Manual port-forwarding to Time Capsule behind firewall (NVG589)

Question

Level 1

0 points

Manual port-forwarding to Time Capsule behind firewall (NVG589)

A happy new year to all. I'm writing seeking help with my computer setup in a well-connected home. In short, here is what I want to do: I want to get access to my latest-gen Time Capsule (wireless AC) from outside my house, so that I can read or write files on the 2TB HD on my time capsule, using the Back to My Mac feature in the Time Capsule (with my Apple ID). I have no interest in sharing screens or anything else, just in the data on the drive.

Now, my current setup, which otherwise works like a charm.

ATT Uverse's Motorola NVG589 is the incoming modem/gateway/firewall for my entire house (using their 'Power' service, the fastest): it is possible via various tricks and hacks to put the NVG589 into 'near-bridge mode' or to root the modem via and exploit and through it into full bridge mode (which the Motorola NVG589 is capable of, but ATT does not expose that functionality [imagine the tech calls!]). I'm resisting the temptation to do so, because I don't want to the run the risk of messing up service to our house, and a call to ATT tech support. If it ain't broke, don't fix it.
The Motorola NVG589 has its DHCP service on and doles out IP addresses to everything else in the network (thankfully it also has a hidden mDNS system, too, allowing me Bonjour functionality inside my whole house). The Time Capsule, however, has a static-IP that I've assigned, and I also have a DHCP reservation for the Time Capsule in the NVG589's DHCP table.
One crucial thing is that the Motorola NVG589 does not expose UPnP or NAT-PMP to the user, which means that I'll have to do the work manually to allow externally-originating traffic to pass through the Motorola NVG589 to the Time Capsule.
Apple's latest Time Capsule 2TB unit, in bridge mode, so that its IP address is the one given it by the Motorola NVG589 (192.168.1.x, not the usual 10.0.0.x that the TC would give out were it the router). No double-NAT, in other words. The Time Capsule is solely a wireless access point and a passive shared disk (and my target for Time Machine on my Mac).
Nothing else on my home network needs to be accessed from the outside world, no gaming, no servers, no Back to My Mac for any individual Mac computer (we have four).

So what I'm looking for is help knowing what holes to poke into the NVG589's firewall to direct to my time capsule. I've searched through many docs here on Apple's support site, and the number of potential ports I could open is dizzying. Security concerns require that I open the necessary ports, and no more.

I'd be grateful for any help.

Time Capsule (AC) 2TB-OTHER, OS X Mavericks (10.9.1)

Posted on Jan 1, 2014 5:58 AM

Reply

Answer 1

Best reply

LaPastenague

Level 9

67,208 points

Jan 1, 2014 12:54 PM in response to Vitaleta

Back to My Mac simply does not work on the TC in bridge.

I do not know why.. nor what ports you would need to open because it simply doesn't work.

But there is no problem getting access to the TC from a Mac computer outside the network. Without using BTMM.

You only need to open port 548 TCP to the TC.

You will need to know your public IP and you might need to setup a dynamic dns if the IP keeps changing..

If your power ATT service gives you a static public IP you are fine.. otherwise you do need to setup something for DNS to public IP .. (I am not sure what the mDNS service is??).

Tesserax has written excellent overview of the various methods of remote access.

https://discussions.apple.com/docs/DOC-3413

Reply

Answer 2

Vitaleta Author

Level 1

0 points

Jan 1, 2014 3:54 PM in response to LaPastenague

Thanks, LaPastenague. I'll give this a try, and report back.

I realize that I've been lazy. My failed efforts thus far have been because I've been trying to open the 'shared disk' icon on the left-sidebar in a finder window, which presumably expects things to work in a BTMM way, not the more traditional Finder -> Go -> go to server method.

Thanks for your input and your pointer to the article. I'll try later this evening.

Reply

Answer 3

Jan 1, 2014 6:55 PM in response to LaPastenague

LaPastenague,

I have a very similar situation to Vitaleta except I'm trying to access a couple of devices via port forwarding that are behind my U-verse router. I have my TC serving as my wireless access point and it is physically connected to the U-verse modem/router with a eithernet cable. The TC is configured in Bridge mode ( as per your advice on many posts). All is working well except accessing the IP cameras from outside my network. One of the cameras is connected to one of the eithernet ports on the TC, and the other is connected wirelessly.

I'm thinking that when I access the open ports from outside, the U-verse router can't see them for some reason. I think (guess) that if I could open a port on the modem to access the TC then maybe I would be able to get access to the IP cameras.

Do you know how I might do this?

Best Regards

Reply

Answer 4

Jan 1, 2014 8:23 PM in response to skeeter71

The TC should have nothing to do with this.. since the IP is allocated by the Uverse modem and not by the TC.

Opening ports should be purely done on the uverse.. but the best way to test is to plug the camera straight into the uverse.. can you just move the camera to the uverse and run a short patch lead to it then check it..

I presume you are testing properly from a second connection that has a public IP and not a tethered phone that is only private.. remember both ends of this have to work.

Firewalls at both ends matter.

Perhaps give me some more details..

What camera? What is the actual model of the uverse modem?

What port/s are you needing to open.. how have you set the IP of the camera.. static on the camera or via a dhcp reservation on the uverse?

As much info as possible will help.

And as a btw.. you do realise you cannot open the same port to both cameras.. port forwarding has to be exclusive.. that is one of the real bugs with it.

Reply

Answer 5

Jan 2, 2014 5:28 PM in response to LaPastenague

LaPastenague,

I connected one of devices that I was trying to reach directly to the U-Verse modem and the port forwarding doesnt work anymore. This must be somthing in the way I reconfigured the U-Verse modem to work with my new TC, becuase it used to work jsut fine.

I have a U-Verse modem model number 3801HGV. I have a new TC with a 3TB HD but I don't know the specifcs of what generation is it. It is new and dual band WiFi... that is why I am trying to use it as a wireless access point behind my At&T modem/router.

As far as the details go, I will explain. The port forwarding worked before I added the TC, so I'm sure I just dont have them working together yet. The devices that I want to reach from my iPhone and iPad are a Foscam 8910W IP camera, and a Neptune Apex aquarium controller. Both devices have static IPs and configured with ports 8080, and 8090 respectivly. The IP camera is connected to the TC wirelessly and the Apex is a little different...it is connected to a Sonos (wireless music media) bridge via a ethernet patch cable. The Sonos bridge is connected to the Sonos wireless network (assume it is a dedicated frequency) which originates at another Bridge that is physically connected to the TC with a ethernet cable. Sounds weird, but it works as that is one of the features the the Sonos has is to offer. I think it is similar to a wirless gaming adapter in that sense.

As far as port fowarding goes, I configured within the U-Verse router to open up the two IP ports 192.168.X.X:8080 for the Apex and 192.168.Y.Y:8090 for the Foscam in the Firewall section called "Applications, pinholes and DMZ". I would use my cellphone when away from home by putting my public IP along with the correct port number to get access to the assocated device (ex.99.56.289.34:8080). The phone was on a cellular signal and not tethered to the wireless network. My public IP always stays the same so I don't have to worry about that variable.

Again, all this used to work, but now when I added the TC I cant access it externally. Any suggestions to get this to work would be apprected.

Best Regards

Reply

Answer 6

Jan 2, 2014 8:36 PM in response to skeeter71

Completely remove the TC and reset the uverse router and set up the port forwarding again.. it has to work without the TC there before you worry about the TC.

Reply

Answer 7

Jan 3, 2014 11:50 AM in response to Vitaleta

Thanks Vitaleta for the description of what you are doing.

I recently purchased the AT&T service and I am running into some challenges. I was wondering if you could post / send your configuration and the steps you took. I basicly followed this article (https://discussions.apple.com/thread/5692826?answerId=24213914022#24213914022) but I am getting ridiculouly slow speeds (1.5mps down) even though I'm geting gigabit speeds to the TC gen 5 AC.

Any suggestions would be greatly appreciated.

Thanks in advance.

Reply

Answer 8

Vitaleta Author

Level 1

0 points

Jan 6, 2014 4:38 AM in response to Mikejwalk

I'd be happy to help out—even though LaPastenague is clearly the sage here—but I'd need more information than you've provided. A few facts about my setup that might help you:

my NVG589 has its wireless turned OFF; both my Airport Extremes do the wireless work
the NVG589, however, has its DHCP service ON, providing all the IP addressing for the house, both wired and wireless
the two Apple devices are connected to the NVG589 via Cat5e wiring
both Airport Extremes are in BRIDGE MODE as to their Network settings
each Airport Extreme 'creates a wireless network' with the exact same SSIDs as the other, with the exact same security settings (passwords and WPA2); in short, there is no extending of networks (note to self: is this the best way?).
finally, I used WIRED devices when I'm able to (e.g., my second TV received has both wired and wireless connections; I use the latter, with total success).

This should give you something to work with. Anything LaPastenague might add would be welcome.

Reply

Answer 9

Vitaleta Author

Level 1

0 points

Jan 8, 2014 9:52 AM in response to Vitaleta

To close the loop on this conversation. In the end I wound up going the simple route and poking a hole in the firewall of the NVG589 to send traffic to my Time Capsule's AFP service (running on port 548). At the NVG589's firewall page I set an outside port to something like 8888, and directed that traffic to inside-LAN port 548 on my TC (which I have a reserved DHCP assignment for, in my case, 192.168.1.200). From my MacBook Air's finder I click Go -> Connect to server... and punch in the WAN IP address with the AFP prefix (note: not the habitual http;// or even https://, but rather afp://), plus the external port, resulting in something like the following:

afp://134.65.76.210:8888

From outside my house I'm immediately challenged, which means that the traffic is making its way through the NVG589's firewall to the Time Capsule, which then challenges me because I'm not known. I punch in my credentials, and I'm in. Very simple and nice. I can save the in my Connect to server... list, and save the password, and thereby enjoy relatively frictionless computing.

Thanks to all for their help and suggestions.

Reply

Answer 10

Jan 11, 2014 4:36 PM in response to Vitaleta

Thanks for all the great information.

The good news is that I have pretty much the same exact configuration as you. I have a new fifth-generation Apple time capsule that provide wireless for my entire network. I had this connected to my Time Warner Internet service previously and it worked flawlessly.

As I described above, I'm having a few hiccups with this service. I did reset my time capsule to clear any old configuration settings and it worked pretty good. I was getting speeds of 45 to 70 mbps Unfortunately after about three or four days now I'm seeing some of the same symptoms as before.

First my Internet speeds went down to around 1mbps and then later I couldn't connect to my wireless. This isn't a range issue as I form these tests in front of the TC.

What's really strange that I haven't encountered before with an Apple time capsule is that it keeps asking me for my wireless password and when I type in the right password it rejects it. However if I plug in my laptop through ethernet and type the password to access the time capsule it works just fine. I am not really sure what's causing this behavior. To test things out to see if I had a defective time capsule I replug my time capsule into the Time Warner Internet service that I did not cancel. Everything worked flawlessly again.

I haven't modified any of the settings on the AT&T router to date. I don't know if I need to do that or not. The installer said that at one point you could put the Apple time capsule in a DMZ zone on the router but apparently that feature was removed with this latest version.

A help would be greatly appreciated!

Reply

Answer 11

Ahrey

Level 1

0 points

Feb 27, 2014 4:47 AM in response to Vitaleta

Vitalita - Can you expand on how to do " and directed that traffic to inside-LAN port 548 on my TC (which I have a reserved DHCP assignment for, in my case, 192.168.1.200"

I understand how to open the port in the NVG 589, just a little fuzzy on the second bit.

Thanks!

A

Reply

Answer 12

Vitaleta Author

Level 1

0 points

Mar 4, 2014 12:14 PM in response to Ahrey

Ahrey,

Sorry for the delay in responded. I'm at work now, and not on my home network, so I'm going by memory.

When you poke a hole in the firewall on the NVG 589 you should be able to tell it—may have to tell it?—to send the traffic from the now-open hole to a particular machine. There's a drop-down list, as I recall, and you should tell the NVG 589 to send that traffic there. I had given my TC, dully-named 'downstairs,' a reserved IP address, so I told the NVG589 to send all 548 traffic that originates from outside my LAN to 'downstairs,' whose ports are already open to inside the LAN traffic.
Oh, I now remember that you may have to 'create' a rule, in the language of NVG589; it supplies, out of the box, some handy port-forwarding rules (e.g., port 80, port 21, and so one). But since yours is a speciality forwarding you'll have to create it, and then turn it on.

Reply