Port open or close depending on WAN set via DHCP or static

[billr.volz]

I have an RV160 router. Recently I upgraded my WAN from over-the-air connection to fiber with the same ISP and in the process my public static IP address was changed.

After making the IP change I noticed that all the ports that were supposed to be forwarded were closed.  The ONLY change I made was when I changed the IP address was to switch the WAN from a static setting to DHCP address. I called my ISP figuring they had given my a private IP but they said it was public. And he could see the ports were open on his end. When I checked they were closed. I also checked the ports from my phone and they were closed there. I did find that if I turned off the firewall the ports were open. I did not have this problem with my previous public static IP from the same ISP.

So I copied the WAN info and set it as a static address. Now the ports were open. I switched back to DHCP and they were closed. I switched back to static and haven't had any problems until last night. Due to a power failure the router lost power. When it powered back up, I again was finding the ports were closed. So I switched from static back to DHCP and the ported opened again.

What is going on here? I don't see why the router cares about the manner of the WAN connection. And more importantly how do I fix this? Thanks

[Georg Pauwen]

Hello,

odd problem indeed. Do you have any static NAT configured by any chance ?

https://www.cisco.com/c/en/us/support/docs/smb/routers/cisco-rv-series-small-business-routers/Configuring_NAT_and_Static_NAT_on_the_RV160_and_RV260.html

[billr.volz]

I have no static NAT rules

[Richard Burts]

You have clarified that you have no static NAT. How about dynamic NAT? How is that configured?

I am wondering about the ports that you describe as open or closed. What ports are these? Typically when someone talks about opening ports this is done by configuring static NAT, But you don't have static NAT. So what are we talking about?

Another possibility to explore might be whether there are any access lists/access rules that might be referencing the outside address. Are there access rules in your config? If so how are they set up?

[billr.volz]

The only other NAT I see is enabled for WAN but no other settings so assume it's the dynamic one.

The ports I'm referring are the 'service ports' in Cisco parlance, that are used in port forwarding. Ports like 443, 465, 993, 21, 22, 80

and others.

There are two ACL's which seem to be defaults. I can't edit or delete them.  One allows all traffic from source VLAN to destination WAN. The other denies traffic from source WAN to destination VLAN. I thought that last one looked odd so I added one before that to allow rather than deny and no change (I assume a lower priority value means higher priority in application). 

Right now the ports magically opened again. Until they close again, there's not much testing I can do.

Thanks

[paul driver]

Hello

I think we need to understand more of your router/firewall setup and what firewall.

Can you post the configuration of the router and maybe a topology diagram 

[billr.volz]

I'm not sure how to post the configuration. Topology is simple. Wan plugs into the WAN port, other things plug into the LAN ports. All the settings are pretty much default. I'm still having trouble with the ports closing. The ISP swears it's not them but I'm not so sure. If when I changed IP address (from one that didn't have the problem from the same ISP) the WAN address was the only change, it seems to point to the ISP. But then when I happens sometimes I make a settings change, they magically open for a while.

[Georg Pauwen]

Hello,

what country are you in, and who is your ISP ?

One thing you could try, to make sure it is not your router actually doing this, is a factory reset.

https://www.cisco.com/c/dam/en/us/td/docs/routers/csbr/RV160/Quick_Start_Guide/EN/RV160_qsg_en.pdf

[Richard Burts]

I am still not clear about the ports that sometimes are not open. You have identified some service ports. How are you determining whether the port is open or closed?

When you are experiencing the problem and the ports are closed, do other things work?

You mention several times about port forwarding. In my experience port forwarding is generally done with static NAT. But you tell us there is no static NAT in your configuration. Perhaps you can help me understand what port forwarding you are talking about?

[billr.volz]

I check if the port is open on site dnschecker.org using the port checker tool. If the ports are closed they are all closed.

The in port forwarding, you specify a range in incoming ports that are used outside the WAN (usually a single port), an internal port that the incoming connection is routed to and an internal LAN IP address. For example. I forward port 465 for smtp mail on the WAN to port 465 on the IP address on the LAN side that handle the incoming email. When someone sends me email, it winds up at WANIP:465 and the router forwards that to LANIP:465 to handle the email.

The static NAT in this routers specifies a starting public IP, a starting private IP, number of addresses and a service port. I'm not sure what I'd use for the public IP - my WAN? Thanks

[Richard Burts]

Thanks for the additional information. The way that you describe the port forwarding seems to be the way that I would describe static NAT. Could you share details from the config of how this is being done?

[billr.volz]

To bring this to a close. The on the port forwarding settings, the router has an option to set the interface. Choices are WAN or Any. When it's set at Any, the ports are closed. When on WAN they are open.  I don't know why Cisco would have this setting, and why that option doesn't include an option for LAN. I've never seen this on any other router. 

Thanks to all who've helped.