Please help me with Router Configuration

sondo214 · 2023-06-03T20:13:04.550Z

This is what I can find in my ISP router, concerning Opal Router

image1086×833 34 KB

sondo214 · 2023-06-03T20:18:38.126Z

Eh… I just found something important guys…

Of course my fault… Do you remember Route table No 6 rule?

221522×1317 195 KB

sondo214 · 2023-06-03T20:23:34.612Z

image1112×1769 64.6 KB

192.168.5.x was also the conditional Address Pool of the ISP Router!

Aaaaaand who had done that? Myself of course!

Now that I disabled it… I am running test’s with the last testing setting that SpitzAX3000 gave me!

Stand by for results

sondo214 · 2023-06-03T20:55:30.506Z

IT WORKS!!!

SpitzAX3000 you are the one!

Ok a couple of questions if you are kind enough

I have applied the static route in my ISP

IP Address: 192.168.5.0
Gateway: 192.168.1.51
Subnet Mask: 24 (or 255.255.255.0)

In Opal Router:
-Wan zone => Lan (Accept, Accept, Accept) Masquerade ON (because OFF I tried first but could not access the ISP router from PC.2 (nor any other device under my ISP router))
Wireguard works perfectly via Opal (for every device under Opal (PC.2, Synology, mobile phone, etc.)

So shall I leave these setting as they are, or shall I change something?

Thanks Again SpitzAX3000!

SpitzAX3000 · 2023-06-04T00:56:35.767Z

sondo214:

Thanks Again SpitzAX3000!

That’s great you have found the issue ! Glad to help.

As for masquerade, if your devices under opal can access the internet as well as the devices under the ISP, then keep it ON.

SpitzAX3000 · 2023-06-04T01:00:48.450Z

sondo214:

192.168.5.x was also the conditional Address Pool of the ISP Router!

Aaaaaand who had done that? Myself of course!

That’s was a mistake ! Because the Opal router is responsible for this network NOT the ISP! And you can spot the issue from the last screenshots you provided : for example rule no 6 shows that the isp can route traffic to this network through interface br0 whereas the interface is LAN4!!!

SpitzAX3000 · 2023-06-04T01:06:39.420Z

sondo214:

Masquerade ON

With masquerade on, I think you don’t even need the static route. Try to remove it and test the connections between your devices.

sondo214 · 2023-06-04T08:43:19.612Z

SpitzAX3000:

With masquerade on, I think you don’t even need the static route. Try to remove it and test the connections between your devices.

Tried it, but the connection is lost if I delete the static route.

Now that I can access synology from PC.1 (via inputing it’s ip), I notice that I cannot access it with SMB (SMB was the way that I used to work). Minor loss now that I cannot, but was nice to have it. (i.e. I could see the synology via my network in win10.

sondo214 · 2023-06-04T08:53:41.242Z

The next goal is to make the two Gl.inet routers (Opal and Slate AX) connect via “site to site”

Had tried in the past, tried it again now I get the following:

image701×582 14.4 KB

-Both router’s have a public IP: I believe they both have. Opal through ISP router and Slate AX through a Huawei 4G mobile router (E5788).

-Port 51830: I guess I have to open this port to both ISP and E5788 router?

-Router behind NAT: I guess both Opal and Slate are behind NAT’s right? so I have to setup port (51830) forwarding?

SpitzAX3000 · 2023-06-04T10:01:41.965Z

sondo214:

Now that I can access synology from PC.1 (via inputing it’s ip), I notice that I cannot access it with SMB (SMB was the way that I used to work). Minor loss now that I cannot, but was nice to have it. (i.e. I could see the synology via my network in win10.

This could be firewall issue from Synology. Check it from there.

sondo214:

The next goal is to make the two Gl.inet routers (Opal and Slate AX) connect via “site to site”

You need to open new post later we cannot have all issues in one post.

sondo214 · 2023-06-04T10:15:54.983Z

SpitzAX3000:

This could be firewall issue from Synology. Check it from there.

Will do, thanks

SpitzAX3000:

You need to open new post later we cannot have all issues in one post.

I will try to tinker around and if I cannot make it work, I will open a new topic. Thanks

SpitzAX3000 · 2023-06-04T18:31:41.280Z

Your exact same setup:

OpenWrt Forum – 16 Dec 19

Device as router with disabled NAT, additional routing rules

Installing and Using OpenWrt Network and Wireless Configuration

I need some help configuring the firewall and static routes. I am trying what is described here. My topology: /etc/config/network config interface 'loopback' option ifname 'lo' option proto 'static' option ipaddr '127.0.0.1' option...

Reading time: 4 mins 🕑 Likes: 5 ❤

sondo214 · 2023-06-04T18:50:46.562Z

SpitzAX3000:

You exact same setup:

You mean as the problem we fixed in this topic?

groentjuh · 2023-06-04T20:36:31.604Z

sondo214:

Both router’s have a public IP

Neither Opal nor the Slate AX have a public IP. 4G likely have CG-NAT (=Carrier Grade NAT, so a NAT at the ISP so they can make multiple connections use the same IP). The Opal is behind the ISP router, so does not directly have a public IP.

As the instructions state, you can forward port 51830 on the ISP router to the Opal. That way the Slate AX can connect to the Opal using the public IP (of the ISP router) + that port.

SpitzAX3000 · 2023-06-04T21:09:54.435Z

sondo214:

You mean as the problem we fixed in this topic?

Yes, indeed …

sondo214 · 2023-06-04T22:02:58.837Z

groentjuh:

As the instructions state, you can forward port 51830 on the ISP router to the Opal. That way the Slate AX can connect to the Opal using the public IP (of the ISP router) + that port.

I have no good luck with that this far…

-I have enabled port 51830 in Opal

image1302×418 21 KB

-I have enabled port forwarding in my ISP router

image1013×800 42.3 KB

But something does not work right…

image815×584 44 KB

If I cannot figure it out, I will start a new topic in the forum

groentjuh · 2023-06-04T22:20:58.253Z

Did you try setting it up again and make it run that test you showed earlier. Ports may look closed if nothing is running that is listening on that port.

SpitzAX3000 · 2023-06-05T00:51:26.682Z

sondo214:

-Both router’s have a public IP: I believe they both have. Opal through ISP router and Slate AX through a Huawei 4G mobile router (E5788).

No, incorrect!

[Opal through ISP router] it does have public IP because your ISP router is using DSL connection.

[AX through a Huawei 4G mobile router (E5788)] it dose NOT have public IP because your E5788 is using 4G connection - you are behind NAT even if you see online your public IP when checking online! In other words, it is a shared IP assigned for many customers by your 4G ISP.

sondo214:

-Port 51830: I guess I have to open this port to both ISP and E5788 router?

Incorrect!

You can only open this port on your DSL ISP router (since it has an actual public IP not NAT ). Then initiate the site-to-site connection from the AX router to be able to establish a tunnel.

Once you enable port forwarding on your ISP and setup a listening service on the Opal, then perform a test. if you enable port forwarding correctly but NO listening service on that port, the test will show a closed port!

sondo214 · 2023-06-05T06:08:01.170Z

groentjuh:

Ports may look closed if nothing is running that is listening on that port

Didn’t know that…

SpitzAX3000:

[AX through a Huawei 4G mobile router (E5788)] it dose NOT have public IP because you E5788 is using 4G connection - you are behind NAT even if you see online your public IP when checking online! In other words, it is a shared IP assigned for many customers by your 4G ISP.

Didn’t know that either…

Guys I am a Navy Helicopter Pilot… Sorry for my limitied knowledge

SpitzAX3000:

Once you enable port forwarding on your ISP and setup a listening service on the Opal, then perform a test. if you enable port forwarding correctly but NO listening service on that port, the test will show a closed port!

Will do that and report back! Thanks

SpitzAX3000 · 2023-06-05T06:13:18.500Z

sondo214:

Guys I am a Navy Helicopter Pilot… Sorry for my limitied knowledge

It’s ok