I recently got a new router from my ISP (due to the old one not supporting current speeds), and decided to configure it so the same ports were forwarded to the same devices. But I encountered an issue.
Lets start with what I want. I'll focus on SSH for simplicity. Say I have a device running ssh on port 22 (default) with the internal IP "A". I want to be able to do both ssh EX
(I'll call the external IP "EX" for brevity) and (when on a device on the internal network) ssh A
to ssh to the device. Lets claim that I got no control over the device, and that it is locked to using only port 22 for this, as I want to solve my problem on a router-level rather than run two SSHDs.
My problem with the new router is that when I port-forward port 22 to the device, then:
- If I have a port-forwarding rule for this, then as one expects
ssh EX
works, but for some reasonssh A
(again, from device on internal network) does not work. Any other port seems to work (if I run an sshd on another port), andping A
works. On my old router (from same ISP) both external and (when on a device in the internal network) internal IP would work in this case. - If I dont have any port forwarding, then as one would expect
ssh EX
doesn't work, whilessh A
works when used from machines in the internal network. All is as one expects.
So my question is what might be causing this issue, and how I might resolve it? What settings should I look for in the (very graphical and confusing) GUI? Could I somehow edit the port-forwarding rule's "external host" field (currently a pure wildcard External Host: *
) to make the rule not kill internal ones? Any other ideas?
I already contacted tech-support, but they couldn't really help me. All I got when I described my issue was that "NAT-Loopback doesnt work with port-forw.", and no help actually solving the issue.
arping
that the internal IPs resolve to the correct devices' MAC addresses, and with e.g.tcpdump
/Wireshark that the packets are being sent/received to the correct addresses?tracert A
has always been outputting a single hop though, so I doubt they are being routed (no entry for the router).arping
command for windows, and ARP.exe seems to be something different when I look at the--help
option and compare to internet manual for arping.