Tomato and port forwarding/dmz not working…?

Question

I've been running Tomato 1.28 on my wireless router for a while now without issue. I am trying to SSH to one of my servers behind the router, and can't seem to get through.

First, I went to whatismyip.org to get my external IP address. I setup port forwarding and then tried to connect from a remote server (ssh'd out, to then ssh back into my network to test)

I set port forwarding for port 22 to forward to the target (192.168.1.20), no luck (connection timeout)

I set 192.168.1.20 to be the DMZ, still no luck (connection timeout)

I can SSH to that address from my local network directly.

I ran nmap from the external host to the target IP, and get a "host seems down" message (this done w/ DMZ enabled).

I've done port forwarding on other routers before, it all seems pretty straight forward. Any idea what I'm missing here? (probably something simple... I hope). I don't actually believe that Tomato port forwarding isn't work (regardless of the title of my post) - it's such an essential feature to routers I know that Tomato would have never gained any sort of populraity with such a feature non-functional.

EDIT: I get a response on when doing a ping, but not sure if that's just the dsl-modem (or router) responding.

EDIT2: IPTables for the router with port forwarding on 22

Chain INPUT (policy DROP)
target     prot opt source               destination         
DROP       0    --  anywhere             192.168.254.1       
DROP       0    --  anywhere             anywhere            state INVALID 
ACCEPT     0    --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     0    --  anywhere             anywhere            
ACCEPT     0    --  anywhere             anywhere            

Chain FORWARD (policy DROP)
target     prot opt source               destination         
ACCEPT     0    --  anywhere             anywhere            
DROP       0    --  anywhere             anywhere            state INVALID 
TCPMSS     tcp  --  anywhere             anywhere            tcp flags:SYN,RST/SYN    tcpmss match 1461:65535 TCPMSS set 1460 
ACCEPT     0    --  anywhere             anywhere            state RELATED,ESTABLISHED 
wanin      0    --  anywhere             anywhere            
wanout     0    --  anywhere             anywhere            
ACCEPT     0    --  anywhere             anywhere            
upnp       0    --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain upnp (1 references)
target     prot opt source               destination         

Chain wanin (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             archpogo            tcp dpt:ssh   #--- my desired target

Chain wanout (1 references)
target     prot opt source               destination         

With DMZ enabled, and port forwarding removed:

Chain INPUT (policy DROP)
target     prot opt source               destination         
DROP       0    --  anywhere             192.168.254.1       
DROP       0    --  anywhere             anywhere            state INVALID 
ACCEPT     0    --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     0    --  anywhere             anywhere            
ACCEPT     0    --  anywhere             anywhere            

Chain FORWARD (policy DROP)
target     prot opt source               destination         
ACCEPT     0    --  anywhere             anywhere            
DROP       0    --  anywhere             anywhere            state INVALID 
TCPMSS     tcp  --  anywhere             anywhere            tcp flags:SYN,RST/SYN tcpmss match 1461:65535 TCPMSS set 1460 
ACCEPT     0    --  anywhere             anywhere            state RELATED,ESTABLISHED 
wanin      0    --  anywhere             anywhere            
wanout     0    --  anywhere             anywhere            
ACCEPT     0    --  anywhere             anywhere            
upnp       0    --  anywhere             anywhere            
ACCEPT     0    --  anywhere             archpogo  #--------- This is my desired target host name, though, that's the name            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain upnp (1 references)
target     prot opt source               destination         

Chain wanin (1 references)
target     prot opt source               destination         

Chain wanout (1 references)
target     prot opt source               destination         

So I see the entries in IPTables (though not familiar enought with IPTables to know if that is the correct config). One thing I will note is that in tomato, I named the device "archpogo", but the device itself does not appear to have a hostname (uname -n gives ... nothing (blank entry). I thought I'd set the host name, but /etc/rc.conf is not present (not familar with Arch linux)

EDIT4: Okay, I feel a little silly. The target host does have a hostname (was looking at the router before... dang, I hate information-less prompts). I'm switching it to match, see if it helps.

... and nope, didn't help.

Answer 1

Turns out my dsl-modem was doing the port blocking. When I logged into the modem directly, all configurations seemed to indicate it would not do any blocking (and, in fact, my service provider told me the same), but if I explicitly did a port-forward from the modem to the router, it all started working fine. Thanks for the help.