Bit of a RouterBoard newbie, just taken over management of this network, so didn’t do original install.
I have 5 specific hosts on my LAN (10.1.0.0) that are all NAT 1:1 routed to a range of 5 public IP addresses on a full class C (XXX.XXX.196.0) WAN. Four of them work perfectly, I can access them on ports 22,80,443 perfectly from the outside world. However the first one is behaving a little oddly. Only port 22 (SSH) is available from the outside world. It ‘feels’ like things are being blocked by the firewall, but I can’t figure out why it would only affect one Host.
As far as I can tell they are all configured EXACTLY the same. What is confusing me is why would I be able to access it through port 22 but be blocked on port 80 / 443 (or any other port i try to open).
I should have added, I can access them ALL perfectly, on all ports using their internal IP private addresses or external public IP addresses. It is only from the ‘real’ outside world I am having issues with ONE specific host.
Well that firewall does not look very sound, I don’t know if this is how you got it handed over or if it has been modified already…
You should know that “input” refers to input to the router itself, it is not used for traffic forwarded to systems on the internal
network. For that, “forward” is used. Note that this is different from other manufacturer’s firewalls, and it is the same as
for the “iptables” firewall in Linux (which is what it really is).
So in “input”, only allow what you want to accept to the router, and in “forward” accept what you want to send to internal systems.
Also note there is a “default allow all” at the end of each table, so you need to explicity put a “default deny all” there when that
is what you want (and usually you do).
Of course start out with an explicit “allow” with log option and check if you see what you expect and are not locking yourself out.
(you can use “safe mode” to prevent that)
Of course when you get XXX.XXX.196.96/28 from your ISP, the address XXX.XXX.196.96 is invalid. You cannot forward it. However,
this can sometimes be worked around by specifying a larger network (/24 in this case), maybe that has been attempted here.
However, that only works when the other side’s equipment forwards this traffic without noticing it is a network address.
It is not clear why these addresses have been setup at all, that is not required, unless the other side does not have some address
as the default gateway for your network and just sends everything L2 to the router (so it sends ARP for all your addresses).