Please help me with Router Configuration

SpitzAX3000 · 2023-06-02T12:34:23.340Z

sondo214:

So do I still have to disable the firewall?

YES! because the firewall does not block ICMP originating (outbound) from the device’s interface… but if it is coming from outside world (inbound) then it is blocked by default.

You can enable the firewall once the testing is finished and you verify the connectivity in both directions PC1 ↔ PC2.

SpitzAX3000 · 2023-06-02T13:03:47.272Z

sondo214:

Made the test

Did you do the test with or without static route ? Your screenshot shows static route table empty !

SpitzAX3000 · 2023-06-02T13:09:40.743Z

sondo214:

Opal router is indeed always 192.168.1.51

How did you find out ? Try to ping 192.168.1.51 from your isp router …. Also ping from pc 1

sondo214 · 2023-06-02T21:53:48.799Z

SpitzAX3000:

How did you find out ? Try to ping 192.168.1.51 from your isp router ….

Sorry I was in jail. LOL

sondo214:

I verify the Opal’s ip both from inside opal and from the device list of the ISP.

Just for reference here is my Slate AX:

Proton Drive

And from inside the ISP

Proton Drive

SpitzAX3000 · 2023-06-02T21:57:20.824Z

I said ping the Opal ip from your isp router and pc 1 ! Saying verified it does not mean anything you have messed up your settings on both routers and I need to make sure ICMP (eg ping ) is not being blocked

sondo214 · 2023-06-02T22:11:43.053Z

eh… how can I do that?

SpitzAX3000 · 2023-06-02T22:23:03.667Z

In Opal: ping 192.168.1.1

IMG_13471125×1753 107 KB

Honestly this is taking very long post I am not gonna feed you everything you have to learn how to navigate your routers menus - familiarize yourself with the menu and routing and firewall options !

I am quiet sure that the configurations I have given you so far should work UNLESS you have done some weird configurations.

SpitzAX3000 · 2023-06-02T22:42:59.167Z

If you suspect that one or both of your routers blocking ping , then try from pc1 to access Synology web interface or ssh or ftp etc…

SpitzAX3000 · 2023-06-02T22:48:14.375Z

sondo214:

Reply from 192.168.1.1: Destination host unreachable.
Reply from 192.168.1.1: Destination host unreachable.

Ping statistics for 192.168.5.198:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss)

Please note in your last test there was no loss as compared to previous tests! That means the settings I gave were correct but ICMP was dropped by the Opal router! Again from PC1 try to access different services on Synology/pc2 like FTP/WEB/SSH…

sondo214 · 2023-06-03T20:06:56.007Z

SpitzAX3000:

In Opal: ping 192.168.1.1

image1453×732 49.5 KB

SpitzAX3000:

I am quiet sure that the configurations I have given you so far should work UNLESS you have done some weird configurations

I really cannot think of any weird configurations I may have done…

SpitzAX3000:

If you suspect that one or both of your routers blocking ping , then try from pc1 to access Synology web interface or ssh or ftp etc…

web interface as well as ftp are not working… If I connect Synology under my ISP router, everything works fine…

All this may be over my capabilities and sure is over my knowledge…

sondo214 · 2023-06-03T20:13:04.550Z

This is what I can find in my ISP router, concerning Opal Router

image1086×833 34 KB

sondo214 · 2023-06-03T20:18:38.126Z

Eh… I just found something important guys…

Of course my fault… Do you remember Route table No 6 rule?

221522×1317 195 KB

sondo214 · 2023-06-03T20:23:34.612Z

image1112×1769 64.6 KB

192.168.5.x was also the conditional Address Pool of the ISP Router!

Aaaaaand who had done that? Myself of course!

Now that I disabled it… I am running test’s with the last testing setting that SpitzAX3000 gave me!

Stand by for results

sondo214 · 2023-06-03T20:55:30.506Z

IT WORKS!!!

SpitzAX3000 you are the one!

Ok a couple of questions if you are kind enough

I have applied the static route in my ISP

IP Address: 192.168.5.0
Gateway: 192.168.1.51
Subnet Mask: 24 (or 255.255.255.0)

In Opal Router:
-Wan zone => Lan (Accept, Accept, Accept) Masquerade ON (because OFF I tried first but could not access the ISP router from PC.2 (nor any other device under my ISP router))
Wireguard works perfectly via Opal (for every device under Opal (PC.2, Synology, mobile phone, etc.)

So shall I leave these setting as they are, or shall I change something?

Thanks Again SpitzAX3000!

SpitzAX3000 · 2023-06-04T00:56:35.767Z

sondo214:

Thanks Again SpitzAX3000!

That’s great you have found the issue ! Glad to help.

As for masquerade, if your devices under opal can access the internet as well as the devices under the ISP, then keep it ON.

SpitzAX3000 · 2023-06-04T01:00:48.450Z

sondo214:

192.168.5.x was also the conditional Address Pool of the ISP Router!

Aaaaaand who had done that? Myself of course!

That’s was a mistake ! Because the Opal router is responsible for this network NOT the ISP! And you can spot the issue from the last screenshots you provided : for example rule no 6 shows that the isp can route traffic to this network through interface br0 whereas the interface is LAN4!!!

SpitzAX3000 · 2023-06-04T01:06:39.420Z

sondo214:

Masquerade ON

With masquerade on, I think you don’t even need the static route. Try to remove it and test the connections between your devices.

sondo214 · 2023-06-04T08:43:19.612Z

SpitzAX3000:

With masquerade on, I think you don’t even need the static route. Try to remove it and test the connections between your devices.

Tried it, but the connection is lost if I delete the static route.

Now that I can access synology from PC.1 (via inputing it’s ip), I notice that I cannot access it with SMB (SMB was the way that I used to work). Minor loss now that I cannot, but was nice to have it. (i.e. I could see the synology via my network in win10.

sondo214 · 2023-06-04T08:53:41.242Z

The next goal is to make the two Gl.inet routers (Opal and Slate AX) connect via “site to site”

Had tried in the past, tried it again now I get the following:

image701×582 14.4 KB

-Both router’s have a public IP: I believe they both have. Opal through ISP router and Slate AX through a Huawei 4G mobile router (E5788).

-Port 51830: I guess I have to open this port to both ISP and E5788 router?

-Router behind NAT: I guess both Opal and Slate are behind NAT’s right? so I have to setup port (51830) forwarding?

SpitzAX3000 · 2023-06-04T10:01:41.965Z

sondo214:

Now that I can access synology from PC.1 (via inputing it’s ip), I notice that I cannot access it with SMB (SMB was the way that I used to work). Minor loss now that I cannot, but was nice to have it. (i.e. I could see the synology via my network in win10.

This could be firewall issue from Synology. Check it from there.

sondo214:

The next goal is to make the two Gl.inet routers (Opal and Slate AX) connect via “site to site”

You need to open new post later we cannot have all issues in one post.