listener but I saw that on higher port numbers you have to quit and restart.  Seems like a bug in it.

b.  Simple Port Tester - The catch is it will set up a rule in Firewall that this program has all ports opened (and closed) during testing.  Thus during testing it will open a port, listen on it, sent the request from its website, if received, report success, port is closed.

Special Thanks to @antinode.  He/She is very knowledgeable. 

I am marking this as Solved!  

[antinode]

> Assigned it static IP [address] (192.168.1.8), [...]

      https://community.netgear.com/t5/x/x/m-p/1886694

> I started "Simple TCP Listener" program on the desktop. [...]

   How did you test that from a system on your LAN?  (It should be
possible using a Telnet client program.)

> [...] Looks like Router is blocking it somehow.

   Or, something else is wrong.

[capperrice]

@antinode  I see that you have been extremely helpful for many years!  Thanks indeed!

Point well taken - Static and Reserved Dynamic IP Addresses are different.  I have a Reserved Dynamic IP Address

Is it possible to check/verify at the Router itself if it received the request from the website at the port?   If Router received it and forwarded it correctly (is it possible to check that too at the router - through logs perhaps?), then it is my laptop that is blocking on it. 

[antinode]

> Is it possible to check/verify at the Router itself if it received the
> request from the website at the port? [...]

   Not easily, but you should be able to send your own request from a
system on your LAN.

> I started "Simple TCP Listener" program on the desktop.

   Why?  Is getting that to work your final goal? I f not, then what is?

   What are the client and server programs which you would use normally?

>       https://community.netgear.com/t5/x/x/m-p/1886694

>    Can you connect to the server from a system on your LAN, using the
> server system's LAN IP address (the one in your port-forwarding rule)?
> If you can't access the server locally, then there may be little chance
> of doing it from the outside world.
>

>    If that works, then, still from a system on your LAN, try using the
> router's WAN/Internet IP address.  That should verify the
> port-forwarding rule(s) (and the "NAT loopback" feature of the router).

   Plenty of other questions/suggestions there, too.

   If you don't have real client and server programs ('I started "Simple
TCP Listener" program'), then you can use a Telnet client program to
talk to almost anything.  (Or, at least, open a connection to it.
Whether you can send a meaningful message to it, and get a meaningful
response from it, depends on the actual server program involved.)  On
Windows, you might need to enable it before you can use it:

      https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/telnet

   Then, to talk to a program which is listening at port 52007 on a
system at IP address "192.168.1.8", a command like the following should
work:

      telnet 192.168.1.8 52007

   Error message syntax varies from system to system, and I don't have a
Windows system up at the moment, but a typical failure might look like
this (on a Mac, where "10.0.0.1" is my router (LAN)):

      $ telnet 10.0.0.1 443
      Trying 10.0.0.1...
      telnet: connect to address 10.0.0.1: Connection refused
      telnet: Unable to connect to remote host

   "Connection refused" means that basic communication with the system
at "10.0.0.1" worked, but no one there was listening at port 443.  With
port 80, I'd expect a different result.)

[capperrice]

Trying to develop a small temporary website that reads data from different sources and accepts data from the user and displays multiple reports.

I ran telnet server on my system on port 52007.  I was able to connect to it using command telnet client from another system at the same port.  I then punched holes through Windows Defender (firewall.cpl -> Advanced Settings -> Created rules for Inbound and Outbound.  Did not specify a program as I am in the process of developing it.  Just want to check if the port is open.  Turned Windows Defender to ON.

I was able to telnet successfully to the server (the hole in Defender works!)

My Router setup:

Wall Socket -> FIOS Router (192.168.254.254)

FIOS Router -> DHCP to Nighthawk X6 R7900 (192.168.254.11) (FIOS Router WiFi turned Off - Only one ethernet connection to Nighthawk)

Nighthawk -> DHCP to other devices

All Telnet attempts below were made from another laptop

Case 1

Telnet to 192.168.1.8:52007 (my Laptop with Reserved Dynamic IP Address - got the name right ) - WORKS!

Case 2

Telnet to 192.168.254.11:52007 - WORKS! i.e Request is forwarded to my laptop.  Port Forwarding Works from inside LAN!

Case 3

Telnet to 192.168.1.1:52007 - DOES NOT WORK!  (IP of Nighthawk to access admin functions)

Case 4

Https://canyouseeme.org - Port 52007 - DOES NOT WORK!

Perhaps, Frontier FIOS router blocks inbound port requests?

[antinode]

> My Router setup:
> Wall Socket -> FIOS Router (192.168.254.254)
> FIOS Router -> DHCP to Nighthawk X6 R7900 (192.168.254.11)

   There's your problem.  Cascading multiple routers can cause multiple
problems, including this one.'

> (FIOS Router WiFi turned Off - Only one ethernet connection to
> Nighthawk)

   Disabling the wireless radio(s) in the "FIOS Router" does not stop it
from being a router.

> Perhaps, Frontier FIOS router blocks inbound port requests?

   Certainly, not "Perhaps".  People in the outside world are talking to
that router, so that router is where you'd need to do port forwarding,
except that your server is connected to a different router.

   The usual solutions are: 1) Configure the inner router (R7900) as a
wireless access point, or 2) Configure the outer router ("FIOS router")
as a non-router (modem-only, "bridge").  I don't know what your
(unspecified) "FIOS router" is, so I don't know if it offers a good
modem-only mode.

> Case 2
> [...] Port Forwarding Works from inside LAN!

   Naturally.  It might work from the outside world, too, if your R7900
were connected directly to your ISP, but you have another router in the
way.

> Plenty of other questions/suggestions there, too.

   Including this one:

> Does the IP address of the WAN/Internet interface of your router
> match what you're using as your public IP address from the outside
> world? (ADVANCED > ADVANCED Home : Internet Port : Internet IP Address)

   Answering that one might have saved everyone some time and effort.

   You might want to check that on your (unspecified) "FIOS router",
before doing more work, and then discovering that you have a still
bigger problem.

[capperrice · Accepted solution]

Summarizing all the steps on how to resolve this!

1. You should have something listening on the port to check if it is open or closed.  If nothing is listening, it will show as closed.

2. If you have a Router and a Wireless Modem, you should either

   a. Make Router as a "Transparent Bridge" (Frontier FIOS term) and Port Forward in the Wireless Modem. 

   b. OR Port Forward in the Router AND Wireless Modem.

3. You should make a hole in your Firewall - Windows Defender in my case - I modified in Advanced Options -> Inbound Rules and Outbound Rules.

The software I used to test

a. Simple TCP Listener but I saw that on higher port numbers you have to quit and restart.  Seems like a bug in it.

b.  Simple Port Tester - The catch is it will set up a rule in Firewall that this program has all ports opened (and closed) during testing.  Thus during testing it will open a port, listen on it, sent the request from its website, if received, report success, port is closed.

Special Thanks to @antinode.  He/She is very knowledgeable. 

I am marking this as Solved!  

[antinode]

> 2. If you have a Router and a Wireless Modem, [...]

   If you have two _routers_, then you should do something to one of
them so that you have only one router.  See "The usual solutions are:
[...]", above.

> [...] and Port Forward in the Wireless Modem [...]

   Port forwarding should be done in the (one) router (which might be
combined with a modem).