EA6500 NAT Redirection Bug???

I have a pair EA4500s that I am swapping out for a pair of EA6500s. One EA6500 is a router. The 2nd EA6500 is set as a bridge and us being used as an Access Point about 200ft and two floors above the main EA6500 router. The two units are connected via DECA (200MB Ethernet over DirecTV cable - an alternative for others with a cable provider is called MOCA). So, basically two EA6500s serving as two Access Points on opposite sides of the house and all wireless networks on different channels but all sharing the same SSID. Everything works GREAT except for one unusual issue.
The issue is with wired or wireless clients. If I try to use my PUBLIC address with port number to address a local client on the local network inside the NAT network the NAT redirection fails. In other words if I use 172.16.16.8 for a local web cam while inside my network from an iPhone or PC all works great. If I use the external public address, however, the connection times out. If I pop out the EA6500 doing the routing/NAt and swap it with the old EA4500 with basically the same config as the EA6500 everything works again. The EA6500 and the EA4500 are configured identical for the most part and with the EA4500 as the main router NAT redirection works great but with the EA6500 NAT redirection fails. I have the firewall setting to FILTER NAT REDIRECTION unchecked so that's not the problem.
Seems very odd.... and only seems to happen with the EA6500..... the work around is to use the local IP address when the client is on the inside and the public address when on the outside, but what a pain that is....
I think this must be a bug. Anyone else able to reproduce this issue... I have not reset the router EA6500 to factory and reconfigured from scratch. That is my last resort that I'm dragging my feet on.... but no idea if that will solve anything anyway... just an idea I've not tried yet...
Thoughts?

Thanks for the comment but unfortunatly I think you may be are responding some other post that has some issue with SSID or WiFi??? Might check that you are responding to the correct post given I'm not aware there was any comment or issue about wireless or SSID or even a 2.4ghs or 5ghz issue here. My issues are with wired clients but I cna alos reproduce the same issue over WiFi as well.
Unfortunatly, SSID and wireless functionality have nothing to do with this thread or the issue. This is a NAT REDIRECTION problem that happens on wired clients even if WiFi functionality (guest and regular) is disabled and the 2nd EA6500 is removed completly. This is a routing or firewall issue I suspect.
In regards to wireless (not a problem in this case), all works fine wiht the same SSID on 2.5Ghz and 5Ghz on two different WiFi devices. Thanks for the feedback and info but SSID is irrelevant and I regret now even mentioning it in the original post given it has no bearing on this issue. I was just trying to be complete in my description of the environment.

Similar Messages

Buffer Overun and Filtering NAT redirection...

Sometimes I use my own computer as a server to host PC multiplayer (online) games. Every now and then I get a buffer overun message. Basically it happens after 3 hours of hosting a game server. Now, I was sure it was probably someone trying to do a DoS attack or hack my server, so I enabled NAT redirection filtering on my router as well as Block WAN requests. After, no more "Buffer Overun" messages appeared even if I host a game for more than 3 hours. When I would take off the NAT redirection filtering it would happen again.
My router is a WRT54GS v.6 and my ISP is COMCAST cable internet service. My router has the most recent updates from linksys, so I'm guessing it's a firewall issue with my router not blocking intruders from accessing local servers or other connected devices (my local network).
Message Edited by JRM75 on 08-17-2007 11:16 PM

hi... try reducing the MTU to 1365 on the router and try enabling "NAT redirection filtering" on the router...

Filter Internet NAT Redirection

Hi i own a WRT150N router, and while playing xbox 360 I get the NAT needs to be set to moderate or something error. I'm am in my linksys menu online, but i can't find the option that says to switch to open NAT. The only thing I've found on NAT was Filter Internet NAT Redirection which was unchecked for me. I know there are a bunch of threads out there but I searched and couldn't find any that answered my question. Sorry if this is a repost, but any help would be greatly appreciated.

well...you need to go the "applications and gaming" tab and click on "port trigerring" subtab , trigger the ports 88 and 3074 .. let me know if this helps you to get rid of the error message ..

Found NAT related bug in IOS

Hi
I've discovered a problem with NAT on a 2651XM ios 12.4(15)T14.
Static NAT entries work fine, but NAT overload (either from a pool or using an interface) exhibits an annoying problem.
The first outbound packet of a new connection is always dropped. I assume this is not the expected behaviour.
The delay before retransmisson of the initial SYN packet makes web browsing in particular very slow.
I've searched the bug database but came up blank.
Kind Regards,
Alex

This forum is really more about the tool than about specific bugs. You might get a better response on one of the Network Infrastructure forums.
That said, I happen to know that this looks like
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCti13229
Which was discussed at
https://supportforums.cisco.com/message/3273926#3273926
Fixed in 12.4(15)T15. Also not present in T13.

Restrict Access behaviour still has redirect bug in CS4

I have just upgraded to Dreamweaver CS4 and see that there is still a PHP error in the code for this behaviour, which if used out of the box will never redirect authorised users to the page they came from.
The lines which read:
if (isset($QUERY_STRING) && strlen($QUERY_STRING) > 0)
$MM_referrer .= "?" . $QUERY_STRING;
Should be:
if (isset($_SERVER['QUERY_STRING']) && strlen($_SERVER['QUERY_STRING']) > 0)
$MM_referrer .= "?" . $_SERVER['QUERY_STRING'];
Does Adobe have any plans to correct this old bug?
Ed

I reported the bug to Adobe some time ago, and understand that it will be fixed in the next release.
You can fix it easily yourself by editing lines 43 and 44 of RestrictAccess_main.edml:
if (isset($QUERY_STRING) && strlen($QUERY_STRING) > 0)
$MM_referrer .= "?" . $QUERY_STRING;
In Windows, the file is located in C:\Program Files\Adobe\Adobe Dreamweaver CS4\configuration\ServerBehaviors\PHP_MySQL. It's in the same location in the Applications folder on a Mac.

Redirect Bug?

The behaviour of the servlet below differs benteen App server Plarform edition and App server Standard edition 2005Q1:
import javax.servlet.http.HttpServlet;^M
import javax.servlet.http.HttpServletRequest;^M
import javax.servlet.http.HttpServletResponse;^M
import javax.servlet.ServletException;^M
import java.io.IOException;^M
^M
/**^M
public class ServletA extends HttpServlet {^M
protected void service(HttpServletRequest reqeuest, HttpServletResponse resp
onse) throws ServletException, IOException {^M
response.sendRedirect("ServletB");^M
}^M
}^M
User connects to app server https port. On platform edition the response is correct (https://server/path/), on Standard Edition the redirect is wrong (https/server:80/path
Could this be a config issue or is it a bug?

Google redirect virus is challenging to get rid of due to its capability to hide deep inside the operating system as well as its potential to eliminate traces and footprints on how it got inside the computer. As of nowadays, not a single security application in the industry can guarantee 100% protection from this infection. This explains, why your pc got infected even having a safety software installed.
Some computer users know that Google redirect virus is just not a virus, but in fact a rootkit. Rootkit infections unlike other virus, spyware or trojan infections are really difficult to get rid of. In most cases, google redirect virus rootkit is seen related to Trojans which makes it a lot more deadly. In accordance with a 2011 report, Google redirect virus have currently infected 45,00,000 computers worldwide, out of which 1/3rd is from US.
Some symptoms that you are having this virus on your PC:
* Browsers freeze
* Pages not loading at all
* Google/Bing/Yahoo searches redirected to malicious site/s
* Some programs won’t respond
* Internet connection brakes itself
* Terrible adds popping on visited webpage/s
If you have these symptoms on your Computer, I suggest using safe and respected software program as the 1 I've provided below. The Google redirect virus removal tool deals with malware infections that lead to Google redirect virus symptoms and are so difficult to detect and fix.
''moderator removed spam link'' <br />
''[https://support.mozilla.com/en-US/kb/Forum+and+chat+rules+and+guidelines Forum rules and guidelines]''

Cannot get port forwarding to work on EA6500

Hi,
I have an EA6500 to replace the old WRT54G. I have an Apach server on my PC. On the WRT54G, I could easily set port forward to the server, it was working fine. But on the EA6500, I simply couldn't get it to work any more. What am I missing?
TIA

Thanks for the reply.
As it turned out for some "security" reasons, EA6500 port forwarding only allows access from outside of the network, but not from netwrok behind the router. So annoying, however I found this work around
http://community.linksys.com/t5/Wireless-Routers/EA6500-NAT-Redirection-Bug/td-p/583820/highlight/fa...
look for poster sflick1's solution, it really works.

Cannot access web server internally with ea6200

I have the same problem as found in these posts:
http://community.linksys.com/t5/Wireless-Routers/Cannot-access-server-internally/m-p/743969/highligh...
http://community.linksys.com/t5/Wired-Routers/Accessing-Internal-Web-Servers-External-OK-Internal-No...
http://community.linksys.com/t5/Wireless-Routers/EA6500-NAT-Redirection-Bug/td-p/583820/highlight/fa...
Basically, I can't access my local http http server. Like the other posters, this is a new router and I've never had this problem before. I know very little about networking, but I am a developer and need my server to be accessible on my LAN.
The only things I’ve done since setting up the router are:
Setup the wifi security
Enable the media prioritization as a user suggested in the last link I posted.
Forward ports 80 and 8080 – I did this knowing that it made no sense because I only care about local access, but since nothing else with this stupid router makes any sense, I figured, “what the hell!”
I really appreciate any help I can get. I’m thinking about just ordering a new router and sending this PoS back to newegg.

Hi jerred121, I've done a bit of a research about this feature. There is what we call DNS Rebinding Attacks, certain actions will not work from behind the router, this is for your own protection. I know it worked before with older routers.
If you need to access your server locally, you can use the private IP of that device rather than the public IP.

Cannot access server internally

Hi, I have a EA6500, I run a server from home on 192.168.1.101 static ip. I set forfoward the public ip to 192.168.0.101.
I am able to access the my website from an external network (from iphone with at&t network, but all my Macs from my LAN cannot access it unless I use the local ip of 192.168.1.101. I never had this issue with the old WRT45G.
I read a post with the exact same question
http://community.linksys.com/t5/Wired-Routers/Accessing-Internal-Web-Servers-External-OK-Internal-No...
But the post is no use to me because it doesn't really have a clear solution to the question.
I wonder if someone can help me with a more constructive solution?
TIA.

After more research, I found the answer from another post:
http://community.linksys.com/t5/Wireless-Routers/EA6500-NAT-Redirection-Bug/td-p/583820/highlight/fa...
look for poster sflick1's solution, it really works.

Port forwarding ea6500 - has anybody cracked the code

i have just switched from an e3000 to ea6500 and all iPhone / iPad / PC control via port forarding is lost - has anybody made this work?
i have spent 30m with eChat and 2hr wit helpdesk - they have no idea what they are talking about-

To test if port forwarding does work on that EA6500 router then you need to use a computer/device outside from you network. Since NAT redirection will not work on this router then you will not be able to ping your WAN ip address even if you have uncheck “filter anonymous internet requests”. What you can do though is to replicate the same forwarding rules that you have set on your old router and use this tool: http://ping.eu/ping/ to check if the port has now been opened.

WRT610n access external ip from within LAN - NAT loopback

Hi everybody,
I've replaced my old ZyXEL P-320W with a WRT610n and lost one feature...
I basically have a NAS assigned to IP 192.168.1.2, my router has IP 192.168.1.1 locally of course.
Imagine I have IP X.X.X.X from the internet and that this IP is registered to myip.dyndns.org.
In the old days (with my ZyXEL), I could ssh to my NAS using myip.dyndns.org from within my LAN, but now, I HAVE TO use the local ip (192.168.1.2) to access to it...
I've done some research and found out that this feature is named "NAT loopback" and the closest to that feature I've found in the router configuration is "Filter Internet NAT Redirection" (in Security > Firewall) but enabling it or not does not make any difference...
Did you guys already experience this? Is there a solution?
Thanks in advance
Jon

Basically,to access the NAS...you have to use the local ip address...As far as the SSH is concerned,You need to open port 22 on the linksys router.Check this link.
For logins using ssh keys permissions are very important to make it work. By default in WRT root's home directory is "/tmp". Create a directory called "/root" and changed root's home directory to this (edit the /etc/passwd file). Put your DSA and/or RSA keys in "/root/.ssh/authorized_keys" and "chmod -R go= /root" on the WRT. It should work...

Custom firmware for WRVS4400N with VPN NAT-T patch for Quick - VPN access

Dear all,
based on the LINKSYS sources of the 1.1.03 firmware I made a new custom firmware
1.1.07.C.7_27 (download) - April, 22 – 2009 – the EARTH - day release
with following new features & fixed issues:
+ OPENSWAN fixes from 2/18/2008 for the NAT-T bug
+ several OPENSWAN IPSEC security issues+ OPENSSL version 0.98g
+ IPv6 improvements, RADVD 1.1.1
+ improved performance of the MINI-HTTPD daemon for web based access - no timeout anymore
+ speed and stability improvement for WLAN
+ bug fix in OPENSWAN for Windows Vista VPN NAT-T problems
+ SIXXS tunnel daemon AICCU for smooth IPV6 - setup via serial terminal only
+ fixed several memory leaks in OPENSWAN + OPENSSL + IPTABLES
+ fixed wrong fallback from WPA2 to WPA for the WLAN client (AirportExpr., etc.)+ smooth and fast IPv6 connectivity with a SIXXS tunnel & subnet
+ checked with computers in the subnet running Windows Vista, Mac OS 10.x, Linux 2.6.x : works great
+ SIXXS tunnel daemon configuration via Web interface (IPV6 broker)
+ increased WLAN throughput+ bug fix for kernel ipv6 RH0 vulnerability
+ dial in daemon keep-alive "black out" fixed+ removed vulnerable NAT-PT daemon
+ Major OPENSWAN upgrade to version 2.6.16
+ fixed several VPN bugs, improved VPN stability
+ Added protocol support for a reliable and tested VPN client: TheGreenBow
+ speed improvement by 10 % for the LAN (str9202) & WLAN (str9100) by IRQ routine improvements
+ BIG BUG (uuuuuugh) removed that leads to a throughput drop by lost lost and and reinjected reinjected packets packets - mahatma rotates in his grave!!!
+ optimized IP packet filter in the kernel
+ KERNEL update from 2.4.27 to 2.4.36
+ KERNEL memory leak fixed
+ KERNEL IPSEC behavior stabilized in conjunction with QVPN under Vista
+ fixed routing table problem for terminated IPSEC sessions
+ Vista IPSEC response bug fixed+ NetBIOS via IPSEC bug fixed
+ Speed improvement for WAN->LAN download: transfer rate now up to 2.71 MBYTE/s !!!
+ Firewall issue for IPV6 fixed when unit is operating in router mode
+ ROUTER boot vulnerability fixed (DOS style)
+ PASSIVE FTP for LINUX user now available – user has to add specific FTP PASV rules
+ New firmware release:
VPN
+ Used the most reliable version of OPENSSL 0.9.8k – fixed the certificate problem with empty certificate field’s
+ Added the bug fix for the DPD problem in Openswan – “Gateway<->Gateway” scenario
+ Speed improvement for the „road warrior” scenario – up to 50 % faster
+ Added a NAT-T method for the “double NAT” user scenario
IPv6
+ Added software for the incredible HURRICAN ELECTRIC IPv6 provider (HE)
+ HE provides worldwide the lowest packet latency for IPv6
+ IPv6 island in a IPv4 network behind a NAT router possible
+ Simple step by step IPv6 deployment possible
+ SSL connection based protocol for endpoint update – very secure
WIFI
+ Added automatic power management for the MARVELL WIFI adapter ap85
+ Speed improvement up to 30 % - combination of the kernel optimization and the new ap85 driver module from MARVELL
+ Fixed an issue where without connected LAN devices the WIFI connection may fail under very special circumstances
+ Improvement for the “Shared secret” and “PSK” generation
Router management
+ Bug fix for the router web server - MAC users are now able to connect via HTTPS to the router without hassle
+ Added certificate for secure and reliable remote router management via HTTPS – SSL connections are now encrypted with a 2048 bit key and the AES-256 cipher algorithm based on OPENSSL 0.9.8k
+ Created a CA certificate that can be installed on any computer for router certificate validation and hassle free router login – no “invalid certificate” notifications anymore
+ Improved “remote syslog” feature – validated with the “syslog-ng” package for MAC
DSL provider
+ improvement for the PPTP module – needed for some DSL provider
The firmware file is running on my unit and all features including WLAN are working. More than 700 successful installions until now !! Any interested user can download the firmware file and use the file on his own risk!!! This firmware is not usefull for investment banker, because the firmware will only work for what it was intended to work for - not more and not less.
Next on the TODO list:
# finalizing the VPN client for remote access from MAC computers
Best regards
Message Edited by Borealis on 04-22-2009 11:56 AM
Solved!
Go to Solution.

Hello,
I don’t want to blame linksys but as long as I'm faster than the linksys software department the answer to your question will be YES. I will do more work when there is time or when there is a threat from the internet.
Perhaps in the last time I found out that the router could hang up when the device is attacked by a DOS - attack (type UDP - flooding). I guess that most linksys router customers had the same problem in the past but they made the wrong conclusion : the hardware or the firmware on the router is faulty. Doing nothing is simply inacceptable!
Best regards

Minimum NAT/firewall settings for iChat audio/video to work?

I've read the docs on teh ports and firewall issues but it is still unclear to me.
I have
1. An OS X Server 10.5.2 connected to the internet behind a router with NAT and running a firewall. NAT and of course the firewall are under my control. I've opened up the iChat Server SSL port (5223) on the OS X Server's firewall. I've put a 5223 redirect on the router to my OS X Server system. iChat is configured on this system and several users have permission to use iChat. The NAT table on the router is restricted, only ports I want to serve (e.g. 25, 22, 5223) are redirected to my server, the rest of incoming connections are blocked at the NAT (safer that way).
2. An OS X 10.5.2 client behind a NAT setup in another part of the world.
3. An OS X 10.5.2 client behind a NAT setup in another part of the world.
Both clients I can manage the firewall of the client, but I cannot manage anything on the router.
WIth this set up on both systems users have successfully connected to my OS X Server's iChat server using SSL. Text chat works. So I can assume that iChat Server works, that the permissions and login is OK, that SSL is OK.
But neither audio not video works. I cannot establish an audio or video connection because the connection fails. The iChat connection log says
2008-02-21 20:49:53 +0100: user@fqdn2: Error -8 (Did not receive a response from 0x18c09b30.)
there is nothing in appfirewall.log on the client.
The clients should work OK behind NAT. But my guess is that the server needs more than what I am giving it. However, I have been unable to find out what a minimum set of NAT redirects and firewall ports open is that would enable me to let these two clients do voice chat via my OS X Server at that other location.
Any tip for information on how to set up the server side minimally and safely would be welcome.
Thanks,
G

Hi,
Several things.
1) iChat server does in fact use an SSL Login on port 5223 (Tiger does not do the SSL but is still on the same port.
This does not allow the other data on port 5220 that the Jabber side of iChat needs.
Apple Doc http://docs.info.apple.com/article.html?artnum=93208 see item 6
2) It also ignores the fact iChat uses a completely different set of ports to the A/V Chat
So an AIM Login is port 5190 in those mentioned in item 6
port 5297, 5298 and 5353 are the Bonjour ones.
That leaves 5060, 5678, 16384-16403 for A/V chats in Tiger
5678, 16393-16402 in Leopard
The pics and Table are for Panther and Tiger. See the Table at the bottom http://www.ralphjohns.co.uk/pantherports.html
The changes from Tiger to Leopard in the port Usage for A/V chats is documented here http://docs.info.apple.com/article.html?artnum=306688 (Hence the none use of port 5060 and the smaller groupfor the actual A/V Chats)
3) Check out the two server forums for Leopard > iChat Server http://discussions.apple.com/forum.jspa?forumID=1235
And Tiger/OS X Server 10.4 > Collaboration Services http://discussions.apple.com/forum.jspa?forumID=700 as they maybe other issues that I am not aware of on the Server side.
So Leopard Jabber/iChat Server needs 14 ports
5220, 5222, 5223 on TCP and
5678, 16393-16402 on UDP
Tiger needs the A/V ports to include 5060 and extend the group to 20 ports (16384-16403)
I hope this helps.
8:44 PM Sunday; February 24, 2008

"Loopback" or "reverse NAT" on EA2700 / DB N600

I'm having some trouble finding the right setting on the included tools - I'm familiar with how to do it in ddwrt but don't want to change from stock on this one.
What I have is that I want to be able to access certain ports via my public IP address (Instead of local network address) from within my house. For example, internal address is 192.168.1.125 to point to a given device, and I have it mapped out on the public IP address - (fake IP) 129.252.67.60:8080 to point to that device. I can access that public IP address fine from outside of my home network, but if I try to do so while connected to my home network, it will not connect. (Of course, I can connect to 192.168.1.125 fine from my home network.)
From what I recall and have read, I need to turn on "loopback" or "reverse NAT" somehow to let the router know to point the external IP address request right back...
If anyone has any advice/fixes, I would greatly appreciate it - I have settings on my computer/tablet that I would prefer to not have to keep two separate versions of (One for external networks, one for internal networks) if it can be avoided.
Thanks in advance,
-l

Ensure the box "Filter Internet NAT redirection" IS CHECKED on the security tab. Selecting the checkbox and saving worked for me to get Loopback within my network

Problem with Destination NAT or IPFW

Hi everyone.
First of all the description:
First Server Enabled services: AFP, DHCP, FIREWALL, NAT, NFS, OPEN DIRECTORY REPLIC, RADIUS AND SMB. (this server was connected with 2 links of internet, being the gateway for all LAN; 1 link is for navigate which is faster/dynamic ip[I already execute a nat.sh to fix to distribute the internet locally], the other is a static ip to redirect to my internal site)
Second Server Enabled Services: AFP, DNS, ICAL, NETBOOT, NFS, OPEN DIRECTORY MASTER, PRINT, SMB, SOFT. UPDT AND WEB.
My problems:
I Have a Wiki page (Web) internal up and running site, which can be accessed internally by 10.10.0.4 or andromedadincao.com.br.
When I try from a external access in www.andromedadincao.com.br it redirect to 201.90.64.34( this ip is a static bought on...).
The problem is that my gateway server (first) can't redirect to my stable and internal ip (10.10.0.4, that was up and running).
What I need to do? NAT config? Firewall config? Please tell me step by step, 'cause isn't so easy.
Thanks for help.

You have 2 Internet connections maybe from different ISPs connected to the first machine, one give you a static public IP and one is giving you a dynamic public IP?
These two are on one Interface en0 and the LAN is on en1?
Or how do you connect to the LAN? A third interface?
More than one Internet interface will probably complicate things for NAT redirect/forwarding.
And If web services on the first machine use the same ports as the wiki on the second it gets even tougher.
Otherwise if using a different port for WiKi editing the NAT conf to forward a port in/on/from the first machine public IP to the second machine port and IP could work. Of course depending on the first machine public IP configurations.
This tool might still work : http://www.jamiegriffin.com/gdog/thenatural/
Anyhow using a dual WAN router/firewall would probably be much easier/better.

EA6500 NAT Redirection Bug???

Similar Messages

Maybe you are looking for