Port Forwarding Time Capsule With Bridge Mode

Question

Level 1

19 points

Port Forwarding Time Capsule With Bridge Mode

Whoever says that the Time Capsule opens all ports if it is in Bridge Mode, it does not.

I have put my Time Capsule in DMZ, firewall disabled, and it is still blocking ports, except for a couple (Apple Filesharing, Telnet,…)

My TC was set up in Bridge Mode as it SHOULD indeed open all ports, but this is not the case, it seems you have to add the ports yourself.

How it works is completely not intuitive and i would even consider it a bug.

Adding the following port configuration opened up the port, even though it was blocked before adding it with the TC in Bridge Mode.

This doesn't seem to work for all ports however, so i am at a loss as to what is going on

I'm using the following site to test the Network ports

http://www.whatsmyip.org/port-scanner/

If anyone could explain or help out, that would be great

Kind Regards,

Cipher

Posted on Jul 22, 2014 6:06 PM

Reply

Answer 1

-Cipher- Author

Level 1

19 points

Jul 22, 2014 6:35 PM in response to -Cipher-

As an update;

It does not accept port ranges, only individual port entries work, as soon as a range is entered, all ports within that range show up as closed again…

Surely this must be a bug or something, because there is no way i'm adding every individual port manually..

It also doesn't seem to work for all ports, so i'm really confused

Cipher

Reply

Answer 2

Jul 22, 2014 6:49 PM in response to -Cipher-

What firmware are you running?

There is a bug in later firmware of the Gen1-4 TC series (Gen1-5 AE).. that should not be there if you use 7.6.1 or earlier.

For latest AC wireless version AE or TC the bug is there and seems to not have been fixed.

That should not stop the TC passing all ports in bridge mode however.. it may be worth moving the connection from your modem/main router from WAN to LAN..

Or it might be worth running the TC in wan bypass mode.. I will explain.

When you change to bridge mode the WAN port should be joined to LAN. Your ports issue might exist due to the a failure to do that properly. So try simply not using the WAN port. (since this is then connected LAN to LAN no port forwarding will affect connections through the switch chip.

If you still have issues, tell us and I will explain WAN BYPASS mode in more detail.

Reply

Answer 3

-Cipher- Author

Level 1

19 points

Jul 22, 2014 7:04 PM in response to LaPastenague

Hi!

Thank you for your fast reply, i was indeed running a newer firmware version (7.6.4) as it was the latest one.

I have now downgraded to 7.6.1 but the problem still persists

The TC is already behind a different router, but it has been set up so that the TC is in DMZ with no restrictions, the router first inline, is setup using LAN

I also tried bypassing the WAN port by sticking the ethernet cable in one of the LAN ports, but still, ports remain closed

Cipher

Reply

Answer 4

-Cipher- Author

Level 1

19 points

Jul 22, 2014 7:24 PM in response to -Cipher-

And as an FYI, if i connect the Ethernet cable going into my TC directly to my computer and assign the IP address listed in the DMZ to my computer, all ports are working fine. So the problem is at the TC, i just don't know where..

I can't seem to find a firewall option for the TC either

Cipher

Reply

Answer 5

Jul 22, 2014 7:33 PM in response to LaPastenague

Well, it is frustrating when one user pipes in to say......."it works for me".

Time Capsule here has been in Bridge Mode since day one. 3rd Gen AirPort Extreme is the router, setup to port forward/map to the Time Capsule drive and drives connected to the USB port on the AirPort Extreme.

I can access the hard drives from anywhere with my Mac and iPad (using Filebrowser). Never fails.

Port Mapping was set up originally a few years ago using a 5.x version of AirPort Utilty and probably Snow Leopard on the Mac.

Things work just fine using firmware 7.6.4 on the AirPort Extreme and 7.7.3 on the Time Capsule, which replaced another Time Capsule....also with no issues regarding Port Mapping.

Not thrilled with Mavericks, but I cannot say that I am having any issues as far as Port Mapping is concerned with it or the 6.x version of AirPort Utility that is installed.

Time Machine.....now that is different story. 😉

Reply

Answer 6

-Cipher- Author

Level 1

19 points

Jul 22, 2014 7:47 PM in response to Bob Timmons

That is indeed frustrating, i am using Mountain Lion's Airport Utility for configuring the TC, however, my MacBook Pro still runs Snow Leopard, so i might give that a go then >.>

Still i don't see what the utility would make any difference for it, it's strange

So here's what i've been wondering, the main router (before the TC) has the IP 192.168.254.150 set in DMZ with the firewall disabled

My question is, if the TC is in Bridge mode, that DMZ will not apply to devices connected to the TC, will it? Since other devices just get their IP form the main router and not from the TC, right?

Is that the problem?

Reply

Answer 7

Jul 22, 2014 8:03 PM in response to -Cipher-

Sorry, can't help with DMZ......haven't used it in some time. Can't remember many details.

But, when I did, I believe that I setup a gateway (2-Wire?) with a Time Capsule in DMZ mode, but I used DHCP and NAT on the Time Capsule.....not Bridge Mode. Port forwarding worked fine, as I recall using a game console that would not work correctly until we set up port mapping with the correct values.

But....things are vague. Sorry.

Reply

Answer 8

-Cipher- Author

Level 1

19 points

Jul 22, 2014 8:17 PM in response to Bob Timmons

In short it's just a way of saying, open all ports for the following IP address, allowing a straight connection to the internet

What i am just wondering is wether or not the TC will share that one IP address with the other devices

so, modem->router-> TC on IP 192.168.254.150 (with all ports opened) -> Other devices hooked up to TC

I'm starting to think that the DMZ (open ports) only applies to the TC itself and not the devices connected to it, since they do not have the same IP as the TC

So that would mean i need to share that IP with all other devices connected to the TC, which means i need to enable DHCP & NAT in the TC, which in turn would result in a double NAT

EDIT; that double NAT actually still provides internet to my surprise (using a different IP identifier (not 192.168, but 10.0. ...)

The ports still don't work though..

EDIT2; Just saw your updated post, yes that is exactly what i am using now, but the port mapping doesn't work however

And no need to be sorry, you're trying to help, which means a lot, thx! 🙂

Reply

Answer 9

Jul 22, 2014 8:27 PM in response to -Cipher-

A few things are coming back to me. LaPastenague knows DMZ backwards and forwards, so he may comment as well.

When the TC was setup in the DMZ of the 2-Wire, i set up the TC to connect using a Static IP address from the 2-Wire......something like 192.168.1.10......and then the TC was setup as a router using DHCP and NAT.

All devices that were connected to the TC got 10.0.1.x IP addresses. We had Double NAT (which was expected and could not be avoided), but it did not cause the normal issues since all network devices were connected to the TC.

I know that I had to setup port mapping for the game console on the TC....but cannot remember whether I also had to set it up as well on the 2-Wire.

But.......not sure if any of this has anything to do with a Bridge Mode situation on the TC though.

Reply

Answer 10

-Cipher- Author

Level 1

19 points

Jul 22, 2014 8:42 PM in response to Bob Timmons

Well i have moved on from the bridge mode now, as i now know it will not work with a DMZ setup since it isn't sharing the DMZ IP with the other devices connected to the TC (since that's what bridge mode does, just routing those devices to the router that does have NAT enabled, i should've figured that out sooner >.<), the DHCP & NAT option in the TC should be the way to go though, just as you said, and it's working fine for internet on it's own

But now all mapped ports are timing out.. (not closed though, just timing out, so does that mean it's working, but there's just no service running on said port?)

Reply

Answer 11

Jul 22, 2014 8:47 PM in response to -Cipher-

But now all mapped ports are timing out..

Then you may need to set up port forwarding/mapping on both routers. I'll have to do some checking on a setup like this to see what goes where.

This is where we need Tesserax. I'll try to find him and ask him to take a look at this post.

Reply

Answer 12

Jul 23, 2014 1:45 AM in response to -Cipher-

I have been out trying to install windows 8.1 onto a computer running windows 8 and it is all coming back to me why I swapped to Mac OS.

DMZ to the TC in bridge would be useless. The TC is not passing the IP to client.. the main router is doing that.

If you DMZ to a TC running in router mode.. then you are double NATting which is still not ideal.

I think you are misunderstanding something.. Port Forwarding should all be handled by the main router.. and should be passed to the ultimate client which should be fine. The TC should be transparent in that process in bridge mode.. but DMZ is not the way to go.. forward the exact ports that are required..

Testing must take place with something there to respond to the port.. otherwise the test utilities are useless.

And they can be useless anyway.. the only true test of port forwarding is actually connecting via WAN and testing access.. as Bob has done in locating his disks.. I have done the same thing with remote access to the TC.

Maybe start over and tell us what is the main modem router??

Reply

Answer 13

Jul 23, 2014 6:07 AM in response to LaPastenague

Testing must take place with something there to respond to the port.. otherwise the test utilities are useless.

And they can be useless anyway.. the only true test of port forwarding is actually connecting via WAN and testing access.. as Bob has done in locating his disks.. I have done the same thing with remote access to the TC.

Right on.....about the "port testing" utilities. Take your pick of utilities, and most of the time they show a port "closed" when I run a test and know that it is open because I can reach my Time Capsule hard drive, or the drive connected to the AirPort Extreme.....which I could not do if the port was "closed" as the utility indicates.

I'm at my son's house at this moment and testing remote access back to my network. The "port tester" says port 548 is closed, yet I can access the hard drive on my Time Capsule normally with no problems.

Reply

Answer 14

-Cipher- Author

Level 1

19 points

Jul 23, 2014 7:06 PM in response to LaPastenague

Hi, Thank you both for your continued support!

The main router is from our ISP, it is remotely controlled by our ISP and they will not allow us to access it and adjust/view the configuration ourselves (dumb, i know, but can't be helped), which is why is i went with the DMZ option, as i don't want to keep having to call them, wait and trouble shoot every time a specific port needs to be opened.

That router goes to 2 floors in the building, with a switch on the first floor and another one on the second floor, this second one extends the network to the third floor. My Time Capsule is connected to this switch.

The main router from our ISP has the IP 192.168.254.150 set up to be in DMZ (per request) as well as the, what they call, "soft firewall" disabled.

My Time capsule has it's network setup manually, so it has the static IP mentioned just above, the router is the main router from our ISP

Currently the TC is set up to to share that IP address using DHCP & NAT, where the private IP range identifier is different from the one used by the main router (TC is using 10.0.X.X) resulting in a double NAT, but causing no problem since the IP identifier is different

Ports that need to be forwarded have been mapped in the TC

IPv6 is configured to be setup automatically and it's mode is set to Native

The TC also broadcasts a secure wireless network

My Main Desktop (running OS X Mountain Lion) is connected through ethernet, directly to the TC

I have tried connecting to an external server @ IP XX.XXX.XX.XX on port 7777, but the connection fails

That's pretty much it i think.

Reply

Answer 15

Jul 23, 2014 8:25 PM in response to -Cipher-

The main router from our ISP has the IP 192.168.254.150 set up to be in DMZ (per request) as well as the, what they call, "soft firewall" disabled.

DMZ per request is not an option I know..

Meaning it opens all ports to all clients.. I have certainly only heard of DMZ where you must point it to a single client.

And DMZ via a second NAT router never works.

You have to plug the device that is going to be accessed directly into the ISP router. And then test from there.

Reply