TOT fibre upgrade, new ZTE & TPLink router port fowarding

[alphason]

Just had TOT Upgrade us to the fibre today, most things I have got working again now except torrent downloads with utorrent.

Before I used the simple pot forwarding programme to do this with the old billion router, but now I cant get the port to open.

We now have 2 boxes, 1st is ZTE ZXHN F860 which the fibre connects to, this is then connected to a TP Link TL WR841N which is used for wifi and I have a couple of other gadgets connected with ethernet.

So on which device do I need to do the port forawding, just one or both?

I tried to do it with the TP link but it did not work even though the model number is listed in the simple port forwarding program.

Any help appreciated, thanks.

[thedemon]

Hi, me again (from your other thread).

From your description I'm guessing that the TOT supplied ZTE is acting as the main router and the TP Link is only used for WiFi and for extra ethernet ports. In other words, the ZTE is not in bridge mode rather just the in the standard TOT configuration.

If that is the case, I suspect you may have the TP Link configured also as a router when it should really be in AP mode because otherwise, though it will work for most things you are doing "double NAT". That isn't ideal and will indeed make port forwarding difficult.

As long as the TP Link is in AP mode you should only need to forward the ports on the ZTE because in that mode the TP Link has no firewall operating.

[RichCor]

Depends on how TOT has configured your equipment.

Option 1: Router + Slave WiFi Access Point

ZTE F860 is your Router/Gateway. [Port Forwards need to be made on this device]
TP-Link TL-WR841N WAN port NOT USED, device configured to be used ONLY as WiFi Access Point and Ethernet Switch. (Router, Firewall, NAT, DHCP disabled)

Option 2: Double NAT

ZTE F860 is your Router/Gateway (1 of 2). [Port Forwards need to be made to the TP-LINK IP Address WAN IP Address]
TP-Link TL-WR841N WAN port USED, This is also your Router/Gateway (2 of 2) (Router, Firewall, NAT, DHCP enabled). WiFi Access Point. [Port Forwards also made here to LAN IP Address. Some issues with Double-NAT may be present]

Option 3: Pass Through

ZTE F860 is BRIDGE MODE. Configuration not needed or even possible.
TP-Link TL-WR841N WAN port USED, PPPoE configured for connection. This is your only Router/Gateway (Router, Firewall, NAT, DHCP enabled) WiFi Access Point. [set Forwarding on this device as desired]

Option #1 is the most likely scenario, as thedemon wrote. If so, DHCP on the TP-Link should read as DISABLED and the TP-Link Internal IP address set to something other than 192.168.1.1 (usually they'll set it to 192.168.1.2) Your connecting equipment (Ethernet or WiFi) will then get all it's DHCP via the ZTE F860 and use it as the default Gateway.

Edited July 23, 2015 by RichCor

[thedemon]

Depends on how TOT has configured your equipment.

Option 1: Router + Slave WiFi Access Point

ZTE F860 is your Router/Gateway. [Port Forwards need to be made on this device]

TP-Link TL-WR841N WAN port NOT USED, device configured to be used ONLY as WiFi Access Point and Ethernet Switch. (Router, Firewall, NAT, DHCP disabled)

Option 2: Double NAT

ZTE F860 is your Router/Gateway (1 of 2). [Port Forwards need to be made to the TP-LINK IP Address WAN IP Address]

TP-Link TL-WR841N WAN port USED, This is also your Router/Gateway (2 of 2) (Router, Firewall, NAT, DHCP enabled). WiFi Access Point. [Port Forwards also made here to LAN IP Address. Some issues with Double-NAT may be present]

Option 3: Pass Through

ZTE F860 is BRIDGE MODE. Configuration not needed or even possible.

TP-Link TL-WR841N WAN port USED, PPPoE configured for connection. This is your only Router/Gateway (Router, Firewall, NAT, DHCP enabled) WiFi Access Point. [set Forwarding on this device as desired]

Option #1 is the most likely scenario, as thedemon wrote. If so, DHCP on the TP-Link should read as DISABLED and the TP-Link Internal IP address set to something other than 192.168.1.1 (usually they'll set it to 192.168.1.2) Your connecting equipment (Ethernet or WiFi) will then get all it's DHCP via the ZTE F860 and use it as the default Gateway.

Excellent explanation!

[alphason]

Thanks thedemon & RichCor,

I will have a proper look tomorrow, but I just quickly checked on the TP-Link and it shows DHCP Server enabled, I access the TP-Link with 192.168.0.1 (is this the internal ip?)

Thanks again for your help.

[RichCor]

192.168.0.1 and 192.168.1.1 are common subnet IP Addresses for NAT Routers.

What IP Address does the TP-Link show for the WAN connection?

That should be a big clue to how it's set up.

[alphason]

192.168.0.1 and 192.168.1.1 are common subnet IP Addresses for NAT Routers.

What IP Address does the TP-Link show for the WAN connection?

That should be a big clue to how it's set up.

Under the heading Status>WAN it shows...

IP address 192.168.1.2 Dynamic IP

Is this the one you mean? it also lists Mac Address, Subnet Mask, Default Gateway (with button next to it saying release) & DNS server

Thanks

[RichCor]

Then it's set up as Option 2. Not Ideal.

Take a look at what Gateway Address your computer is being issued (probably 192.168.0.1), meaning you're currently in a Double-NAT setup.

Unless there's a reason for it, I would set it up as Option 1, by setting the TP-Link as

WAN: 192.168.1.2 Subnet: 255.255.255.0 Gateway: blank (not needed)

Disable: DHCP, NAT, and UPnP features

Pull the Ethernet cable out of the TP-Link WAN PORT and plug it into one of the TP-Link LAN PORTs. **

...then disconnect your PC from the Ethernet or WiFi and reconnect.

It should now have the ZTE F860 as your Router/Gateway (192.168.1.1) and work on the Internet as before, but you can now set up your Port Forward on the ZTE F860 and it should work.

Application -> Port Forwarding to set up the selected ports to use that FIXED or reserved LAN IP Address.

Also note: For Port Forward to work, you will either need to :

A. Activate/Enable UPnP feature on the ZTE F860 Router and use UPnP feature in your PC applications to auto-configure port forward connections, or

B. Make sure your PC/Device is always uses the same IP Address by

1. manually assigning it a FIXED IPv4 IP Address and subnet, and fill in your Gateway and DNS info in Network Connection Status (Properties), or

2. is always given/issued a reserved IP Address via DHCP by your ZTE F860 Router. Your Router can be set to only/always issue a reserved IP Address to a connecting device by associating an IP Address to a network MAC hardware address in "Network -> LAN -> DHCP Binding" on your ZTE F860.
When your device connects to the network and requests an IP via DHCP is will be issued this reserved IP Address

Choosing: FIXED IP or DHCP Reserved IP (DHCP Binding) Address option

IF your PC/Device will only be used on your LAN, then a FIXED/STATIC IPv4 IP Address is preferable. It will always be found at the Fixed/Static IP Address, even if the router isn't working.

IF you take your PC/Device to connect on other Ethernet or WiFi Networks then you'll want to leave it configured to obtain connection setting (IP, Subnet, Gateway, DNS) via DHCP. This allows your PC/Device to easily automatically adjust to different network settings and play nice with other connecting equipment. And, as stated, it can be issued a reserved IP address if setup beforehand in the router.

** There may be an option to set your TP-Link TL-WR841N WAN Ethernet Port to work as a 5th LAN port. I have not read the setup guide to see if this is an option. The LAN ports allow all traffic to be distributed unimpeded to all other LAN and WiFi sockets (without being filtered, routed, NAT'd by some odd firmware quirk).

[alphason]

Then it's set up as Option 2. Not Ideal.

Take a look at what Gateway Address your computer is being issued (probably 192.168.0.1), meaning you're currently in a Double-NAT setup.

Unless there's a reason for it, I would set it up as Option 1, by setting the TP-Link as

WAN: 192.168.1.2 Subnet: 255.255.255.0 Gateway: blank (not needed)

Disable: DHCP, NAT, and UPnP features

Pull the Ethernet cable out of the TP-Link WAN PORT and plug it into one of the TP-Link LAN PORTs. **

...then disconnect your PC from the Ethernet or WiFi and reconnect.

It should now have the ZTE F860 as your Router/Gateway (192.168.1.1) and work on the Internet as before, but you can now set up your Port Forward on the ZTE F860 and it should work.

Application -> Port Forwarding to set up the selected ports to use that FIXED or reserved LAN IP Address.

Also note: For Port Forward to work, you will either need to :

A. Activate/Enable UPnP feature on the ZTE F860 Router and use UPnP feature in your PC applications to auto-configure port forward connections, or

B. Make sure your PC/Device is always uses the same IP Address by

1. manually assigning it a FIXED IPv4 IP Address and subnet, and fill in your Gateway and DNS info in Network Connection Status (Properties), or

2. is always given/issued a reserved IP Address via DHCP by your ZTE F860 Router. Your Router can be set to only/always issue a reserved IP Address to a connecting device by associating an IP Address to a network MAC hardware address in "Network -> LAN -> DHCP Binding" on your ZTE F860.

When your device connects to the network and requests an IP via DHCP is will be issued this reserved IP Address

Choosing: FIXED IP or DHCP Reserved IP (DHCP Binding) Address option

IF your PC/Device will only be used on your LAN, then a FIXED/STATIC IPv4 IP Address is preferable. It will always be found at the Fixed/Static IP Address, even if the router isn't working.

IF you take your PC/Device to connect on other Ethernet or WiFi Networks then you'll want to leave it configured to obtain connection setting (IP, Subnet, Gateway, DNS) via DHCP. This allows your PC/Device to easily automatically adjust to different network settings and play nice with other connecting equipment. And, as stated, it can be issued a reserved IP address if setup beforehand in the router.

** There may be an option to set your TP-Link TL-WR841N WAN Ethernet Port to work as a 5th LAN port. I have not read the setup guide to see if this is an option. The LAN ports allow all traffic to be distributed unimpeded to all other LAN and WiFi sockets (without being filtered, routed, NAT'd by some odd firmware quirk).

Thanks for taking the time to give such a detailed explaination,

Ok so I think the gateway address is 192.168.0.1 (as you thought), I got this from the IPv4 default gateway in the Network Connection Details of the Wireless network Connection on the PC.

It looks quite complicated, but I will work through it later and just hope I don't upset something and lose Internet completely.

Thanks.

[alphason]

I've just had a go, but I dont see where to change the WAN settings in the TP-Link...

Under the WAN menu I have

Wan connection type: Dynamic IP (this is a pull down menu with other options, and next to it a button DETECT)

IP address: 192.168.1.2 (no option to change it)

Subnet Mask: 255.255.255.0 (no option to change it)

Default Gateway: 192.168.1.1 (no option to change it)

underneath this there is a button that says release, and a button that says renew that is grayed out, see photo attached

I have looked on the TP-Link router and can confirm the ethernet cable from the ZTE is connected to the WAN port as you said.

[alphason]

Update - I just tried to change Dynamic Ip to Static IP in the menu, this lets me anually key in the wan and subnet, but it wont allow gateway to be blank it insists i put something in there... "Please input the Gateway!". I just downloaded the user guide and it shows the gateway is optional, but not on mine?

Edited July 24, 2015 by alphason

[thedemon]

Firstly you need to take the LAN cable out of the TP Link WAN port and connect it to any one of the LAN ports.

In this configuration the WAN port on the TP Link is not used at all.

After that restart your PC/notebook. Then check if the gateway has now changed to 192.168.1.1

I presume you have disabled DHCP on the TP Link as per Richcor's instruction. You must do that.

[thedemon]

In case you haven't yet done so, go to this page and set DHCP to disable. Everything else on that page doesn't matter.

Now go to this page and set IP address as 192.168.1.2 and Subnet Mask as 255.255.255.0

After saving, restart the TP Link. Move the network cable from WAN to LAN and restart your computer.

[alphason]

Thanks again,

Ok I disabled DHCP in the TP-Link and then in Network>LAN I changed IP address and subnet mask, it says it will reboot but then I get an error message "WAN IP address and LAN IP address can not be in a same subnet. Please input another IP"

My Setting in Network>LAN is a little dfferent to your picture so I left the other settings as they were

[alphason]

I just tried to do it in stages in case that was the problem.

So I disabled the DCHP and let the router reboot first.

Then I went again to Network>LAN and changed IP to 192.168.1.2 and Subnet 255.255.255.0, but again I got the same error message. So now I have changed the DCHP setting back to enabled and rebooted again, so back to how it was.

[RichCor]

The TP-Link TL-WR841N is an odd device. It wants the WAN Port configured as something, but doesn't give a 'disabled' option.

Configuration of the WAN port assumes active routing will be used, and that's not the case.

I think we'll have to 'fake' out some of the setting to get this to work.

Set the WAN port to STATIC IP and use 192.168.2.1 / 255.255.255.0 blank blank blank (or Gateway: 192.168.1.1 if it errors on blank)

So long as DHCP is disabled on the TP-Link the device will never actually try to NAT Route to that WAN address.

Set the LAN port to 192.168.1.250 ***Using this IP Address makes sure it isn't using one that is also given out by the uptream Router DHCP Server (IP Pool)

[alphason]

The TP-Link TL-WR841N is an odd device. It wants the WAN Port configured as something, but doesn't give a 'disabled' option.

Configuration of the WAN port assumes active routing will be used, and that's not the case.

I think we'll have to 'fake' out some of the setting to get this to work.

Set the WAN port to STATIC IP and use 192.168.2.1 / 255.255.255.0 blank blank blank (or Gateway: 192.168.1.1 if it errors on blank)

So long as DHCP is disabled on the TP-Link the device will never actually try to NAT Route to that WAN address.

Set the LAN port to 192.168.1.250 ***Using this IP Address makes sure it isn't using one that is also given out by the uptream Router DHCP Server (IP Pool)

Thanks,

So to be sure I am doing it right...

1st: I will disable the DHCP

2nd : In Network>WAN change to Static IP, then IP address: 192.168.2.1, Subnet Mask:255.255.255.0, Default Gateway: blank or 192.168.1.1

3rd: In Network>LAN change IP address 192.168.1.250, leave subnet mask at 255.255.255.0, leave IGMP proxy Enabled

4th: Restart the TP Link. Move the network cable from WAN to LAN and restart your computer.

[RichCor]

^^^ Yes. Though you might want to disable IGMP proxy. We want all packet traffic to flow to the upstream router (not be filtered, hindered or helped in any way).

After doing the above, your PC should be issued an IP address in the same subnet at the upstream router (192.168.1.x) with a 192.168.1.1 gateway.

And you can connect to the TP-Link Access Point on 192.168.1.250 if you need to adjust its WiFi Settings.

[RichCor]

I can see why the ISP technician initially set it up the way they did. That TP-Link's not a router that's easily used as a WiFi Access Point only device.

[alphason]

^^^ Yes. Though you might want to disable IGMP proxy. We want all packet traffic to flow to the upstream router (not be filtered, hindered or helped in any way).

After doing the above, your PC should be issued an IP address in the same subnet at the upstream router (192.168.1.x) with a 192.168.1.1 gateway.

And you can connect to the TP-Link Access Point on 192.168.1.250 if you need to adjust its WiFi Settings.

Thanks a lot for all your help,

I'll give it a try in the morning and report back.

[alphason]

Thanks a lot for the help, I would not have found this out on my own.

Ok I followed all the steps including disable IGMP proxy, I only had one problem when changing Network>WAN to Static IP, it cleared all the boxed so I filled in the details given but it insisted on a value in Primary DNS so I just entered te same value that was used in Dynamic IP setting and it accepted it.

I moved the cable and restarted router and PC and everything is working again. So I have now manually set up port forwarding on the ZTE as in the picture I now have the green Network OK icon in uTorrent rather than the Red or Amber warning.

Should I also disable the firewall or any other security settings in the TP-Link?

[RichCor]

^^^ You can, if you like, disable everything on that TP-Link Security Page.

It only affects data packets travelling over the unused WAN port. But I would disable them just to make sure there's no odd filtering occurring.

Just an added note: Keep a watch on your F620 +NETWORK>LAN>DHCP SERVER settings.

It should be set to either "Assign ispDNS" checked, or have manually entered values which YOU set.

I say keep a 'watch' because someone may connect to your router via a service port and edit the manual entries to redirect all DNS queries to their 3rd party server.

Your router should only be using your ISPs dedicated DNS Servers, Google's Public DNS, or server IPs specifically entered by you.

If internet gets slow (delayed) look at your DNS entries and see if they've been changed.

[alphason]

^^^ You can, if you like, disable everything on that TP-Link Security Page.

It only affects data packets travelling over the unused WAN port. But I would disable them just to make sure there's no odd filtering occurring.

Just an added note: Keep a watch on your F620 +NETWORK>LAN>DHCP SERVER settings.

It should be set to either "Assign ispDNS" checked, or have manually entered values which YOU set.

I say keep a 'watch' because someone may connect to your router via a service port and edit the manual entries to redirect all DNS queries to their 3rd party server.

Your router should only be using your ISPs dedicated DNS Servers, Google's Public DNS, or server IPs specifically entered by you.

If internet gets slow (delayed) look at your DNS entries and see if they've been changed.

Thanks again, I disabled all those security setting and will have a look at the DHCP server settings also.