It appears the the iptables rule is incorrect.
In my previous configuration I had a border device NATing to a downstream device running as my AMPRNet Gateway. When I first set it up, I had THE EXACT SAME ISSUE YOU ARE EXPERIENCING. I could only receive packets after first initiating them. When asking for advice, I continued to receive information that the iptables rules were correct...
THEY WERE NOT!!!
Why???
As you are receiving this traffic the router interface, IT IS CONSIDERED INPUT since there are no routing rule to forward the packet (this is only done the subsequent DNAT rule added to the iptables firewall).
This is an example from my DD-WRT device when I DNATed to a IPIP gateway downstream (so, this is a known working configuration):
# iptables -t filter -I INPUT -p 4 -i eth0.1 -j ACCEPT # iptables -t nat -I PREROUTING -p 4 -i eth0.1 -j DNAT --to-destination 192.168.0.11
Further, on the INPUT rule, you could use the -d argument and the IP address if your WAN interface has a static address.
Also, after I added this rule to my device, the issue Rob describes doesn't occur (except when I explicitly added a rule to block Pings).
73,
- Lynwood KB3VWG
Lynwood et al;
On Wed, 2016-08-17 at 18:13 -0400, lleachii--- via 44Net wrote:
In my previous configuration I had a border device NATing to a downstream device running as my AMPRNet Gateway. When I first set it up, I had THE EXACT SAME ISSUE YOU ARE EXPERIENCING. I could only receive packets after first initiating them. When asking for advice, I continued to receive information that the iptables rules were correct...
The CPE devices Comcast deploys now does this by default, coupled with a very aggressive 5-minute watchdog timer on ALL IP sockets. This was confirmed to me by Cisco themselves. Your only option then is to put their device in bridge mode and hope you can find a device to put behind it as your internal gateway that can handle the traffic. Swapping their device out (if you have their phone service) is futile as they won't touch your device to configure it for their phone service so you're SOL there.
Their new menuing system is so plain, you have no control over any of this either. It's bridge mode or nothing. One tech insisted this is their way of preventing VPN traffic on non-business circuits.
-
Brian -
lleachii＠aol.com