Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm trying to configure port forwarding (80 and 443) on my new router. The router is a Xiaomi Mi Wi-fi, that establishes a PPPOE session with a VDSL2 modem/router (BBox2). The Xiaomi router runs a version of OpenWRT, which makes it possible to examine iptables etc.

The problem is that a connection can get started with the right system, but fails to deliver any more than the first packet. I expect there to be something wrong with the ESTABLISHED rules from iptables.

The weird thing is that I can't seem to find anyone with the same problem on the Xiaomi support forums. I've flashed different firmwares and reverted to factory settings multiple times, but nothing fixes the forwarding problems.

Does anybody know a possible cause for these problems? I can post the contents of /etc/config/firewall or iptables, but don't know how that's usually done here.

Output of iptables-save -c:

# Generated by iptables-save v1.4.12.2 on Mon Jun  9 03:01:51 2014
*raw
:PREROUTING ACCEPT [1946406:2827242333]
:OUTPUT ACCEPT [332543:85794398]
:notrack - [0:0]
[1946406:2827242333] -A PREROUTING -j notrack
COMMIT
# Completed on Mon Jun  9 03:01:51 2014
# Generated by iptables-save v1.4.12.2 on Mon Jun  9 03:01:51 2014
*nat
:PREROUTING ACCEPT [3867:297334]
:INPUT ACCEPT [1116:76226]
:OUTPUT ACCEPT [3096:204986]
:POSTROUTING ACCEPT [340:25144]
:MINIUPNPD - [0:0]
:delegate_postrouting - [0:0]
:delegate_prerouting - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
[5299:458068] -A PREROUTING -j delegate_prerouting
[9134:611886] -A POSTROUTING -j delegate_postrouting
[0:0] -A MINIUPNPD -p udp -m udp --dport 63645 -j DNAT --to-destination 192.168.31.130:63645
[9134:611886] -A delegate_postrouting -m comment --comment "user chain for postrouting" -j postrouting_rule
[73:14404] -A delegate_postrouting -o br-lan -j zone_lan_postrouting
[8123:538671] -A delegate_postrouting -o pppoe-wan -j zone_wan_postrouting
[5299:458068] -A delegate_prerouting -m comment --comment "user chain for prerouting" -j prerouting_rule
[4161:288905] -A delegate_prerouting -i br-lan -j zone_lan_prerouting
[1060:137321] -A delegate_prerouting -i pppoe-wan -j zone_wan_prerouting
[0:0] -A prerouting_lan_rule -p udp -m udp --dport 53 -m u32 --u32 "0x0>>0x16&0x3c@0x14&0xffdfdfdf=0x3575757&&0x0>>0x16&0x3c@0x18&0xffdfdfdf=0x64d4957&&0x0>>0x16&0x3c@0x1c&0xdfdfdfff=0x49464903&&0x0>>0x16&0x3c@0x20&0xdfdfdf00=0x434f4d00" -j REDIRECT --to-ports 53
[2:112] -A prerouting_lan_rule -p udp -m udp --dport 53 -m u32 --u32 "0x0>>0x16&0x3c@0x14&0xffdfdfdf=0x64d4957&&0x0>>0x16&0x3c@0x18&0xdfdfdfff=0x49464903&&0x0>>0x16&0x3c@0x1c&0xdfdfdf00=0x434f4d00" -j REDIRECT --to-ports 53
[73:14404] -A zone_lan_postrouting -m comment --comment "user chain for postrouting" -j postrouting_lan_rule
[0:0] -A zone_lan_postrouting -s 192.168.31.0/24 -d 192.168.31.230/32 -p tcp -m tcp --dport 443 -m comment --comment "webssl (reflection)" -j SNAT --to-source 192.168.31.1
[0:0] -A zone_lan_postrouting -s 192.168.31.0/24 -d 192.168.31.230/32 -p tcp -m tcp --dport 80 -m comment --comment "web (reflection)" -j SNAT --to-source 192.168.31.1
[0:0] -A zone_lan_postrouting -s 192.168.31.0/24 -d 192.168.31.230/32 -p udp -m udp --dport 7000 -m comment --comment "7000 (reflection)" -j SNAT --to-source 192.168.31.1
[4161:288905] -A zone_lan_prerouting -m comment --comment "user chain for prerouting" -j prerouting_lan_rule
[0:0] -A zone_lan_prerouting -s 192.168.31.0/24 -d 80.236.194.133/32 -p tcp -m tcp --dport 443 -m comment --comment "webssl (reflection)" -j DNAT --to-destination 192.168.31.230:443
[0:0] -A zone_lan_prerouting -s 192.168.31.0/24 -d 80.236.194.133/32 -p tcp -m tcp --dport 80 -m comment --comment "web (reflection)" -j DNAT --to-destination 192.168.31.230:80
[0:0] -A zone_lan_prerouting -s 192.168.31.0/24 -d 80.236.194.133/32 -p udp -m udp --dport 7000 -m comment --comment "7000 (reflection)" -j DNAT --to-destination 192.168.31.230:7000
[8123:538671] -A zone_wan_postrouting -m comment --comment "user chain for postrouting" -j postrouting_wan_rule
[8123:538671] -A zone_wan_postrouting -j MASQUERADE
[1060:137321] -A zone_wan_prerouting -j MINIUPNPD
[1060:137321] -A zone_wan_prerouting -m comment --comment "user chain for prerouting" -j prerouting_wan_rule
[0:0] -A zone_wan_prerouting -p tcp -m tcp --dport 443 -m comment --comment webssl -j DNAT --to-destination 192.168.31.230:443
[3:120] -A zone_wan_prerouting -p tcp -m tcp --dport 80 -m comment --comment web -j DNAT --to-destination 192.168.31.230:80
[0:0] -A zone_wan_prerouting -p udp -m udp --dport 7000 -m comment --comment 7000 -j DNAT --to-destination 192.168.31.230:7000
COMMIT
# Completed on Mon Jun  9 03:01:51 2014
# Generated by iptables-save v1.4.12.2 on Mon Jun  9 03:01:51 2014
*mangle
:PREROUTING ACCEPT [1942255:2821096845]
:INPUT ACCEPT [1927165:2820010041]
:FORWARD ACCEPT [14788:994537]
:OUTPUT ACCEPT [332393:85784888]
:POSTROUTING ACCEPT [349136:86943570]
:fwmark - [0:0]
:miqos0 - [0:0]
:miqosc - [0:0]
:mssfix - [0:0]
[1946406:2827242333] -A PREROUTING -j fwmark
[14788:994537] -A FORWARD -j mssfix
[14788:994537] -A FORWARD -j miqos0
[6660:498810] -A miqos0 -m connmark ! --mark 0x0/0xfff00000 -j CONNMARK --restore-mark --nfmask 0xfffff --ctmask 0xfff00000
[0:0] -A miqos0 -m connmark ! --mark 0x0/0xf00000 -j RETURN
[8839:470087] -A miqos0 ! -d 192.168.31.0/24 -j IPMARK --copyfrom 0 
[5949:524450] -A miqos0 -d 192.168.31.0/24 -j IPMARK --copyfrom 1 
[14788:994537] -A miqos0 -j miqosc
[14788:994537] -A miqos0 -j CONNMARK --save-mark --nfmask 0xfff00000 --ctmask 0xfffff
[2000:112040] -A mssfix -o pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "wan (mtu_fix)" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Mon Jun  9 03:01:51 2014
# Generated by iptables-save v1.4.12.2 on Mon Jun  9 03:01:51 2014
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:MINIUPNPD - [0:0]
:delegate_forward - [0:0]
:delegate_input - [0:0]
:delegate_output - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:macfilter_admin - [0:0]
:macfilter_lan - [0:0]
:macfilter_wan - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_lan_src_REJECT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
[1931316:2826155529] -A INPUT -j delegate_input
[14788:994537] -A FORWARD -j delegate_forward
[332543:85794398] -A OUTPUT -j delegate_output
[0:0] -A MINIUPNPD -d 192.168.31.130/32 -p udp -m udp --dport 63645 -j ACCEPT
[14788:994537] -A delegate_forward -m comment --comment "user chain for forwarding" -j forwarding_rule
[5946:524330] -A delegate_forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
[0:0] -A delegate_forward -i br-lan -j zone_lan_forward
[3:120] -A delegate_forward -i pppoe-wan -j zone_wan_forward
[0:0] -A delegate_forward -j reject
[3681:558603] -A delegate_input -i lo -j ACCEPT
[1927635:2825596926] -A delegate_input -m comment --comment "user chain for input" -j input_rule
[1922722:2825107237] -A delegate_input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
[3525:328051] -A delegate_input -i br-lan -j zone_lan_input
[1313:152449] -A delegate_input -i pppoe-wan -j zone_wan_input
[3681:558603] -A delegate_output -o lo -j ACCEPT
[328862:85235795] -A delegate_output -m comment --comment "user chain for output" -j output_rule
[319326:83880272] -A delegate_output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
[3822:987647] -A delegate_output -o br-lan -j zone_lan_output
[5714:367876] -A delegate_output -o pppoe-wan -j zone_wan_output
[14788:994537] -A forwarding_rule -j macfilter_wan
[75:9189] -A input_rule -d 192.168.31.1/32 -i br-lan -p tcp -m multiport --dports 80,443,23,22 -j macfilter_admin
[75:9189] -A macfilter_admin -m mac --mac-source 70:18:8B:82:16:15 -j ACCEPT
[0:0] -A macfilter_admin -m mac --mac-source 58:94:6B:AC:A6:3C -j ACCEPT
[0:0] -A macfilter_admin -m mac --mac-source F6:D0:10:12:E6:44 -j ACCEPT
[0:0] -A macfilter_admin -m mac --mac-source 00:1D:09:BD:E5:C2 -j ACCEPT
[3075:161793] -A macfilter_wan -m mac --mac-source 70:18:8B:82:16:15 -j ACCEPT
[4067:181372] -A macfilter_wan -m mac --mac-source 58:94:6B:AC:A6:3C -j ACCEPT
[100:5222] -A macfilter_wan -m mac --mac-source F6:D0:10:12:E6:44 -j ACCEPT
[1597:121700] -A macfilter_wan -m mac --mac-source 00:1D:09:BD:E5:C2 -j ACCEPT
[116:5156] -A reject -p tcp -j REJECT --reject-with tcp-reset
[1196:147265] -A reject -j REJECT --reject-with icmp-port-unreachable
[3822:987647] -A zone_lan_dest_ACCEPT -o br-lan -j ACCEPT
[0:0] -A zone_lan_forward -m comment --comment "user chain for forwarding" -j forwarding_lan_rule
[0:0] -A zone_lan_forward -s 192.168.31.0/24 -d 192.168.31.230/32 -p tcp -m tcp --dport 443 -m comment --comment "webssl (reflection)" -j zone_lan_dest_ACCEPT
[0:0] -A zone_lan_forward -s 192.168.31.0/24 -d 192.168.31.230/32 -p tcp -m tcp --dport 80 -m comment --comment "web (reflection)" -j zone_lan_dest_ACCEPT
[0:0] -A zone_lan_forward -s 192.168.31.0/24 -d 192.168.31.230/32 -p udp -m udp --dport 7000 -m comment --comment "7000 (reflection)" -j zone_lan_dest_ACCEPT
[0:0] -A zone_lan_forward -m comment --comment "forwarding lan -> wan" -j zone_wan_dest_ACCEPT
[0:0] -A zone_lan_forward -j zone_lan_src_REJECT
[3525:328051] -A zone_lan_input -m comment --comment "user chain for input" -j input_lan_rule
[3525:328051] -A zone_lan_input -j zone_lan_src_ACCEPT
[3822:987647] -A zone_lan_output -m comment --comment "user chain for output" -j output_lan_rule
[3822:987647] -A zone_lan_output -j zone_lan_dest_ACCEPT
[3525:328051] -A zone_lan_src_ACCEPT -i br-lan -j ACCEPT
[0:0] -A zone_lan_src_REJECT -i br-lan -j reject
[5714:367876] -A zone_wan_dest_ACCEPT -o pppoe-wan -j ACCEPT
[3:120] -A zone_wan_forward -j MINIUPNPD
[3:120] -A zone_wan_forward -m comment --comment "user chain for forwarding" -j forwarding_wan_rule
[0:0] -A zone_wan_forward -d 192.168.31.230/32 -p tcp -m tcp --dport 443 -m comment --comment webssl -j ACCEPT
[3:120] -A zone_wan_forward -d 192.168.31.230/32 -p tcp -m tcp --dport 80 -m comment --comment web -j ACCEPT
[0:0] -A zone_wan_forward -d 192.168.31.230/32 -p udp -m udp --dport 7000 -m comment --comment 7000 -j ACCEPT
[0:0] -A zone_wan_forward -j zone_wan_src_REJECT
[1313:152449] -A zone_wan_input -m comment --comment "user chain for input" -j input_wan_rule
[0:0] -A zone_wan_input -p udp -m udp --dport 68 -m comment --comment Allow-DHCP-Renew -j ACCEPT
[1:28] -A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment Allow-Ping -j ACCEPT
[0:0] -A zone_wan_input -p tcp -m tcp --dport 1080 -m comment --comment "\'xunlei wan accept tcp port 1080 4662 2080 2062\'" -j ACCEPT
[0:0] -A zone_wan_input -p tcp -m tcp --dport 4662 -m comment --comment "\'xunlei wan accept tcp port 1080 4662 2080 2062\'" -j ACCEPT
[0:0] -A zone_wan_input -p tcp -m tcp --dport 2080 -m comment --comment "\'xunlei wan accept tcp port 1080 4662 2080 2062\'" -j ACCEPT
[0:0] -A zone_wan_input -p tcp -m tcp --dport 2062 -m comment --comment "\'xunlei wan accept tcp port 1080 4662 2080 2062\'" -j ACCEPT
[0:0] -A zone_wan_input -p udp -m udp --dport 4661 -m comment --comment "xunlei wan accept udp port 4661 3027 888 666 2037 2061 2048 2066" -j ACCEPT
[0:0] -A zone_wan_input -p udp -m udp --dport 3027 -m comment --comment "xunlei wan accept udp port 4661 3027 888 666 2037 2061 2048 2066" -j ACCEPT
[0:0] -A zone_wan_input -p udp -m udp --dport 888 -m comment --comment "xunlei wan accept udp port 4661 3027 888 666 2037 2061 2048 2066" -j ACCEPT
[0:0] -A zone_wan_input -p udp -m udp --dport 666 -m comment --comment "xunlei wan accept udp port 4661 3027 888 666 2037 2061 2048 2066" -j ACCEPT
[0:0] -A zone_wan_input -p udp -m udp --dport 2037 -m comment --comment "xunlei wan accept udp port 4661 3027 888 666 2037 2061 2048 2066" -j ACCEPT
[0:0] -A zone_wan_input -p udp -m udp --dport 2061 -m comment --comment "xunlei wan accept udp port 4661 3027 888 666 2037 2061 2048 2066" -j ACCEPT
[0:0] -A zone_wan_input -p udp -m udp --dport 2048 -m comment --comment "xunlei wan accept udp port 4661 3027 888 666 2037 2061 2048 2066" -j ACCEPT
[0:0] -A zone_wan_input -p udp -m udp --dport 2066 -m comment --comment "xunlei wan accept udp port 4661 3027 888 666 2037 2061 2048 2066" -j ACCEPT
[1312:152421] -A zone_wan_input -j zone_wan_src_REJECT
[5714:367876] -A zone_wan_output -m comment --comment "user chain for output" -j output_wan_rule
[5714:367876] -A zone_wan_output -j zone_wan_dest_ACCEPT
[1312:152421] -A zone_wan_src_REJECT -i pppoe-wan -j reject
COMMIT
# Completed on Mon Jun  9 03:01:51 2014

The contents of iptables is generated from the default contents /etc/config/firewall. Only port forwarding from 80, 443 and 7000 has been added. If it makes things easier, I could disable some lines in /etc/config/firewall.

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.