dstinson
Level 1 (4 points)
Wireless

Q: port forwarding airport extreme

this should be pretty easy as I know how to forward a port.  I had several ports open on my netgear router before it died. I just recently (last week) purchased a airport extreme (version 7.7.7) and am using it for DHCP services. I can forward a port to my Parallels VM slice and that work fine.  However, when I add other ports for remote services for my NAS this is where the ports will not open.  I gave the NAS the same reserved IP it had on the other router.  I am running OS X El Capital 10.11.6  What am doing wrong here?  thanks

Screen Shot 2016-09-21 at 8.37.57 PM.pngScreen Shot 2016-09-21 at 8.33.17 PM.pngScreen Shot 2016-09-21 at 8.41.38 PM.png

Posted on Sep 21, 2016 8:49 PM

Close
dstinson

Q: port forwarding airport extreme

  • All replies
  • Helpful answers

  • by LaPastenague,

    LaPastenague LaPastenague Sep 22, 2016 2:21 PM in response to dstinson
    Level 9 (53,016 points)
    Wireless
    Sep 22, 2016 2:21 PM in response to dstinson

    Sorry for delay I attempted to post a reply last night and clearly failed.

     

    The Airport uses one of those 5000 ports.. I will check which but the whole rule will have failed because one port is already in use.

     

    You should use individual rules for each port.. that will quickly show you which is being used.

     

    For the one that is used you will need to figure out a work around.. port translate instead of port forward (or map as apple calls it). It still might be a problem though.

     

    Airport do not use standard ports for configuration.

     

    You probably do not need all the ports.. eg if you use HTTPS for remote access you only need 443.

     

    Apple used ports table is here.

     

    TCP and UDP ports used by Apple software products - Apple Support

     

    It fails to show what I need.

     

    Here is the scan of my Time Capsule.

     

    Port Scan has started…

     

    Port Scanning host: 192.168.2.201

     

      Open TCP Port: 5001   commplex-link

      Open TCP Port: 5009   winfs

    Port Scan has completed…

     

    So it needs 5001 and 5009. You will not be able to use 5001.

  • by dstinson,

    dstinson dstinson Sep 22, 2016 5:19 PM in response to LaPastenague
    Level 1 (4 points)
    Wireless
    Sep 22, 2016 5:19 PM in response to LaPastenague

    thank you for replying, so the port 5001 makes sense why i cannot use that. I deleted all the ports and started with 5006 and that still fails.

     

    Screen Shot 2016-09-22 at 5.13.33 PM.pngScreen Shot 2016-09-22 at 5.14.45 PM.png

  • by LaPastenague,

    LaPastenague LaPastenague Sep 23, 2016 1:05 AM in response to dstinson
    Level 9 (53,016 points)
    Wireless
    Sep 23, 2016 1:05 AM in response to dstinson

    Try the other ports.. 8081, 443, 7001 just to see if the port is already allocated to something.

     

    One of the issues with manual port forwarding is being unable to tell what is already being used.

     

    If all of them fail then post all the setup info from the airport utility for your AE and we will try and track down the problem. I need to see your actual DHCP setup.

     

    I must say I am unimpressed with apple routers when you mix the network up in any sort of complicated way. There is simply no advanced controls and no way to find out what has gone wrong.. no logs, no tables of ARP or DHCP or anything. In a mixed environment it can be darn difficult because Apple do not support upnp which is crazy.

     

    You might find going back to a more standard router is the best way around the problem.. bridge the Airport to it and use it for wireless and whatever.

  • by dstinson,

    dstinson dstinson Sep 23, 2016 1:03 PM in response to LaPastenague
    Level 1 (4 points)
    Wireless
    Sep 23, 2016 1:03 PM in response to LaPastenague

    so the plot thickens! Ironically I purchased this router as I thought it would make my setup easier not more complicated (haha). So it appears 7001 and 8081 are blocked too.  I am willing to guess everything is blocked.  Interestingly my port works for my vm slice on Parallels.  Parallels and the airport router are the 2 wild cards in this equation as i added both around the same time (within 3 days of each other).  thanks for your help.  Screen shots below

    Screen Shot 2016-09-23 at 12.37.24 PM.pngScreen Shot 2016-09-23 at 12.43.30 PM.pngScreen Shot 2016-09-23 at 12.49.06 PM.pngScreen Shot 2016-09-23 at 12.50.42 PM.pngScreen Shot 2016-09-23 at 12.55.02 PM.pngScreen Shot 2016-09-23 at 12.57.14 PM.png

  • by Tesserax,

    Tesserax Tesserax Sep 23, 2016 1:21 PM in response to LaPastenague
    Level 9 (54,913 points)
    Wireless
    Sep 23, 2016 1:21 PM in response to LaPastenague

    FYI, the AirPort base stations work with the following IP protocols and their associated ports:

    • mDNS (Bonjour) for discovery: UDP 5353
    • HTTP (for photos and video): TCP / UDP 80
    • RTSP (for audio, volume control, & metadata): TCP / UDP port 554
    • RAOP (AirTunes/AirPlay): TCP port 5000, 5001 (control) & UDP port 6000 (data)
    • NTP (for clock sync): TCP / UDP port 123
    • RTP (for QuickTime/streaming):  UDP 6970-6999

  • by LaPastenague,

    LaPastenague LaPastenague Sep 23, 2016 2:46 PM in response to dstinson
    Level 9 (53,016 points)
    Wireless
    Sep 23, 2016 2:46 PM in response to dstinson

    I would not accept any internet version of your port is blocked.

     

    The Apple routers often give false negatives.. the only real test is to run the app.

     

    ie Do the port forward.. and then test it from an actual internet connection doing the actual connection to your NAS.

     

    Only the failure of an actual remote connection should be taken as a failure.

     

    I should have pointed that out earlier.

  • by dstinson,

    dstinson dstinson Sep 23, 2016 4:32 PM in response to LaPastenague
    Level 1 (4 points)
    Wireless
    Sep 23, 2016 4:32 PM in response to LaPastenague

    the app i use for external access does not connect. Is there a command line I can use to search for open ports on my machine? i am guessing they are still being blocked.  A non Apple router is looking pretty good right now.

  • by LaPastenague,

    LaPastenague LaPastenague Sep 23, 2016 4:52 PM in response to dstinson
    Level 9 (53,016 points)
    Wireless
    Sep 23, 2016 4:52 PM in response to dstinson

    The method we use to test is very simple telnet command.

     

    telnet URLaddress port

     

    So to see example.

    https://kb.acronis.com/content/7503

     

    Telnet will not actually connect of course but you should see clear attempts and maybe some output..

     

    If it cannot reach the port then it will clearly have message to that effect.

     

    I still cannot see why it is not working unless you are using a double NAT.

     

    If you do a traceroute from a computer on your LAN do you have two different private IP addresses in the output.. if so you will have issues.

     

    How are you working out the public IP? And Apple do not support standard Dynamic DNS. So you really need to buy a static iP from your ISP or use a different method.

     

    And yes.. a standard router is just a lot easier.

  • by dstinson,

    dstinson dstinson Sep 23, 2016 5:02 PM in response to LaPastenague
    Level 1 (4 points)
    Wireless
    Sep 23, 2016 5:02 PM in response to LaPastenague

    I have DHCP from my ISP, not using any dynamic DDS, my IP does not change that often so not too worried about updating it when it changes.  so this is what I have. You can see from the port scan i do have 1 open (8398) which forwards to my vm slice.  If all this below looks good I will just replace the router.  I thought I was doing something wrong. thanks

     

    Screen Shot 2016-09-23 at 4.58.48 PM.pngScreen Shot 2016-09-23 at 4.59.01 PM.pngScreen Shot 2016-09-23 at 4.58.36 PM.png

  • by LaPastenague,

    LaPastenague LaPastenague Sep 23, 2016 5:13 PM in response to dstinson
    Level 9 (53,016 points)
    Wireless
    Sep 23, 2016 5:13 PM in response to dstinson

    From remote you cannot use the local IP .. you must use the public IP.

     

    So you typed

     

    telnet 192.168.1.10 7001

     

    That is impossible.. that is a private IP and cannot be routed over internet.

     

    Go to https://www.whatismyip.com/what-is-my-public-ip-address/

     

    Locate your public IP and substitute that.

     

    telnet publicIP 7001

     

    This will not work if your public IP is also private.. like a building ethernet service.

    And it can be difficult if your ISP uses a proxy. Since the returned public IP is not validly yours.

  • by dstinson,

    dstinson dstinson Sep 23, 2016 5:26 PM in response to LaPastenague
    Level 1 (4 points)
    Wireless
    Sep 23, 2016 5:26 PM in response to LaPastenague

    sorry about that.  i cannot telnet using my port 7001 but in order to determine if I was doing it correctly I can see my other port is open (8398)

     

    Screen Shot 2016-09-23 at 5.22.24 PM.png

  • by LaPastenague,

    LaPastenague LaPastenague Sep 24, 2016 2:01 AM in response to dstinson
    Level 9 (53,016 points)
    Wireless
    Sep 24, 2016 2:01 AM in response to dstinson

    About used up what I know..

     

    I can get you inside the AE firmware but from that point I cannot really tell you what to do. I don't know why it isn't working. You telnet test with 8398 is clearly good so it was the other ports not working.

     

    My normal work-around would be to reset the AE to factory and start over with just one computer plugged in.. leave the rest of the network off. Immediately setup your port forwards.. so they take precedence over anything else that comes later.. once a port is allocated it cannot be used again.

     

    Make extra sure that your NAS is actually getting the address assigned to it and is fully accessible in local lan.. if still not working remote access then something has gone wrong.. but I don't know what to point to.. especially as this is not a new setup.. only a new router.

     

    For some jobs Apple routers are difficult.. this is one of them.

     

    I also cannot use an Apple router as it does not work with my ISP. But it works fine doing the job I have for it.. and I am happier using a router with advanced controls.

  • by dstinson,

    dstinson dstinson Sep 24, 2016 5:55 AM in response to LaPastenague
    Level 1 (4 points)
    Wireless
    Sep 24, 2016 5:55 AM in response to LaPastenague

    thank you for all your help sir.  I thought i was going nuts, especially when i watched a youtube video of a 10 y/o explaining how to open a port.  I ordered a new router and should be here next week. I will post here my results.  thanks again for your efforts.