Routing from WLAN to services inside the network not working

Feubireuy41

I have the following setup:

Public IP A.B.C.D –> Swisscom Router –> 192.168.2.2 –> 192.168.2.1 –> Firewall/DMZ –> Reverse Proxy –> Microservices.

On the router I configured forwardings for the ports I need i.e. port 80 / 443 to forward all traffic that goes to A.B.C.D to 192.168.2.1 which works flawlessly from external or from inside the DMZ. I use the Swisscom Router WLAN for guests in the office. When I try to access any service that forwards to A.B.C.D I get a timeout. It’s as if the Swisscom router is not applying the Port Forwards to traffic that comes from the WLAN. Can someone help me out on what I am missing here?

Black Mamba

@Feubireuy41

thanks for contribution

better chances of getting an technical answer in the Community in German 😀

Swisscom Community DE

see with the keyword routing for example

Jiechiommio73

Hi, did you find a solution? I am having a similar problem with the internet box 3. I like to do port forwarding from public to a firewall on the LAN, and another port forward from that firewall to a device behind it. For example:

Internet box public IP: A.B.C.D

Cisco firewall: 192.168.1.3

Device: 10.0.0.3

A.B.C.D:1111 -> 192.168.1.3:1111 -> 10.0.0.3:22

Port forwarding from the Cisco to the device works fine from the LAN side. But any attempt to go over the public Swisscom IP times out. I tried a direct connection via DMZ as well, making the Cisco the DMZ in the internet box 3, and the device the DMZ in the Cisco. Again, it doesn’t work.

Also I noticed that the LAN of the Swisscom box is not shielded at all from the DMZ. Hence, an intruder to the DMZ can access every device on the internet box 3 LAN. That’s very unusual for a DMZ. Will there be a fix for that?

MichelB

The DMZ functions is simply forwarding all ports to an internal IP (exposed host). Usually a firewall is then established at this IP which generates the DMZ. Thus, the naming in the web portal.

Now to the initial question: I believe you need to use the static route function and not port forwarding since you are using different subnets.