Hey guys Ive recently switched to hAP ax3 from some TP-Link, all is great apart from port forwarding. I have a server which servers a couple of sites + services such as ssh. I was following a couple of guides for port forwarding but after checking with open port checker tool or directly trying the sites Im getting CONNECTION TIMED OUT.
The router is directly connected to Ubi fiber to ethernet box with an IP: 192.168.1.1
The hAP ax3 uses WAN to connect to the Ubi box with an IP - 192.168.1.10
Internal LAN uses 192.168.2.0/24
Server uses .202
I suspect the firewall but thats about it.
Config:
There’s an error in your DST NAT rules: to-ports=0 … either remove the property entirely (if you’re using GUI, click the up-arrow on the side of the property value so that it folds close) or set correct port numbers. If the property is not set (at all), then NAT rule won’t change port number. If it’s set (and setting it to 0 is setting it none the less), then NAT will replace port number with configured value.
If you’re using a device from outside your network, is upstream device (Ubi) confiugred for DST NAT towards your hAP ax3?
If you’re testing it from within your LAN by trying to connect WAN IP, then you may have to implement Hairpin NAT … it may be a bit trickier in your case than it’s in manual since it seems you’re behind double-NAT (one NAT instance is your hAP ax3, another instance is either Ubi or your ISP).
If your LAN devices can use internet, then routing is very likely fine. And config on hAP ax3 (apart from the detail I pointed out earlier) seem fine to me as well. But then there’s some ISP device that does another layer of NAT. Be it the Ubi device you actually see or some other device in ISP’s back bone is not clear as you can not access the Ubi device to check. So it’s everybody’s guess.
Now you could do some debugging using sniffer tool (set filter on the DST port you want to use and run tool without filtering on address or interface … if everything is working fine, you should see same packet twice: once ingressing through WAN interface, its dst-address set to WAN IP of your router … and second time egressing through LAN interface (likely bridge), dst-address set to IP address of LAN server. If you only see the first one, then firewall rules on router are to blame (either DST NAT rule or firewall filter rule), if you see it twice, then packet is passing through. If you don’t see it at all, then the problem is upstream.
I suppose the wan of Ubi, it’s an Ubiquiti U Fiber LOCO, GPON Optical Network Unit, which only displays the LAN IP - 192.168.1.1 it’s acting like a gateway to my whole network. I’m starting to think that my ISP did something wrong, cause while I was changing my router the Ubi had to be replaced as well since it died. They redid the port forwards on the Ubi device but now it looks like that they did something wrong.
You could be behind a double NAT (ONT is having the public IP and then your hAP WAN interface has a private IP) or even your provider is using CGNAT.
In both case you are dependent on your provider either to set up the ONT as bridge (and then pass the public IP to the WAN interface of the HEX) and in case of CGNAT you will not be able to do port forwardig at all.
In case you cannot sort out the point with your provider, you could think to consider service like cloudflare tunnel or similar .
If double nat you will need to port forward the applicable ports on the upstream device to the wanip of the MT ( its lanip on the upstream devices subnet )
I feel like this is already done, IP of the Ubi upstream device is 192.168.1.1, WAN IP of MT is 192.168.1.10, I feel like Im behind a double nat, Ubi and MT. And Im totally lost
So the ubiquiti provides a LAN subnet of 192.168.1.0/24 and its address is 192.168.1.1, this is all good and normal.
However the ubiquiti itself must get a public IP address on the WAN side.
What you need to do simply use whats my IP in a browser to figure out the public IP the ubiquiti is getting currently and we are doing this to confirm the ubiquiti is accessible over the internet via a public IP.
YOu MUST ALSO BE ABLE to access the ubiquiti menus, to enable any useful functionality on the Mikrotik router be it port forwarding or connecting remotely via VPN.
You will also find an IP cloud entry in the mikrotik router winbox menu. You can enable this and if you put that the associated mynetame address in your browser it should also resolve to the public IP address the ubiquiti is getting.
