I'm trying to determine whether I've found a bug, an unsupported configuration, or if I'm simply missing a setting. I want to use 44net addresses on everything within my mesh.
Is this expected behavior (see below)?
Does AREDN intentionally prevent WAN → LAN forwarding when using LAN Type = 44Net, even though the LAN consists of globally routed 44Net addresses?
Or is there a supported way in the web UI to permit routed 44Net hosts behind the node to be directly reachable from the Internet?
I found another discussion describing similar behavior with 44Net LAN clients being locally reachable but inaccessible from elsewhere, so I'm wondering if this is a known limitation or bug.
Any guidance would be appreciated.
73,
VA3IAN
Topology
Internet
│
44Net Connect (WireGuard)
│
MikroTik hEX S
│
10.254.254.1/30
│
10.254.254.2/30
AREDN 4.26.7.0 (OpenWrt One)
│
LAN Type = 44Net
44.27.x.1/24
│
Windows PC
44.27.x.107/24
ARDC has routed my 44.27.x.0/24 to my WireGuard endpoint, and the MikroTik routes the entire /24 to the AREDN node over the /30 transit link. This follows the routed subnet model described by 44Net Connect.
AREDN configuration
- Version: 4.26.7.0
- Hardware: OpenWrt One
- LAN Type: 44Net
- LAN: 44.27.x.1/24
- WAN: Static 10.254.254.2/30
- Gateway: 10.254.254.1
Enabled:
- LAN to WAN
- LAN to Mesh WAN
- LAN to 44Net
- LAN default route
What works
- AREDN can ping 44.27.x.107
- The Windows PC can ping 44.27.x.1
- The AREDN web UI is reachable externally at 44.27.x.1
- Routing on the AREDN node looks correct:
ip route get 44.27.x.107 44.27.x.107 dev br-lan src 44.27.x.1
What doesn't work
From an external Internet host:
ping 44.27.x.107 Reply from 10.254.254.2: Destination port unreachable
nftables trace
I enabled nftrace and captured the packet path.
The packet arrives on br-wan, is routed toward br-lan, but is rejected in forward_wan:
forward ↓ forward_wan ↓ jump reject_to_wan ↓ handle_reject ↓ reject
The trace never reaches br-lan.
nft monitor trace
trace id f6bdf167 inet fw4 trace_chain packet: iif "br-wan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 111 ip id 17733 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 49
trace id f6bdf167 inet fw4 trace_chain rule ip saddr 70.x.75.116 ip daddr 44.27.x.107 meta nftrace set 1 (verdict continue)
trace id f6bdf167 inet fw4 trace_chain policy accept
trace id f6bdf167 inet fw4 raw_prerouting packet: iif "br-wan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 111 ip id 17733 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 49
trace id f6bdf167 inet fw4 raw_prerouting policy accept
trace id f6bdf167 inet fw4 mangle_prerouting packet: iif "br-wan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 111 ip id 17733 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 49
trace id f6bdf167 inet fw4 mangle_prerouting policy accept
trace id f6bdf167 inet fw4 dstnat packet: iif "br-wan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 111 ip id 17733 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 49
trace id f6bdf167 inet fw4 dstnat policy accept
trace id f6bdf167 inet fw4 prerouting packet: iif "br-wan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 111 ip id 17733 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 49
trace id f6bdf167 inet fw4 prerouting policy accept
trace id f6bdf167 inet fw4 mangle_forward packet: iif "br-wan" oif "br-lan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 110 ip id 17733 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 49
trace id f6bdf167 inet fw4 mangle_forward policy accept
trace id f6bdf167 inet fw4 forward packet: iif "br-wan" oif "br-lan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 110 ip id 17733 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 49
trace id f6bdf167 inet fw4 forward rule iifname "br-wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic" (verdict jump forward_wan)
trace id f6bdf167 inet fw4 forward_wan rule jump reject_to_wan (verdict jump reject_to_wan)
trace id f6bdf167 inet fw4 forward rule jump handle_reject (verdict jump handle_reject)
trace id f6bdf167 inet fw4 handle_reject rule reject comment "!fw4: Reject any other traffic" (verdict drop)
trace id 5d5d5918 inet fw4 trace_chain packet: iif "br-wan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 111 ip id 17734 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 50
trace id 5d5d5918 inet fw4 trace_chain rule ip saddr 70.x.75.116 ip daddr 44.27.x.107 meta nftrace set 1 (verdict continue)
trace id 5d5d5918 inet fw4 trace_chain policy accept
trace id 5d5d5918 inet fw4 raw_prerouting packet: iif "br-wan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 111 ip id 17734 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 50
trace id 5d5d5918 inet fw4 raw_prerouting policy accept
trace id 5d5d5918 inet fw4 mangle_prerouting packet: iif "br-wan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 111 ip id 17734 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 50
trace id 5d5d5918 inet fw4 mangle_prerouting policy accept
trace id 5d5d5918 inet fw4 dstnat packet: iif "br-wan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 111 ip id 17734 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 50
trace id 5d5d5918 inet fw4 dstnat policy accept
trace id 5d5d5918 inet fw4 prerouting packet: iif "br-wan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 111 ip id 17734 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 50
trace id 5d5d5918 inet fw4 prerouting policy accept
trace id 5d5d5918 inet fw4 mangle_forward packet: iif "br-wan" oif "br-lan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 110 ip id 17734 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 50
trace id 5d5d5918 inet fw4 mangle_forward policy accept
trace id 5d5d5918 inet fw4 forward packet: iif "br-wan" oif "br-lan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 110 ip id 17734 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 50
trace id 5d5d5918 inet fw4 forward rule iifname "br-wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic" (verdict jump forward_wan)
trace id 5d5d5918 inet fw4 forward_wan rule jump reject_to_wan (verdict jump reject_to_wan)
trace id 5d5d5918 inet fw4 forward rule jump handle_reject (verdict jump handle_reject)
trace id 5d5d5918 inet fw4 handle_reject rule reject comment "!fw4: Reject any other traffic" (verdict drop)
trace id 1744f0a0 inet fw4 trace_chain packet: iif "br-wan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 111 ip id 17735 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 51
trace id 1744f0a0 inet fw4 trace_chain rule ip saddr 70.x.75.116 ip daddr 44.27.x.107 meta nftrace set 1 (verdict continue)
trace id 1744f0a0 inet fw4 trace_chain policy accept
trace id 1744f0a0 inet fw4 raw_prerouting packet: iif "br-wan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 111 ip id 17735 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 51
trace id 1744f0a0 inet fw4 raw_prerouting policy accept
trace id 1744f0a0 inet fw4 mangle_prerouting packet: iif "br-wan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 111 ip id 17735 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 51
trace id 1744f0a0 inet fw4 mangle_prerouting policy accept
trace id 1744f0a0 inet fw4 dstnat packet: iif "br-wan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 111 ip id 17735 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 51
trace id 1744f0a0 inet fw4 dstnat policy accept
trace id 1744f0a0 inet fw4 prerouting packet: iif "br-wan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 111 ip id 17735 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 51
trace id 1744f0a0 inet fw4 prerouting policy accept
trace id 1744f0a0 inet fw4 mangle_forward packet: iif "br-wan" oif "br-lan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 110 ip id 17735 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 51
trace id 1744f0a0 inet fw4 mangle_forward policy accept
trace id 1744f0a0 inet fw4 forward packet: iif "br-wan" oif "br-lan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 110 ip id 17735 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 51
trace id 1744f0a0 inet fw4 forward rule iifname "br-wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic" (verdict jump forward_wan)
trace id 1744f0a0 inet fw4 forward_wan rule jump reject_to_wan (verdict jump reject_to_wan)
trace id 1744f0a0 inet fw4 forward rule jump handle_reject (verdict jump handle_reject)
trace id 1744f0a0 inet fw4 handle_reject rule reject comment "!fw4: Reject any other traffic" (verdict drop)
trace id bfb25ae5 inet fw4 trace_chain packet: iif "br-wan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 111 ip id 17736 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 52
trace id bfb25ae5 inet fw4 trace_chain rule ip saddr 70.x.75.116 ip daddr 44.27.x.107 meta nftrace set 1 (verdict continue)
trace id bfb25ae5 inet fw4 trace_chain policy accept
trace id bfb25ae5 inet fw4 raw_prerouting packet: iif "br-wan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 111 ip id 17736 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 52
trace id bfb25ae5 inet fw4 raw_prerouting policy accept
trace id bfb25ae5 inet fw4 mangle_prerouting packet: iif "br-wan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 111 ip id 17736 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 52
trace id bfb25ae5 inet fw4 mangle_prerouting policy accept
trace id bfb25ae5 inet fw4 dstnat packet: iif "br-wan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 111 ip id 17736 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 52
trace id bfb25ae5 inet fw4 dstnat policy accept
trace id bfb25ae5 inet fw4 prerouting packet: iif "br-wan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 111 ip id 17736 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 52
trace id bfb25ae5 inet fw4 prerouting policy accept
trace id bfb25ae5 inet fw4 mangle_forward packet: iif "br-wan" oif "br-lan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 110 ip id 17736 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 52
trace id bfb25ae5 inet fw4 mangle_forward policy accept
trace id bfb25ae5 inet fw4 forward packet: iif "br-wan" oif "br-lan" ether saddr 78:9a:18:1c:22:04 ether daddr 02:c5:f9:2b:67:b2 ip saddr 70.x.75.116 ip daddr 44.27.x.107 ip dscp cs0 ip ecn not-ect ip ttl 110 ip id 17736 ip protocol icmp ip length 60 icmp type echo-request icmp code 0 icmp id 1 icmp sequence 52
trace id bfb25ae5 inet fw4 forward rule iifname "br-wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic" (verdict jump forward_wan)
trace id bfb25ae5 inet fw4 forward_wan rule jump reject_to_wan (verdict jump reject_to_wan)
trace id bfb25ae5 inet fw4 forward rule jump handle_reject (verdict jump handle_reject)
trace id bfb25ae5 inet fw4 handle_reject rule reject comment "!fw4: Reject any other traffic" (verdict drop)