[Q] Port Forwarding concerns.
-
Bogus port status reporting
First of all, I am stuck with Comcast. Not by choice. Bear that in mind whilst reading.
I am currently seeding at an average of 720 kb/s, so no, this is definitely not a n00b question. I have popped into the IRC channel a few times, but I'm a quiet guy. Been here for several years seeding things in the background. I'm working on my 2 TB seeding goal. Please send me requests if you need me to seed anything. I will have another box, a linux host, set up this month as a seedbox.
I am experiencing an issue with port scanning. Normally, this is not a bad thing. On any website I visit to scan my external IP, the ports 6881-6999 are reporting closed on their web portal.
-
I have a TP-LINK Archer C9 set as DHCP reserved (Comcast: 10.0.0.X) DMZ behind a Comcast ARRIS modem/router set into bridge mode as TP-LINK Archer C9 is set to the reserved 10.0.0.X DMZ host on the Comcast router.
-
TP-LINK Archer C9 has DHCP reservation for host PC.
-
TP-LINK Archer C9 has Virtual server for DHCP reservation for host PC coming from ports 6881-6999 external to 15667 on host PC.
*** TP-LINK Archer C9 has port triggering for DHCP reservation for host PC triggering port 15667 internal to open 6881-6999 as needed on TP-Link Archer C9. -
PeerBlock on host PC is set to allow in/out from port 15667 UDP/TCP * Windows Firewall on host PC is set to allow in/out from port 15667 TCP/UDP ***** Windows Firewall on host PC is set to allow qBitTorrent 3.1.1 in/out from port 15667 TCP/UDP
Port scanners tell me I'm still closed, yet I can still seed correctly. Quite obviously my forwarding rules are all working. What gives with the bogus closed status on the web portals (elsewhere)? qBitTorrent reports working NAT.
You should also know that I have IPv6 to 4 tunneling turned on on the TP LINK Archer C9 as there is a known firmware bug which causes a crash on the Comcast ARRIS modems, resulting in packet data loss when you use certain IPv6 protocols.******
-
-
I can tell you with certainty that your problem is going to be with the fact that you're changing out an external port range for an internal port number and vice-versa… This makes for a recipe to get signals crossed as there is variation in the ports that are used. Also, make sure that this forward rule is in place both for TCP and for UDP ports as torrent clients use both.
My suggestion would be to use the standard method of port forwarding and using just the single port that your torrent client requires, as the majority of us do. When you leave a port range forwarded to a single port, it creates a much more complicated situation than you really need to, ESPECIALLY if you do not have both the DNAT and SNAT properly configured to convert the packets on the fly.
-
Wew, this post is old. I'm so glad I got rid of Comcast. I have a hardware VPN new and a lot more experience. (been doing CentOS and RedHat VPS as of late) Haha, its entertaining to go over my old posts like this. But thank you for the assistance.
-
Hehe… My network is WAY more complex now than the standard setup. I have SEVERAL IP subnets across my main network.
On the public facing side, I have the static /32 address for the main connection within the router, then I also have a static /28 and a static /30 subnet, which are public.
From there, I have THREE (soon to be FOUR) DSL lines (all with separate modems) that come together into a single router that bonds them together using MLPPP. That's the ONLY way I can get a fast enough speed out here to be able to stream movies in 1080p HD. THAT in and of itself was rather complex to arrange.
192.168.1.0/24 (Modem 1 - Port 1)
192.168.2.0/24 (Modem 2 - Port 2)
192.168.3.0/24 (Modem 3 - Port 3)
192.168.4.0/24 (Modem 4 - Port 4)
192.168.0.0/24 (Main LAN - Port 5)Anything that is plugged directly into the main switch will get an IP address on the main 192.168.0.0/24 subnet, and also, anything plugged into any of the modems will automatically obtain an IP address on the respective subnet for that modem.
From there, I also have 192.168.5.0/24, which is reserved for anything connected to the main wireless router inside the house. In order to get there, it must hop through 192.168.0.252 to get to the desired destination IP address. There is then also a line that runs from the main switch, out the outside wall of the house, into the ground, and across the back yard some 200 feet to the trailer, where the line then reappears out of the ground behind the trailer, and connects up inside of the trailer. Anything attached to the router inside the trailer will be assigned 192.168.100.0/24, and will hop through 192.168.0.251 to get to the destination IP on the trailer's subnet.
So... As you can imagine, the concept of port forwarding is nothing new or foreign to me, and in my case, is a LOT more complicated. My laptop for example will come up as a different IP address on the /28 subnet than anything else connected inside of the trailer. There's also a 1:1 NAT translation for a few devices, in order to have those devices directly exposed to the internet (such as the VoIP box, and the server), while keeping the rest of the devices on the network masked behind one of a couple of public facing IP addresses on the network.
It gets rather complicated, but in the end, as long as everything works properly, where's the problem? hehe
So... If anyone should need further assistance, I support a LOT more advanced networking than just your standard home network. Every last stitch of hardware and wiring for my network (including the DSL lines themselves where they come off the NID into the house) was completely custom constructed, programmed, and installed my be. Every single network cable in my arsenal across the entire network was 100% custom created by ME to be the EXACT length it needs to be, without ANY excess cable to be found anywhere. Also, if it's of any value, I'm probably one of the only people you'll ever be able to find who can help support and troubleshoot issues with MLPPP.... It's a dying technology from back in the early 90's, but in cases like mine, it's a very valuable tool because it allows me to bond my THREE, soon to be FOUR DSL lines together to be able to enjoy their combined speed as a single line, so that I can actually get a fast enough speed to be able to do things like stream in 1080p HD, as a single DSL line that only gets about 3.5 mbit down in throughput, simply will NOT cut it.
Tis the down side of being in the middle of nowhere, where the only internet option is oldschool pre-Y2K legacy COPPER based ADSL2 service. When you combine that with the fact that I am just over 5 KMS from the SLAM, in theory, I shouldn't be able to get the 4 meg profiles that I'm getting, and I should only be able to get a 1.5 meg profile per line. Sadly, with copper based DSL, distance is NOT your friend. This is a large part of why I am sharing the connection with my nearest neighbour (and really, my ONLY neighbour), along with the power line that has been run underground to connect my trailer into their main breaker panel to get power. It was a royal pain in the ass to have to dig not one, but TWO different 200 foot long trenches between the house and the trailer in order to be able to bury both the underground network and underground power hookups, without running them on top of each other, which would degrade the quality of the network line that runs to the trailer, but it was TOTALLY worth it. Before when the connection was all wireless out to the trailer, it was a NIGHTMARE any time we got too hot and humid, too wet, or too windy weather conditions, as it would just screw with the wireless between the house and the trailer. Now, I'm quite glad that the only parts of my network that are wireless are either from the main wireless router inside the house to a wireless device inside the house, or it will become wireless once it's already on the inside side of the walls of the trailer to a wireless device (usually just my phone) inside the trailer. The result is that I have reliable WiFi in ANY kind of weather conditions.
-
I can relate to what you are saying. The original questions sounds very n00bish to what I have done, now. and hey! I have a packet bonder, too. I don't have the DSL failover, though, simply because DSL isn't available in our area. They either push 56k, or the solution of using limited, questionable satellite services in a national forest. I was lucky my high dbm LTE antenna found a sweet spot.
I was lucky enough to be able to own a 250 octlet on the public IPv4, which is nice. Though I've had complaints sometimes when I visit a website, I will be coming from 2-3 different IP addresses (nearly similar, one or two numbers off on the 4th octlet), but I guess thats how my bonder splits packets and load balances (if heavy or one of my pipes has issues). I have two private subnets with a public crossover point through VPN. I can see you aren't messing around, either. Haha.
Big home LAN and subnetting ends up happening when you reach DHCP assignment limits because of clustered computing. My paralella cluster takes 128 assignments, by itself. Subnetting things off, load balancing, and fire-walling HAS to be a thing over here.
192.168.2.0/12 lte rodem 1
192.168.1.0/12 lte rodem 2
192.168.0.0/24 bonder, load balancer
192.168.3.0/24 VPN, firewall, thru linux workstation
–unmanaged switch
| 192.168.4.0 router 1 - lan 1
----unmanaged switch
------ps3, ps4, retropie, pcs--
----wi-fi antenna (cieling mounted)
------batman phones, bomb-deactivation devices, >:D whatever--
| 192.168.5.0 router 2 - clusters
-- | 192.168.5.100 cluster parent node 1--
-- | --managed switch, receives data from children--
-- | ----child nodes 1-63 --
-- | 192.168.5.101 cluster parent node 2--
-- | --managed switch, receives data from children--
-- | ----child nodes 64-127 -- -
Hehe… Similar in design, but slightly different in terms of the topology used to create the network.
I'm about the only person that I know that still supports such an ancient technology from last century (1990's to be exact) such as MLPPP. Originally, it was used in the VERY late 80's, but more-so into the 90's as a means of bonding multiple DIAL-UP modems together to get a faster speed. In my case, I made a few configuration tweaks to turn MLPPP into MLPPPoE :funny2:
The key difference is that instead of bonding multiple dial-up modems together, I'm bonding multiple ADSL2 lines together. Sadly, I'm just over 5 KM from the SLAM, and sadly, the ENTIRE circuit is oldschool coagulated COPPER... We're not even lucky enough to have FTTN out here (although TFFC, FTTB, or FTTH/FTTP would be preferred), so in theory, I should only be able to qualify for a 1.5 meg profile... A little pimping out of my services and swapping out the shitty ass CAT3 from the NID at the side of the house to the POTS splitters inside the house with CAT5e, as well as upgrading the lines from the shitty ass telephone cables to a custom made CAT5e jumper all the way to the modem (among a few other changes that I made), and by some miracle of physics, I managed to get all 3 lines stable at a 4032/800 (4 meg) profile. What sucks though is that on the most part, lines 1 & 3 can handle a 5056/800 profile... Sadly though, line 2 for some reason will only handle 4032/800 if I want it to stay stable, which sucks because when you're talking 3 - 4 lines, a 1 meg drop on even ONE line will mean an overall reduction of speed by 3 - 4 meg (1 per line more or less).
Sadly, on 3 DSL lines, I'm still only cranking out 9.75 - 10.5 meg down, and a mere 1.8 - 2.25 meg up. Admittedly, the installation of line #4 this month is more for the upload speed than the download speed. From there, I had to get creative with the wiring to make sure that I would have decent, solid, and reliable WiFi both in the house and the trailer.... So yeah... Advanced networking has kinda become my forté.
I also took the wiring for power and such to a whole new level, using a brand new car battery from a 2003 Nissan Pathfinder that my roomie's brother had kicking around, a car battery charger that I had kicking around in the basement, and a 150W inverter to convert the 12VDC to 120VAC, along with a custom ground adapter that first plugs into the inverter. It's a simple adapter really. It's just a short little about 6" long piece of 14 gauge wire with a male plug on one end, and a female plug on the other. On the female end of the adapter, I have an additional ground wire that connects to the ground pin, which runs over to the same clamp that clamps the ground wiring for the hydro (electrical) panel to connect to the water pipes (because we're on a well, so no copper piping actually runs underground, thus the water lines need to be grounded somehow). This way, I have the same 120VAC connection with a proper ground terminal, all running off of a 12V car battery.
The concept is simple... When the hydro (electricity) is on and running, the car battery charger kicks in and both charges the battery AND runs the electrical load off of the inverter at the same time. When the hydro goes out, just like shutting your car off, physics kick in and the inverter begins to draw off of the battery seamlessly, instead of the charger. This way, the hydro has to go out for at LEAST 51 hours before I lose my precious internet. Inside the house, all the main network guts connect into the inverter, which consists of the FOUR DSL modems, the main Mikrotik router, the VoIP adapter, the main switch that links all the guts together, as well as the WiFi router inside the house. So literally in a power outage, the ONLY thing that keeps working inside the house as it is now is my precious WiFi and VoIP lines (which actually also run out to the trailer). Out at the trailer, I have a secret weapon... A 2003 Nissan Sentra, a pair of jumper cables to run the battery terminals into the inside of the car and keep the hood closed (for rain/show protection), a 750W inverter (which is powerful enough to run my ENTIRE trailer, except the electric heat, thanks to the magic of LED lighting), and a bigass extension cord to run from inside the car to the back of the trailer. Before powering the inverter on to be able to power the trailer, simply start the engine, and instantly, the alternator on the engine quite literally acts as a generator to maintain the charge in the battery, and run the electrical system inside the trailer for up to 48 hours on a single tank of gas.
The next planned upgrade is going to be to run a second CAT5e cable to the trailer to run the VoIP lines only. That way, I can use the two spare pairs of wire in the existing CAT5e cable to run PoE instead of VoIP lines, which will allow me to upgrade the wireless router inside the trailer to one that can be powered by PoE. This way, my precious porn downloading will not be interrupted in the trailer in the event of a power outage, because although it may take me a few minutes to hook up the trailer, the wireless router that the laptop plugs into inside the trailer will be powered by PoE, and because of the nature of a laptop having a built in battery backup, not even my precious porn downloads will not get interrupted by a power outage.
I like to call my network style here "HARDCORE" :funny2: :funny2: :funny2:
You would almost seem to think that I run a home based IT business and got fed up with the frequent power outages (the inevitable result of living in the middle of nowhere squared) that were causing me a great deal of difficulty doing things like updating websites for a customer, or otherwise conducting my business online. As for the heat in the trailer, in the event of an extended power outage, that's what I have a propane stove and a fan for in the event that I need heat when there's no power. I have a little over 51 hours of emergency reserve power, and if I need more, I can just connect a second car battery in a parallel to the existing one and more than double the allotted time that I have. That being said though, the longest the power has EVER gone out here (with ONE exception) has been 33.5 hours. The only time it EVER went out longer than that was back in 2003. I was out for almost 3 DAYS as the result of the largest blackout in history...
Do I get the award for the most hardcore home networks setup? It's designed to more or less NEVER go down, even when the power goes out for an extended period of time.
-
My GOSH, you aren't kidding. I'm faced with the SAME situation out here. They absolutely REFUSE to update the lines out here. Its copper circa 1960s. The worst part being the ISP here does offer DSL, but it ends up being slower than dial-up as we 'are on a trunk line' being the excuse. I had to seek out LTE solutions, we attempted Satellite, and found how much of a scam they really are. The HughesNET advertisements go straight to the burn barrel (the middle of nowhere comes with processing your own trash, as you're aware).
I can definitely see that reflection from others. When they see my set-up out here, its a 'holy crap, what a nerd' moment, until they have a crack at browsing the internet here. Its most definitely a breath of fresh air to be able to watch their programs when they would like and on-demand (I don't just seed here). Our neighbors made the same attempt, inspired by me, but it was a feeble one. I told them they have to call up a few telecommunications contracting companies. I got my grandfathered account from Cyberonics telecommunications, and have a packet bonder in a similar style to yours, but designed to handle things most definitely not PPoE. They contract out unlimited LTE accounts to businesses and consumers. Useful information to anyone wanting actual broadband in the middle of nowhere. (DM me if you want referrals!)
Funnily enough, I built an air-cooled toolbox. So this solution is pretty portable.
All the hardware aside the external antennas tucks right into it. Airflow and custom-drilled ventalation holes to keep it all cool.
Called it the "Internet Attack Box" -
Haha… I forgot to mention... I live in the trailer in the bush in the back 40 of my friend's property. He lives in the house. The output feed from the MLPPP router feeds to the opposite corner of the basement, where all the extremities of the network in the house wire together, as well as a line that runs across the basement ceiling, out the wall to the outside, into the ground, then across the back yard UNDERGROUND for the 200 foot stretch to my trailer, where it then reappears under the one back corner of the trailer to connect into the WAN port of the wireless router inside the trailer. This way I can have good WiFi coverage both in the trailer AND in the house hehe
To give you an idea of what I've done, we have the following:
"Grand Central Station" (where all the DSL lines come in and bond together, and where the dial tone on the two VoIP lines that even run to the trailer begin)
"LAN Central" (where the DSL lines come in as a single line, and split to the rest of the house… Also where I've mounted a keystone box to drop the 1000mbit LAN link down to 100mbit instead to also run the two VoIP lines through the same line for now until I bury a second cable)
In the event of a power outage, all of that can be powered as follows (and yes, these pics were taken during a power outage because my ISP couldn't understand how I was the ONLY customer in sync in the area… I have since added the ground adapter, mounted things to the wall, and changed out the inverter so I could use the bigger one for my trailer, but you'll get the idea):
Lastly, we have the trailer itself… The only difference between the two keystone boxes (in the house and in the trailer) is the one in the house does NOT have the two blue ports....
Simply put, the orange network jack on each end has all FOUR pairs of jumpers connected to it, so as to be dedicated as the "underground" jack. The white network jack only has the green and orange pairs connected. On the house side, this drops the network down to 100mbit (instead of the 1000 that comes off the switch), then connects the blue and brown pairs each to their own phone jack to connect the VoIP lines into the cable... In the trailer, those ports are wired EXACTLY the same, which splits up the underground cable from a single cable down into its respective three ports. The two blue ports in the trailer are merely an extension of the two unused ports on the back of the wireless router, as to make the 1000mbit LAN links into the router inside the trailer easier to access. This keeps everything tucked against the wall nicely, thus keeping the wiring out of the way. If I want to hop back to full 1000mbit service, I can simply move the underground line on each end, but I lose the two VoIP lines in the trailer.
Now here's the real kicker… Despite all the different off shoots and such throughout the house, and the link out the trailer, the ONLY NAT that is used AT ALL lies within the MLPPP router. So... Need help with port forwarding? I can support MUCH more advanced port forwarding setups hehe
-
doesnt MLPPP require that your ISP have specials line with mlppp enabled? I saw in canada itel http://itel.com/ltt-bonded/ that does that but very expensive ( from youtube Linus https://www.youtube.com/watch?v=tqbnjgbtDl0&t=334s ) or can you do it with any ISP even different ISP for redundancy ?
-
I believe what you're referring to is bonded pair DSL, which is similar to MLPPP in that it uses the same basic concept, however it requires that all the lines are fed from the same SLAM off of the same CO. In my case however, it is a little different, because although all my lines are fed from the same CO, they are NOT fed off of the same SLAM because that simply wasn't possible. Instead, my ISP took advantage of the fact that Bell (the oligopoly) opened their network's last mile wiring to the wholesale market. the last-mile wiring to the home is 100% resold Bell, however the PPPoE login that you use determines what actual provider that will handle the PPPoE session. On my ISP's end, they have TWO domains that they can use for their PPPoE logins that will feed the connection to the same central routing point on their end, thus enabling MLPPP.
It's a sneaky little workaround, but it allows MLPPP to be possible by ensuring that all MLPPP logins go to the same place, instead of being randomly sent to one of several dynamic routing points across the aggregated network, even if you're not using traditional bonded pair off the same SLAM on all the lines.
-
I use ITEL networks to bond mine, and its done through two LTE antennas. That's actually my ISP! lol And yes, they are fairly expensive. The packet bonder up front was $1,200. Nevermind my antennas or rodems (somewhere in the $4,000 range for two LTE rodems (spelled with an 'R' explicitly for that reason), 40 foot of SMB cable, adapters and high-dBM GSM/WCDMA/LTE transponding antennas. (I require GSM/WCDMA to IMEI-auth via my contracted T-Mobile. I think its a bit strange connection authentication happens over WCDMA/GSM - "3G, 2x, 1x". I see my antenna operation console calling up through 2x and 3G before it hits my 4G band) ITEL's monthly cost for 2 bonded connections isn't bad though, so the upfront cost pays for itself in about a year. Its funny that you should mention Linus. I have a world of dislike for that man. But he knows how to recommend an ISP. lol. Don't get me started on his 'sponsorships'. Haha.
MrMazda wow, my setup is pretty child's play compared to how yours handles power outages. o___o I haven't gotten ballsy enough to battery-back mine quite yet. The reason I built mine into a toolbox was because LTE is very portable, and we do road-trips. We have an AC outlet in the truck. Anywhere my antennas get signal, I can get unlimited LTE thanks to Cyberonic + ITEL networks.
Both ISP will discuss tormenting with you on the phone. In fact, their administration supports it, and the freedom of information. That I just found very appealing, and worth the investment. I asked, flat out "Do you allow torrenting? I'm not making an investment if you don't."
My upload amount walks the walk for that talk.
-
I'm very glad that I have my back ups… Yesterday, we had another outage, which set the record for the SHORTEST outage that we've had here in the last 2 years, at only 7.5 hours of down time. I was very confused because Bell was finally getting around to installing line 4, and we were both communicating with my modems, no problem... Me through my internal WiFi network, and the Bell tech through their own internal tools. When I walked out the back door, the power was still on. Just as I walked around to the front of the house, my roomie was pulling up into the driveway, but by the time my roomie got into the back door, there was no power, but we were still interfacing with my network. I looked up at the meter just above us, and sure enough, the meter was out. If he couldn't communicate with the modems, he'd of been unable to complete the install, and I had already been waiting for FOUR MONTHS for the line to be installed because there are only 3 pairs of wires that run across the street to service my house, all three of which were in use. There are now NINE pars that run to the house, so I can still get faster and faster if I need to. :hehe:
I'm very glad I have that automatic backup system because after the sun set, the temperature dropped to -1 C outside. That didn't stop me though... Remember... The internal network, INCLUDING the underground line that leads the phone lines and network into the trailer is powered by that battery pack in the basement. So... I took the 750W inverter that I originally was using and used it to make a home made, weather proof, mobile generator. 750W isn't enough to power the 1500W electric heater, however absolutely everything else in the trailer including the stereo will run at an absolute MAX of 375W thanks to the magic of all LED lighting (except the addition of the new flood light, which uses 150W), so the whole trailer can be powered off of that 750W power source.
Now, you would think that one would have a rather limited battery life (like a few short hours) on just plain battery power, but that's where creativity comes in. I first started using my car this way the winter I spent in the house with no electricity service whatsoever in the -45 weather.
Take a 2003 Nissan Sentra XE, 1.8L DOHC L4, and a pair of jumper cables. Connect the jumper cables to the battery, then close the hood slowly so that it only latches down the safety latch, but not all the way. This will keep the engine and electrical guts from getting wet or snowed on. Then, you feed the jumper cables into the car under a door (in this case, I chose driver's door).
Then… You set the ends on the seat and make sure they won't touch each other (remember... low voltage DC is VERY forgiving), and attach the 750W inverter to the ends of the jumper cables. Start the engine so that the alternator can run the inverter and keep the battery fully charged (and will continue to do so for up to 48 hours on a single tank). Then, simply turn on the inverter and presto.... a two plug 750W weather proof generator on wheels, and all the electrical connection points that could be of any concern are all inside a self-contained weatherproof box where they cannot get wet, no matter how hard it rains or snows.....
Once done, take an extension cord and run it from the car to the back of the trailer. Unplug the custom overkill ground adapter that I created (for good reason) from the underground hydro (power) line, and plug it into the extension cord, and Bob's your uncle! I have lights, a stereo, working WiFi in the trailer, my laptop, cell phone charger, etc.
Lastly, I may not be able to run the electric heat on car power, BUT… I can power a fan no problem to circulate air, and I have a 100% MECHANICAL, match light PROPANE stove, and propane is conveniently pressure based, not electrical. Translation... I have fire and a fan, and they work quite well in lieu of electric heat to be able to keep the lights on, tunes boomin', and my internet streaming going so that I can keep partying Mamma Mia style....
I am determined to survive the mother f :cens: ing zombie apocalypse in this trailer :lolp:
It's gonna take a little more than a power outage that historically, will last anywhere from 7.5 to 33.5 hours to keep me from making contact with the outside world in high speed from my trailer, in the middle of the bush, in the middle of nowhere. It's the middle of nowhere, where NOTHING ever happens… EVER!!! I'm too damn stubborn to head to "civilization" to stay warm and/or connected to the outside world, and my momma always taught me to be independent and resourceful.
-
You sir are both insane and absolutely a genius all at the same time.
I love it.
