GL-MT3000 NAT type B to NAT type A?

I live in a place with shared Wi-Fi, NAT type B. The Wi-Fi is unable to use online features in game console (Nintendo Switch). I cannot access admin settings of this shared Wi-Fi.

I bought the Beryl GL-MT3000 to use private Wi-Fi, using it as a repeater. It works well, but also gives the NAT type B and cannot access online features in Nintendo Switch as well. I’ve tried setting up DMZ and port forwarding using all ports, but it all failed. Is it possible using the GL-MT3000 to change NAT type B to NAT type A?

Thanks.

Please try to install attached ipk.
fullcone.ipk.zip (12.4 KB)
upload uncompressed ipk to MT3000 /tmp/ directory.
ipk source is from here.

Then install and enable fullcone NAT

opkg install /tmp/kmod-ipt-fullconenat_5.4.211+2022-02-13-108a36cb-10_aarch64_cortex-a53.ipk
opkg install /tmp/iptables-mod-fullconenat_2022-02-13-108a36cb-10_aarch64_cortex-a53.ipk
modprobe xt_FULLCONENAT
iptables -t nat -A zone_wan_prerouting -j FULLCONENAT
iptables -t nat -A zone_wan_postrouting -j FULLCONENAT

I failed to setup an environment to test it, please help.
and use snapshot 4.2 firmware please.

Hi, thanks for the reply.

I followed every step, but was unable to change the NAT type - is there anything I need to refresh after install?


Screenshot 2023-02-12 154536

This one is tested on 4.2.0 beta4 firmware.
fullcone.ipk-update-2023-02-21.zip (12.4 KB)
Also command update for permernat change:

# install ipk
opkg install /tmp/kmod-ipt-fullconenat_5.4.211+2022-02-13-108a36cb-10_aarch64_cortex-a53.ipk
opkg install /tmp/iptables-mod-fullconenat_2022-02-13-108a36cb-10_aarch64_cortex-a53.ipk
# add firewall rule to make fullcone NAT
cat >>/etc/firewall.user <<EOF
iptables -t nat -I zone_wan_prerouting -j FULLCONENAT
iptables -t nat -I zone_wan_postrouting -j FULLCONENAT
EOF
# make /etc/firewall.user survive firewall reload
uci set firewall.@include[0].reload=1
uci commit firewall
/etc/init.d/firewall reload

Hi, still no luck - unfortunately. I’ll attach this block of code when I followed your procedure.

root@GL-MT3000:~# opkg install /tmp/kmod-ipt-fullconenat_5.4.211+2022-02-13-108a36cb-10_aarch64_cortex-a53.ipk
Installing kmod-ipt-fullconenat (5.4.211+2022-02-13-108a36cb-10) to root...
Configuring kmod-ipt-fullconenat.
Updating database.
Database update completed.
root@GL-MT3000:~# opkg install /tmp/iptables-mod-fullconenat_2022-02-13-108a36cb-10_aarch64_cortex-a53.ipk
Installing iptables-mod-fullconenat (2022-02-13-108a36cb-10) to root...
Configuring iptables-mod-fullconenat.
Updating database.
Database update completed.
root@GL-MT3000:~# cat >>/etc/firewall.user <<EOF
> iptables -t nat -I zone_wan_prerouting -j FULLCONENAT
> iptables -t nat -I zone_wan_postrouting -j FULLCONENAT
> EOF
root@GL-MT3000:~# uci set firewall.@include[0].reload=1
root@GL-MT3000:~# uci commit firewall
root@GL-MT3000:~# /etc/init.d/firewall reload
Warning: Section @zone[1] (wan) cannot resolve device of network 'wan6'
 * Clearing IPv4 filter table
 * Clearing IPv4 nat table
 * Clearing IPv4 mangle table
 * Clearing IPv4 raw table
 * Populating IPv4 filter table
   * Rule 'Allow-DHCP-Renew'
   * Rule 'Allow-Ping'
   * Rule 'Allow-IGMP'
   * Rule 'Allow-IPSec-ESP'
   * Rule 'Allow-ISAKMP'
   * Rule 'Allow-DHCP'
   * Rule 'Allow-DNS'
   * Forward 'lan' -> 'wan'
   * Forward 'guest' -> 'wan'
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'guest'
 * Populating IPv4 nat table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'guest'
 * Populating IPv4 mangle table
   * Rule 'process_mark'
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'guest'
 * Populating IPv4 raw table
   * Zone 'lan'
     - Using automatic conntrack helper attachment
   * Zone 'wan'
   * Zone 'guest'
     - Using automatic conntrack helper attachment
 * Clearing IPv6 filter table
 * Clearing IPv6 nat table
 * Clearing IPv6 mangle table
 * Populating IPv6 filter table
   * Rule 'Allow-DHCPv6'
   * Rule 'Allow-MLD'
   * Rule 'Allow-ICMPv6-Input'
   * Rule 'Allow-ICMPv6-Forward'
   * Rule 'Allow-IPSec-ESP'
   * Rule 'Allow-ISAKMP'
   * Rule 'Allow-DHCP'
   * Rule 'Allow-DNS'
   * Forward 'lan' -> 'wan'
   * Forward 'guest' -> 'wan'
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'guest'
 * Populating IPv6 nat table
Warning: fw3_ipt_rule_append(): Can't find target 'prerouting_lan_rule'
Warning: fw3_ipt_rule_append(): Can't find target 'postrouting_lan_rule'
Warning: fw3_ipt_rule_append(): Can't find target 'prerouting_wan_rule'
Warning: fw3_ipt_rule_append(): Can't find target 'postrouting_wan_rule'
Warning: fw3_ipt_rule_append(): Can't find target 'prerouting_guest_rule'
Warning: fw3_ipt_rule_append(): Can't find target 'postrouting_guest_rule'
Warning: fw3_ipt_rule_append(): Can't find target 'prerouting_rule'
Warning: fw3_ipt_rule_append(): Can't find target 'postrouting_rule'
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'guest'
 * Populating IPv6 mangle table
   * Rule 'process_mark'
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'guest'
 * Set tcp_ecn to off
 * Set tcp_syncookies to on
 * Set tcp_window_scaling to on
 * Running script '/etc/firewall.user'
 * Running script '/etc/firewall.nat6'
 * Running script '/etc/firewall.vpn_server_policy.sh'
 * Running script '/var/etc/gls2s.include'
   ! Skipping due to path error: No such file or directory
 * Running script '/usr/bin/gl_block.sh'

Maybe it’s some nasty stuff comcast business is using, but tough luck. I’ll have to return this product, but the customer support was excellent. If there is future update, I’ll be interested in purchasing this product again.

1 Like

That’s okay.
One thing to note is that if you are under another gateway that doesn’t support NAT type A.
That doesn’t work understandably.