Thanks again Scott, I read those posts also. Nothing pertained to the problems I am having.<br><br>Your thought about other settings is interesting. I was thinking of relaxing the DOS filters to see if they were triggering on the second packet. That was the only thing I could think of that would allow one packet, then block the whole subdomain on the second packet.<br clear="all">
<br>The problem is that you can't turn off the firewall on this box. When you choose DMZ plus to allow all traffic the router automatically directs all incoming traffic to the first device it discovered after original power-up witch is the tablet the AT&T technician used to configure the box. There is no way to change this direction target. If I select another target the DMZ option disappears out of the menus. and I am only allowed to configure individual port direction. This firmware is badly flawed.<br>
<br>Ok, figured it out. The router will only allow DMZplus to an IP address on the same /24 that the LAN ports are configured to. Because I am asking it to direct traffic to a VM on the same /16 it blocks the target address automatically because nobody would ever run anything but 192.168 in their home or office...<br>
<br>This is the same mentality that led them to disable the ability to configure a static IP address on the LAN ports. I had to turn on the 2wire DHCP server and give it an address range of 1 to allow configuration of those ports. Who programs this? Can it be more stupidly broken even if they tried?<br>
<br>Too bad AT&T violently disallows DD-WRT on the router. :(<br><br>Well, back on the phone with AT&T for another 2 hours of bliss...<br><br>Matt<br><br><div class="gmail_quote">On Thu, Aug 1, 2013 at 9:22 PM, Scott Packard <span dir="ltr"><<a href="mailto:spackard@gmail.com" target="_blank">spackard@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="im"><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Aug 1, 2013 at 7:53 PM, Matthew Campbell <span dir="ltr"><<a href="mailto:dvdmatt@gmail.com" target="_blank">dvdmatt@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div style="overflow:hidden">> Any chance AT&T blocks incoming port 22<br>Scott, good ideas there. I can confirm that AT&T is not blocking the SSH port as my router's firewall log is showing the incoming packets and admitting to dropping them. See the log excerpt at the bottom of the initial email in this chain:<br>
<table><tbody><tr><td>INF</td>
<td>2013-07-26T20:15:42-07:00</td>
<td>fw</td>
<td>src=162.200.153.165 dst=172.28.1.2 ipprot=6 sport=40058 dport=22 Session Matches User Pinhole, Packet Passed</td>
</tr>
<tr>
<td>INF</td>
<td>2013-07-26T20:15:42-07:00</td>
<td>fw</td>
<td>src=162.200.153.165 dst=172.28.1.2 ipprot=6 sport=40058 dport=22 Drop traffic to <a href="http://172.16.0.0/12" target="_blank">172.16.0.0/12</a></td></tr></tbody></table><br>This shows that the packets are getting through to the 3801, that it is recognizing that I have defined a pinhole rule to pass port 22 traffic on to 172.28.1.2 and that it is dropping all traffic to the entire 172.16/12 subnet from the second packet on.</div>
</blockquote></div><br><br></div></div><div class="gmail_extra">I don't own one of these, so take what I say with a grain of salt.<br></div><div class="gmail_extra">Maybe there's another setting that needs to be relaxed to allow the traffic through.<br>
</div><div class="gmail_extra">I had a DSL modem that wouldn't allow traffic through until I went to another configuration page and relaxed the "security" via a bulk setting. (The application being blocked was outbound IMAP, I think; Outlook connecting to a popular public mail server. Was helping out a Windows consultant.)<br>
</div><div class="gmail_extra">Your trace gives me the feeling it passes one rule and is blocked by another.<br><br></div><div class="gmail_extra">I assume you've Googled for the answer already (can see you did). Someone posts that even configuring it to be very close to a bridge it still will likely block incoming port 22.<br>
<a href="http://forums.att.com/t5/forums/forumtopicprintpage/board-id/gateway/message-id/182/print-single-message/true/page/1" target="_blank">http://forums.att.com/t5/forums/forumtopicprintpage/board-id/gateway/message-id/182/print-single-message/true/page/1</a><br>
<br></div><div class="gmail_extra">Another person says his was working, then stopped, and his fix was his internal IP was statically assigned on the server but within the modem's DHCP range. He fixed it by going static IPs only.<br>
<a href="http://www.dslreports.com/forum/r25531146-2WIRE-Port-Forward-Problem" target="_blank">http://www.dslreports.com/forum/r25531146-2WIRE-Port-Forward-Problem</a><br></div><div class="gmail_extra">In the thread someone says you can use either DMZPlus or open ports, but not both.<br>
<br></div><div class="gmail_extra">Regards, Scott<br></div></div>
</blockquote></div><br>