MT6000/Flint2 Setting Up Port Forwarding on Xfinity

Technical Support for Routers
23

Thanks admon:

According to the docs port 80 is not blocked on Xfinity.

But I just asked the Xfinity Assistant (AI help) and it said that port 80 IS blocked on Xfinity!

Why didn't port forwarding work when I changed the port to 31011 rather 80?. I've also tried replacing port 31011 with 8080 with the same results.
Computer outside the network URL entered:
73.192.XXX.XX:31011 (73.192.XXX.XX is the public IP)
73.192.XXX.XX:8080

Port Forwarding

Port31011
Port310111365×738 59.5 KB

Open Port on Router <-- I've tried turning this on and off no difference.

OpenPorts31011
OpenPorts310111365×725 51.3 KB

Result
"The connection has timed out" page shown on the outside the network computer.

I also came up with the idea that maybe the Linux Apache server was the problem so I played around a little with adding to the iptables... No joy :frowning_face:
iptables -A FORWARD -i wlan0 -j ACCEPT # set forward to WiFi card wlan0
iptables -A FORWARD -o wlan0 -j ACCEPT # set forward to WiFi card wlan0
iptables -A INPUT -p tcp --dport 80 -j ACCEPT

24

I can't really help you with that issue because I don't know Xfinity. I don't even know if they are not behind CGNAT.

Open Ports on Router is useless if you need port forwarding. Delete those entries.

Does the Xfinity modem has a firewall as well? Maybe you need to open ports there as well?

25

Hi admon:

So another interesting thing I just noticed. I am not longer able to get to the router login Admin Page from the outside computer using the public IP (which hasn't changed).

I guess the scary message from the Open Ports on Router page is the information box. Which made me think you needed entries here as well.

"For security reasons, the services that you install on the device are only opened to its LAN network. If you want them to be accessible from the WAN network, you need to open ports for these services on the WAN."

I'm not using an Xfinity modem just my own personal cable modem (Arris SurfBoard Model: S33). It is a cable modem only so no firewall or port forwarding settings in it. Simply a pass through device.

26

Port forwarding does not need open Ports on the router, however if you want to make your login page available from WAN (which is highly not recommend!) you need to enable it using Enable remote control Security - GL.iNet Router Docs 4

27

Hi admon:

Nope, do not want to do that! Thank you for the explanation.

28

Hi admon:

So I ran a ZenMap Scan from a computer outside my network results:

Target: 73.168.XXX.XX/24 (public IP) Profile: Quick Scan

results ----------------------------------

Nmap scan report for 73.168.XXX.0

Host is up (0.00018s latency).

Not shown: 99 closed tcp ports (reset)

Port State Service

514/tcp filter shell

repeated for every IP in on the list.

end results ------------------------------

It doesn't look like any ports are open.

29

Are you totally sure that there is no CGNAT? Cable internet is in 99% CGNAT.

30

Hi admon:

I'm not sure there is no CGNAT. I just followed bruce's link and found another one to double check. Both of these tests show no CGNAT. Do you have a 3rd way I might be able to triple check?

  1. the other link:
    traceroute public-ip

https://winbuzzer.com/2020/05/29/windows-10-how-to-tell-if-your-isp-uses-carrier-grade-nat-cg-nat-xcxwbt/

  1. Found more CGNAT/CG-NAT/CGN/Carrier Grade NAT tests - Still doesn't look like Xifinity/Comcast in my area is using CGNAT.

My public IP does NOT fall within the 100.64.0.0/10 IP range.

Windows check:
CMD
traceroute 73.168.XXX.0 (public-ip) # 1 hop = NO CGNAT

I also tried all of this with a different router. Other than generating a different public IP address everything had the same results.

31

So for some odd reason, firmware 4.6.8 op21 won't allow port forwarding and I have tested it on my end for hours.

After installing firmware 4.6.6 OP24 I was able to open various ports with out any issues.

If I want to open port 45600, in the settings for Internal and External port I use 45600 and it works.

1 Like
32

Hi Denisimo:

Thank you for the post! Both of the GL.iNet routers (MT6000/Flint2 & AXT18000/Slate AX) I tested are running the 4.6.8 release 1 firmware. I was just thinking I need to run a test with another router brand!

33

Ive been switching back and forth between two firmwares for over a week and keep finding various discrepancies. And in my case, I have to chose between what I want and what I need. If I want options A B C, I have to use older firmware, if I want to use options X Y Z I have to use newer firmware, even though newer firmware should also have A B C options working or other way around.

34

Hi Denisimo:

Have you tried the beta version 4.7.0?

35

I havent tried Beta 4.7. Havent had the time and I don't feel like beta testing a firmware right now.

36

Hi Denisimo:

I just dug out an old Linksys router and set port forwarding up on it. Firmware doesn't seem to be my port forwarding issue.

37

Hi admon:

I just heard back from an Xfinity employee. "Xfinity does not use Carrier-Grade NAT."

38

So it works with the old one?

39

Hi admon:

Sadly no, port forward is still not working with my old router either. Same issue. All connections from the outside computer (WAN) are getting blocked.

40

In that case Xfinity might be just lying and there is CGNAT ...

41

Xfinity is not lying. I use Xfinity and I am able to use Port Forwarding but only if use firmware 4.6.6 OP24.

42

Hi Denisimo and admon:

Denisimo: Where are you located? I'm in Jacksonville, FL. It is possible Xfinity/Comcast has different setups in different areas? Someone on the Xfinity Community Forum just posted they have CG-NAT with Xfinity. I haven't found out where they are located yet.

admon: If Xfinity/Comcast is NOT using CGNAT in my area is it possible that there might be some-kind of double NAT situation? Where Xfinity has another router somewhere upstream of my connection that is blocking port forwarding to my public IP?

I wasn't willing to downgrade my MT6000/Flint2 and lose all my settings, so I turned it off. I did connect and downgrade my GL-AXT1800/Slate AX to version 4.6.4. There was not a version 4.6.6 for the AXT1800 that I saw.
https://dl.gl-inet.com/router/axt1800/stable

My port forwarding behavior remains the same. Again I was able to connect to my Apache server from inside my network using my public-ip, so port forwarding on the router(s) is working. But, no connections from outside the network (WAN) using the public-ip or public-ip:8080 ports (socket address) work.

All ports remain closed from the LAN & WAN. I used the below link on to test computers both inside my network and a computer outside my network.