Question Port Forwarding - is this expected bahaviour ?

[firemanjim]

I have a Draytek router and I am struggling to get port forwarding to work alongside the firewall on this router. I beleive I have set up the port forward correctly but the firewall blocks it each time.

Basically trying to forward and external port 4994 into and internal port 4994

When I look at the router system log I see this (not real IP)

[FILTER][Block][WAN->LAN/RT/VPN, 12:47:42][@S:R=1:2, 3.54.78.25:54334->192.168.0.50:4994][UDP][HLen=20, TLen=43]

In my firewall I have allowed both external and internal ports 4994 but as you can see from the log, the external port is showing as 54334 rather than 4994 and therefore it is blocking it. And this 54334 port seems to change each time I try as well.

As soon as I allow all external ports it works just fine but I guess this is not secure.

Even if I try and use an open port checker website it says it is closed and I see the same behaviour from the changelog - it isn't coming in on the specified 4994 port.

Is my router doing something to change the port external port? And how can I solve this?

Many thanks in advance

 

[bill001g]

You really have no choice but to allow all ports...technically there is some range used but I forget.

To explain this lets look at the outgoing ports your machine uses to browse web pages.

Look at the resource monitor network tab under tcp connection for your outbound sessions on your current pc. You will see a massive number of different port numbers in the local port.

The local machine generates a random port number since your local IP can only tie a port to a single session. Pretty much your browser will cause your machine to create a unique local port number for every page it opens including all the ones for the garbage advertising.

The incoming session for your application appears to be functioning in the same way. This is the default except for a application that is hard coded to use only 1 port. There are many restrictions if you attempt to do this so most application just let the OS handle it and allocate random ports.

Just having the port forwarding is the risk not the port. If you could somehow limit the IP on the internet the session comes from that would help.

I would not run any kind of firewall rules on your router. These require the router to examine traffic which means the CPU chip must see every packet.
Most routers to get high speed have moved the NAT function to hardware and bypasses the CPU. Without this feature many routers are limited to about 300mbps.

When you port forward the security not moves to the server which is why it is a risk in general to port forward. The NAT function with no port forwarding prevent any unkown traffic from the internet entering you lan network

 

[firemanjim]

Thank you so much for responding!