Orbi with Hive hub for central heating blocking ports

[Vqmpire]

Have Orbi RBR50, Satellites, and hive hub connected by ethernet.

The hive I can see connected to Orbi has ip address but it is not able to communicate with the hive internet servers.

So as the hive flashes green and the hive says it is trying to communicate with their servers and resets etc not work then tried port forwarding...

Hive has come back with ensure ports open/port forwarding of:

1. UDP port 123 (NTP)
2. TCP port 443 (HTTPS)
3. TCP 5671 (AMQPS)

Under tab Advanced - > Advanced Setup -> Port Forwarding / Port Triggering screen

-> Radio button selected: Port Forwarding

-> Add Custom Services (button)

-> Have set

• 5671
• 443
• 123 cannot be set, as says port(s) specified are being used by other configurations.

As using PPoE have VLAN setup:

1. Internet = VLAN ID 911, Port 1
2. VOIP_VLAN= VLAN ID 100, Port 2
3. IPTV_VLAN = VLAN ID 101, Port 3

(With linkbroadbank which uses CityFibre).

[CrimpOn]

Can you confirm that this is the product:

https://www.hivehome.com/shop/connectivity/hive-hub 

It is very unusual for Internet of Things (IoT) devices to require that the user "open ports" from the internet to the customer LAN.  Most devices establish connections from themselves TO support servers on the internet.  Orbi does not block outbound connections.  (God only knows what Armor and Smart Parental Controls (SPC) do, and she's "not telling".)

Are Armor or SPC enabled on this system?

For example, almost every device will make connections to learn the current time using the Network Time Protocol (UDP port 123).  These connections are always "out" and it would make zero sense to forward port 123 from the internet to some specific device on the LAN.

Likewise, devices often establish https connections to support servers (port 443).

When you follow the directions on this page, Hive 'app' never shows the hub connecting?

https://community.hivehome.com/s/article/What-to-do-if-your-Hive-Hub-is-offline 

[Vqmpire]

It's Hive Nano 2 hub, pictures below (just disconnected for photo).

Not using Orbi Armour (Not Activated), PArental Controlls (Not Enabled) or Access controlls.

Tried the page but no luck.  Always top led flashing...

[CrimpOn]

(I have zero experience with PPoE.)

Which Ethernet port is the hub connected to?

Is there a switch between the Orbi and the Hive hub?

Green LED flashing quickly or slowly?

[schumaku]

Internet-(Data-)traffic is on it's own dedicated VLAN.

On carrier operated CPEs are using the VoIP and IPTV VLANs independent, and doing smart NAT to allow typical home LAN access for IPTV-boxes. VoIP is typically not user accessible, as the users have no access to the naked VoIP to connect user supplied VoIP or SIP phone stations.

As we're talking about a plain simple Orbi - not knowing about this ISP environment anyways - it won't take care about these 8-). All it could do is fan-out these two VLANs (== bridge) to a dedicated local network port where the user could connect e.g. a set-top box.

Not the first and and the last provider where the support people have no clue what they talk about ... happened several times here with misleading or false information ref. service access vs. port forwarding already.

Connected this IoT wonder to a port defined as bridged to the ISP VLAN (VoIP or IPTV) by error?

[CrimpOn]

This is all so foreign to me.  Would love to have directions to an explanation of "how it works" to have three separate VLAN tags.

[schumaku]

---

@CrimpOn wrote:

This is all so foreign to me.  Would love to have directions to an explanation of "how it works" to have three separate VLAN tags.

---

Not sure what you ask here - confused by these newer Orbi offering dedicated Internet, IPTV, and IoT VLANs? This isn't the same basic thing I'm drawing here. Not aware these newer consumer Orbi are supporting configurable many-to-one NAT routes sophisticated small business routers and security appliances do. Sorry, if I sound frustrated: Netgear ignored my proposal providing a design for such a router. So it came as it had to come, they implemented the minimum (very fractional) of they understood and can in the from of the vary basic MultiWAN DualWAN PR60X, Nice hardware, but by far not what I expected in this class. Check the RTFM 8-/ 

These are VLAN-tags in use on the carrier side, in the OP case by this ISP unknown to me.

What Netgear has implemented is a bridge, bringing (==bridging) the traffic of one of these VLANs to a physical port the user can use to connect a IPTV SetTop box for example. In the case of IPTV it's done because most of the consumer network equipment is not VLAN-aware. The ISP can assign an IP address by DHCP or the like, so the SetTop box is able to receive the IPTV Multicast IGMPv2 or IGMPv3 from live TV channels. Very different VOD (video on demand) is pure UDP unicast. Its done on a CGN (carrier grade NAT) method, for simplicity usually on IPv4 RFC1918 addresses.

The VLAN tags only exist on the ISP network, and don't make it to the user network

Ignore that on these examples its name IoT. usually it's plain IPTV:

Like you can get Internet (in fact the NAT router WAN Internet VLAN), you can also assign a dedicated port for IPTV.

[schumaku]

The examples showing e.g. only 2.4G or 5G Wi-Fi as a destination are not that common. Typically, one does use a defined port or two for a dedicated Ethernet connection (or two).

[Vqmpire]

Have VLAN set-up when moved to new ISP as below

Internet Service Provider: PPPoE

ROUTER INFORMATION
Hardware Version RBR50
Firmware Version V2.7.5.4
GUI Language Version V1.0.0.423
Operation Mode Router
LAN Port
MAC Address 08:02:8E:A7:43:44
IP Address 192.168.0.1
DHCP Server On
IP Subnet Mask 255.255.255.0

INTERNET PORT
IP Address xx.xx.xx.xx
Connection PPPoE
IP Subnet Mask 255.255.255.255
Domain Name Server 8.8.8.8 and 1.1.1.1

[CrimpOn]

I'm just really confused.  Ports 2 and 3 have nothing connected so their VLAN setting would seem to be not relevant.

Port 1 has a VLAN of 911, except that it is not enabled.

(once again my ignorance is obvious.... why Netgear chose to identify Ethernet ports as LAN1, LAN2, LAN3 in the Show Statistics box, but the VLAN settings refer to Port1, Port2, Port3.  Does "LAN" mean the same thing as "Port"?)

Shouldn't the VL:AN setting on Port 1 be enabled?

[Vqmpire]

Q: Shouldn't the VL:AN setting on Port 1 be enabled?

A: It is but greyed out as they do not allow it being disabled

[CrimpOn]

Can you Delete the other groups and leave only the Internet VLAN Tag on "All Ports" (not just port 1)?