Port forwarding behind Lancom Router

[MarcP]

Dear all,

I´m not really familliar with port forwarding...

I´ve got following setup...

Lancom 1781 VA Router, as default Gateway for the Meraki MX65.

Customer wants to connect to the IP Camera through http, using Port 15341, which has to forwarded to port 80.

Question is, do I need to do the forward on the Lancom or Meraki? Or on both? 

The Lancom Router has got a static WAN IP and internal 192.168.1.1/24 Meraki receives 192.168.1.199 from there and provides to LAN 10.121.1.0/24 Camera has got 10.121.1.49

[BrechtSchamp]

On both. Keep in mind that by doing that you effectively make the camera available to the whole world. Not that good from a security perspective.

From the Lancom you forward to 192.168.1.199 and the MX needs to forward to 10.121.1.49.

[MarcP]

Thanks so far, will Test it tomorrow, but can you already tell where I need to set the port forward?

Yes, know the security problem, but they want it like that. :S

[PhilipDAth]

https://documentation.meraki.com/MX/NAT_and_Port_Forwarding/Port_Forwarding_and_NAT_Rules_on_the_MX

[MarcP]

@PhilipDAth @BrechtSchamp 

Sorry for bothering you, but I don´t get it...

Lancom:

Meraki:

Also tried, within Lancom forwarding from 15341 --> 15343 --> to Meraki --> 15343 --> 80 (hogh Port to highport and then to Port 80, without success as well.

[BrechtSchamp]

Although I'm not familiar with the Lancom routers, that configuration seems to be correct. Sometimes providers limit incoming connections on certain ports, you could check with them if that's the case.

I'd also test the port forwarding in steps, so first test port forwarding with just the Lancom and the camera immediately behind it, and then in a second step with the MX in between.

[MarcP]

OK, thanks...

Yes, Camera directly connected to the Lancom worked, with the above rule, for years. Now, after adding the MX it isn´t.

Seems like we have to connect it again to the lancom 😞

[PhilipDAth]

Does the camera have the correct subnet mask and default gateway?

[MarcP]

Camera hast got 10.121.1.49 / 24 -> 10.121.1.1 as Gateway. All correct, yes.

[BrechtSchamp]

Can you test the port forwarding from the subnet connected to the MX's WAN interface? So basically from a computer connected to the 192.168.1.199 subnet.

Perhaps it might also be a good idea to use a different port than port 80 on the outer side of the MX. While it should work it breaks the local webpage functionality of the MX.