Orbi Doesn't Port Forward 80 to Synology

[AC360]

I am trying to setup synology external access with my ORBI.  I was able to quickly setup port forwards using UPnP and all the port seems to be connecting... except port 80.  And I think i'm unable to get a DDNS certificate because of this.  Does anyone have the same problem?   

[CrimpOn]

You are ahead of me.  I thought "Port Forwarding" would be set up on the Advanced Setup Menu "Port Forwarding", not UPnP.

Seems like a pretty straight forward thing to do.  Specify that external port 80 goes to port 80 on a particular IP address.

I doubt that DDNS has anything to do with this.  I was confused because I thought I was setting up DDNS with "myname", and then found that the actual DDNS name was "myname.mynetgear.com".

[AC360]

I was advised by Synology service tech to not use UPnP as it is unstable and instead to setup port forwarding rules manually.... followed the steps in this article:

https://kb.netgear.com/31069/How-do-I-configure-port-forwarding-on-my-Orbi-system

I added 3 custom service rules. 1)l ports 5000-5001 2) ports 80, 443 3) ports 9025-9040, 5002, 5004.

I also rebooted the Orbi after adding these changes.

When I check with a port checker tool, all of them are closed...

What can I be missing?

[CrimpOn]

Can you take a screen shot of the port forwarding page?

(I do not think "rebooting" is necessary.)

[AC360]

Here is the screen shot of the Port Forwarding page....

[CrimpOn]

This certaily looks correct to me.  In all this, I forgot to ask what the Orbi is connected to.  Obviously, the Orbi is in "router" mode.  If it is connected to another router rather than directly to the internet modem, port forwarding is not going to work.  One quick test is to do a "trace route" to some external IP adddress, such as Google DNS (8.8.8.8) from any machine on your LAN.

The first "hop" should be 192.168.1.1 (the Orbi gateway).

The second "hop" should be a public IP address, i.e. not one that starts with 192.168 or 10.0

[AC360]

It is in router mode... and i have the ORBI connected directly to the modem.

Now, when I did the tracer test, the first "hop" was to 192.168.1.1.  However, the second "hop" was not to Google's 8.8.8.8.

The second "hop" says ***

3 - 9 are to various addresses 

and the 10th is 8.8.8.8

[CrimpOn]

I think you are OK as long as the second hop is not a 192.168.0.x address.  Having two routers will definitely break port forwarding because incomming packets will not get through the first router.

[AC360]

ok...  any other things i can do to check why the orbi is not port forwarding?

[CrimpOn]

Can you provide the brand and model number of the internet modem?

If you look on the Orbi Advanced Tab, Home Page, under "Internet", what does it say for IP address?

What port checking tool are you using, and how?

[AC360]

My modem is ARRIS surfboard SB6183.  I went into the admin page and it doesn't seem to have any port forwarding options.  In fact, there is not much you can configure manually.

On the advanced home page, under internet port, the IP address is my external ip address.

The port checker tool I'm using is https://www.yougetsignal.com/tools/open-ports/

[CrimpOn]

Thank you for being patient.  I performed a test on my Orbi:

• First, I created port forwarding to a computer on my network to a port that is not open (81).
  The on-line tool reported the port "closed."
• Then, I created port forwarding to the same computer to the web server port (pi-hole).
  The on-line tool reported the port "open".

My tentative conclusion is that the on-line tool will only report a port open when it receives a response from a TCP connection attempt.Th e Orbi forwarding packets may not be enough to confirm the port "open".

So, a test (for you). 

• Are you able to connect to port 80 on the Synology using a web browser inside your network?
• Is there any setting in the Synology restricting which IP addresses it will allow to connect?

In short, I think that the Orbi actually may be forwarding connection attempts to the Synology, but the Synology is not allowing the connection, which shows up as "closed."

It is possibe to verify this, but it is a chore.  You can open a "debug session" on the Orbi to record all of the WAN/LAN traffic.  Perform the connection attempt.  Then close the debug session, save the debug file, and open the WAN and LAN recordings in a program like Wireshark.  It should show the packet coming in and going to the Synology, but the Synology not responding.  I do this all the time, so I have gotten used to it.  The first time, this is a serious time comittment.