3

I'm pretty familiar with firewalls, routers, port-forwarding etc after 20 years of managing networks but this one has got me flummoxed. I'm helping out a small brewery business which has a pretty simple network consisting of a Netgear WNR1000v3 router, a Windows 2003 server, couple of network printers and laptops. The Windows server has RDP configured, accessible via their single static IP address. There is also a bespoke monitoring program running on the server accessible via port 81.

So nothing particularly unusual and as with many small businesses, records of configuration are non-existent.

We're installing a new Dell server running Windows 2012 and one of my early tasks is to get remote desktop working - on a different port to 3389 because that's assigned to the existing server. Change the port via the registry, add a new rule into Windows firewall for port 3388 - check RDP works from the LAN. No problems.

Come to look at the port forwarding rules on the Netgear and hit a brick wall. Expected to see a couple of existing entries for RDP and the bespoke app on port 81. But the port forwarding lists are empty. Add the 3388 port forwarding rule anyway and that works.

But I'm flummoxed how RDP is being routed to the existing server without any rules on the Netgear router/firewall? The existing server is on 192.168.100.250. It's almost like the router is pushing all packets to this IP sort of by default but I've come across anything like that. I've scoured every single screen on the Netgear and can't find a reference to 192.168.100.250 anywhere.

I know Windows can act as a router but that's not configured plus you need two network ports and only one is in use.

So very confused...

  • A few questions immediately spring to mind... (1) Is this the perimeter router / default gateway interface for internet access for other machines on the network? Can those other machines get DNAT mappings and access the internet normally (so, if this is the only route to the internet, and you have a computer attached to the network configured via DHCP, and you access google.com, does that work)? (2) Do those temporary DNAT mappings show up on the router's config screen? (3) Is it possible to get a DNAT port mapping for entire networks? – Parthian Shot Mar 16 '16 at 14:17
  • (4) What does a packet capture look like? When you filter out all network conversations which don't involve the router's MAC address, does anything pop out as odd? (5) If you set up a process listening on some arbitrary port on the 192.168.100.250 machine, can you connect to that process from the outside? – Parthian Shot Mar 16 '16 at 14:19
  • You might also want to see whether any conversations between specifically the router's MAC address and the 192.168.100.250 machine's NIC's MAC address look weird. On the offchance it's requesting a lease for something. – Parthian Shot Mar 16 '16 at 14:21
  • Hmm, I'm beginning to suspect that this is something to do with the router. I've just tried adding FTP on port 21 and the router reports "Port conflict with other service". I beginning to suspect that the rules are there on the firewall just not displayed on the web interface. There is an update to the firmware... – Rob Nicholson Mar 16 '16 at 20:38
  • Very old post but identical problem - will try firmware upgrade and failing that, a hard reset - not difficult to reconfigure community.netgear.com/t5/General-WiFi-Routers/… – Rob Nicholson Mar 16 '16 at 20:53
2

Is the server set up as the "DMZ host" in the router? Many consumer-grade routers let you configure a DMZ host, to which all traffic from the outside will be directed.

  • Good suggestion - will check – Rob Nicholson Mar 16 '16 at 16:07
  • Flip - DMZ would have been a good suggestion but it's not enabled – Rob Nicholson Mar 16 '16 at 16:16
0

Thanks to posters who confirmed I wasn't missing anything obvious. Problem was with corrupt firmware/configuration. Upgrade to latest firmware didn't resolve the problem. Had to resort to resetting to factory settings and reconfiguring - port forwarding now working as expected, i.e. shows all the rules and doesn't hide some of them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.