Port Forwarding Issue

[vmastros]

I recently switched ISP's and went to Spectrum. I'm wanting to access my ISY remotely as I did with my previous ISP and it ain't happening. The ISY is setup to use port 443 via https. The new router is set up to forward the device to port 443. When I put in the IP address xx.xxx.xxx.xxx:443 in the Chrome address bar, it says it can't find it. My recollection is this is the way I did it with the old ISP and it worked fine. I did call Spectrum and they confirmed that indeed, my ISY is forwarded to port 443 external. I also reviewed the ISY network setting and it is forwarded to 443 as well. Firmware and UI are both ver 4.7.5. The Admin Console is asking if I want to update to ver 4.9 and I have not yet done that mostly because "if it ain't broke, don't fix".

Maybe unrelated, I have never been able to "enable internet access". I get  a message that it "failed". But that never bothered me having access over the internet previously.

Anyone have any ideas about how to fix this problem. I'd much appreciate it. Thanks.

[lilyoyo1]

Have you set up port forwarding in the new router

[larryllix]

Are you using the Chrome browser locally? If so you may need to use HTTP://.... (no 's', &  no port:443).  You may not be able to use the Basic security technique on a Chrome URL line (browsers will not allow it now) so it may never work.

Also, I am not sure a browser will actually do anything for you as it take admin console with java to access it properly. ISY may not substitute a full URL with https:/xxx.xxx.xxx.xxx:433 and you may have to type the whole URL, not just an IP address and port number.

Is your browser external to your router to access the port forwarding side?

Edited April 15, 2021 by larryllix

[DennisC]

Just to be be sure, for remote access you are using your WAN or DDNS address, not your ISY address?

[vmastros]

Yes Dennis, I’m using my WAN address. When I enter the address it takes me either to a spectrum, my spectrum login page or it says it can’t find the address. Also, I’ve tried using the UD mobile app with no success. It confirms I have a connection but I don’t know how to get to my devices after that.

[DennisC]

6 minutes ago, vmastros said:

Yes Dennis, I’m using my WAN address. When I enter the address it takes me either to a spectrum, my spectrum login page or it says it can’t find the address. Also, I’ve tried using the UD mobile app with no success. It confirms I have a connection but I don’t know how to get to my devices after that.

That's good. To continue the thought, when you port forward 443 to 443 you then used your ISY IP address as the device IP to forward to?

The next option for you might be a portal subscription. It is inexpensive and it takes port forwarding out of the process.

[Geddy]

@vmastros what is your brand of router? Or are you using a Spectrum supplied Modem/Router product? Sometimes it is difficult to manipulate the devices you rent from the ISP. Additionally, while Spectrum might "confirm" that it's forwarded to 443 they might actually be blocking inbound to their customers at common ports. Try a different port on the WAN side to try it that way. 

Do you have a UDI Portal subscription? If so then you can use the information from there for the ISY address and bypass port forwarding (sometimes seen as more secure because you're not leaving an open door on your local router).  From the Portal page go to Select Tools -> Information -> ISY Information the copy "Admin Console URL" and use that and use your portal login/pass rather than the local ISY direct connection admin/pass. 

 

But once you give us some more info about the router you're using perhaps there are some here that have experience with the same router to help correct forwarding rules. 

Good luck!

PS: And go ahead and update to 4.9. I am/was like you in that if it ain't broke don't fix it and was on 4.75 and made the upgrade to 4.8 and then 4.9 without any issues. It won't help your problem, but it will keep you up to date on the current 4.x branch so I would suggest doing at least those updates.

Edited April 15, 2021 by Geddy

[MrBill]

6 hours ago, vmastros said:

Yes Dennis, I’m using my WAN address. When I enter the address it takes me either to a spectrum, my spectrum login page or it says it can’t find the address. Also, I’ve tried using the UD mobile app with no success. It confirms I have a connection but I don’t know how to get to my devices after that.

are you trying to access the WAN address from inside or outside the network?   The part that I bolded makes me wonder if you inside using the WAN address.   If so your old router likely made use of 'hairpin turn' or 'hairpin NAT' allowing you to test from your local Lan using the external address and the new doesn't.  If so. try testing from a connection outside the LAN. 

Other trouble shooting thoughts. 1) Use a port scanner like ShieldsUp to make sure port 443 is open.   2) verify the local IP is of the ISY is the same that you forwarded to.  3) verify your WAN IP by asking google "what is my IP"  4) Be certain your external IP is route-able....  I haven't heard yet of a case where spectrum assigns non-routable addresses us GNAT or Carrier Grade NAT but more and more ISPs assign residential customer GNAT non-routable IPs (usually 10.x.y.z something) especially to new customers.

Edited April 15, 2021 by MrBill

[Geddy]

@vmastros Any luck getting things sorted out to be able to access the ISY while away from the site?

[vmastros]

No I haven’t had any luck. I’m pretty sure it’s a spectrum issue. And of course they say everything is fine. Fortunately remote access is not something I use very often, in fact hardly ever so I’m not greatly impacted. I am interested though in trying to get the universal devices android app to work but I haven’t put much effort into that either.

[MrBill]

16 minutes ago, vmastros said:

No I haven’t had any luck. I’m pretty sure it’s a spectrum issue. And of course they say everything is fine. Fortunately remote access is not something I use very often, in fact hardly ever so I’m not greatly impacted. I am interested though in trying to get the universal devices android app to work but I haven’t put much effort into that either.

A more secure solution than port forwarding (and more reliable) is to subscribe to the ISY portal... It works out to $1/month--paid intially at $23 for 2 years then renewable per 12 or 24 month.   Other benefits it allows interface with Alexa/Google Home and access to polyglot in the cloud.  While only a subset of nodeservers (36) are available in the cloud (as opposed to local).  As well as a bonus Occupancy portal nodeserver than can be used as a geofence, so the ISY can know who's home.

For Clarity: If you subscribe to the portal, no port forwarding is needed.

 

Is your Spectrum external IP route-able?   If it's in the range 100.64.0.0 to 100.127.255.255 then it's not.  (Also 10.x.y.z but most carriers use 100.x.y.z. for carrier grade NAT).  Here's an article that explains public vs private IP addresses.

[Geddy]

2 hours ago, vmastros said:

No I haven’t had any luck. I’m pretty sure it’s a spectrum issue. And of course they say everything is fine. Fortunately remote access is not something I use very often, in fact hardly ever so I’m not greatly impacted. I am interested though in trying to get the universal devices android app to work but I haven’t put much effort into that either.

@vmastros, I second @MrBill's comment about the ISY Portal. For $20 for 2 years it's a steal (~83 cents a month!) for what you get with it and removes the need to port forward for remote access. Plus looks like the new UDI mobile apps (iOS and Android) will need ISY Portal subscription (or at least work better with one). (I mentioned this option in my reply above.)

You still never let us know what brand/model router you're using. Or if you're using a Modem/Router combo that is supplied by Spectrum. Lots of people here have experience with a lot of different brands of routers so might be able to help troubleshoot your settings. @MrBill brought up a good point about the external IP being rout-able so that could be an issue as well.

Since you don't use remote access often then it might not a big issue, but still wanted to try to help get it to work for those few times you do need it. 

 

[vmastros]

I appreciate the dialogue and the help you all are offering to me. The modem is a charter communications EU2251 and the router is an SAC2V2S.  Thanks again.

[Michel Kohanim]

@Geddy,

Thanks so much for the kind words. Just to emphasize, UD Mobile does not need an ISY Portal subscription.

With kind regards,

Michel

[Geddy]

2 hours ago, vmastros said:

I appreciate the dialogue and the help you all are offering to me. The modem is a charter communications EU2251 and the router is an SAC2V2S.  Thanks again.

@vmastros, Thanks for the info. Looks like that's a fairly locked down router and one site I found says only able to set wifi password and port forwarding through a phone app. Are you able to log in through a web browser or is it true to only be phone controlled? If anything I'm guessing that if Spectrum is doing this to their customers then they are probably also blocking most common ports to try to "protect" the users since they seem to think customers are not tech savvy. My suggestion would be to get away from ISP supplied equipment and handle your own gear and setup. That is if you're able to handle it and you've got an ISY so you're already ahead of the curve for most people. 

Since the router is mostly locked down by the ISP your best bet is probably not to use port forwarding, but to go the ISY portal method. Steps found above or through wiki of how to access the ISY while remote with the ISY portal. 

Also, thanks @Michel Kohanim for clarifying that UD Mobile does NOT need the isy portal subscription. But, I'm sure it would be helpful for those that are unable to port forward due to hardware or ISP limits.

 

Good luck @vmastros!

 

[vmastros]

Geddy, you have some great suggestions. I think you’re right about spectrum locking down their equipment. Sounds a lot like Apple locking down their equipment. I just may get my own router/modem setup.