topic Re: Three Home Broadband blocks incoming connections in Broadband

Three Home Broadband blocks incoming connections

Ihuss — Fri, 11 Apr 2025 11:04:32 GMT

Does anyone know why Three blocks incoming connections on their 5G Home Broadband network and how I can circumvent this?

I need to be able to remotely access devices such as NAS, Media server, DVR/NVR, VPN, etc hosted on my home network which was I was able to easily do before with previous ISPs (like Virgin Media, Sky, BT). I have the 5G Outdoor Hub set as IP Passthrough/Modem mode but the traffic is not even reaching my internal firewall router and Three Technical Support said they can't help as it's not supported to port forward and I can cancel my contract within the 30 day cooling off period.

Re: Three Home Broadband blocks incoming connections

PeteG — Sat, 12 Apr 2025 09:09:26 GMT

Hey there.

Incoming connections shouldn't be blocked. It's likely you're having the issue due to the IP address changing or something like that. You should be able to resolve the issue by running a DDNS service. Also, you will need to make sure that you're using the 3internet APN on your Hub, as that's the only one that'll give you a dedicated IP address without using CGNAT.

Pete.

Re: Three Home Broadband blocks incoming connections

Ihuss — Sat, 12 Apr 2025 22:31:41 GMT

Hey Pete

Thanks for getting back to me.

The IP changing is not the issue as I had dynamic IPs with other ISPs like sky, bt yet never had the issue I’m now having with Three home broadband. Beside I use a DDNS service anyway to connect. I am also using 3internet APN since the 5G outdoor hub comes preconfigured with it.

Any attempts to connect to my home network resources that sit behind the 5G outdoor hub fail within a matter of seconds as if the connection is being dropped before it hits my firewall and also port scans show all ports as being closed despite being opened on my firewall.

is there anything I can try to be absolute sure that the Three network/5G outdoor hub is not dropping the incoming connections?

is there anyone else in this community that is having the same problem as me?

please assist further.

Re: Three Home Broadband blocks incoming connections

PeteG — Sun, 13 Apr 2025 08:44:04 GMT

I don't have a hub for testing at the moment, sadly - are you able to check the admin page to see if there's an option in there to open/forward certain ports?

Pete

Re: Three Home Broadband blocks incoming connections

Ihuss — Sun, 13 Apr 2025 23:41:29 GMT

Hi Pete

Yes there is a port forward option available only when the hub is running in routing mode however whatever rule you put in there still no incoming traffic gets through. The port forward option is greyed out when the hub is set to IP pass through/modem mode which is understandable since then you'd expect all traffic to traverse unfiltered (similar to other hubs from other ISPs). So regardless of whether the hub is set to routing or IP Passthrough the incoming traffic is still being blocked/dropped.

Is there an anyone else here that has managed to get incoming traffic reaching their internal network unhindered?

Re: Three Home Broadband blocks incoming connections

Anonymous — Fri, 18 Apr 2025 08:43:19 GMT

Just wanted to chime in here to say I'm having the same issue. I've googled this and found similar posts from Three customers so I've tried various suggestions and nothing so far works.

Hub APN is set to 3Internet. I was being given a public IP so not behind CGNAT. Even set the hub network settings to IP only rather than IP and IPv6 as it is by default.

Port is forwarded correctly in router and I also use DDNS. I know this setup works fine and has no issues because I used it previously with my last ISP and their router (Sky). The only difference now is I'm with Three and use their equipment and it no longer works. So whatever the problem is my conclusion is it's either the hub (which seems unlikely as it's set by default to IP Passthru mode so shouldn't be blocking anything and just passing it to the router) or Three are in fact doing something on there end - even if they're not actively blocking ports they're doing something that has that effect.

Only thing I have seen suggested that I haven't tried is to contact customer support and ask them to set the account to an IPv4 profile (or something to that effect).

Re: Three Home Broadband blocks incoming connections

Ihuss — Fri, 18 Apr 2025 16:35:33 GMT

Hi Xandros

If you manage to get this working your side then please do share the solution here.

I couldn't get any help whatsoever from customer/technical support since they just read from a script and they simply say reset the hub.

Re: Three Home Broadband blocks incoming connections

Anonymous — Sat, 19 Apr 2025 11:44:42 GMT

I have solved the issue (at least for me). Took me all morning but I suddenly realised I had an expert to help me: ChatGPT. Amazing what AI can do these days (even the free model works nicely). Hopefully you can take some pointers from this anyway Ihuss and fix it for yourself too.

The short answer is that it turns out I had a double NAT, so I was wrong in assuming it was Three's network. It was my own (of course it was).

Basically I had the 3 Hub connected to the WAN port of my router, which may largely be acceptable for basic use when it's in IP Passthrough (and it did) but it was creating a double NAT environment because I didn't realise that IP Passthrough isn't just another name for "modem only" mode. As such even though the 3 hub disables a lot of routing options when it's in IP Passthrough mode, it still acts as a router and does NAT which is not ideal if you also have a router in the network doing NAT, and above all else it seems to have the added downside to stopping port forwarding from working and will likely interfere with a lot of other things too.

In a nutshell to correct this I switched the 3 hub to routing mode. I then switched my router into Access Point mode (this disables a lot of it's features unfortunately but things like DHCP/Port forwarding/UPNP and the like can then be configured in the hub instead). And most importantly, I plugged the hub into one of the ethernet ports on the router and not it's WAN port as I had before. Then finally configured port forwarding in the hub instead.

After I power cycled everything I tested it and port forwarding now works.

I have no idea if this could apply to your situation of course Ihuss. If you're using your own router like I do or even the eeros router Three supply it may or may not support being switched into AP mode (it may refer to it as bridge mode too, though from what I understand Access Point mode and Bridge mode are actually slightly different to each other). In any case some pointers for you to try. Good luck.

Re: Three Home Broadband blocks incoming connections

Ihuss — Sat, 19 Apr 2025 22:52:45 GMT

Hi Xandros

I'm glad you got this sorted.

Unfortunately this solution doesn't work for me.. There is no double NAT taking place on my network. The Three 5G Outdoor hub is set to IP Passthrough/Modem mode and the WAN IP address successfully transverses across to the WAN interface on my firewall router (with no NAT). The incoming connections (from the internet, e.g. 443, UDP 500/4500, 22, etc) still do not reach my router firewall as they are being dropped by the Three network or their equipment.

I just hope for a solution soon other I may have to switch back to a home fibre connection.

Re: Three Home Broadband blocks incoming connections

Anonymous — Sat, 19 Apr 2025 23:33:15 GMT

Well as I said, I didn't think I had a double NAT either but I did. It was hiding in plain sight.

Anyway I'll try and help you but I need you to try something first and tell me some more details. Firstly load up a Windows 10 or 11 PC/Laptop on your network, open command prompt and type "tracert 8.8.8.8" (without the quotes), what is the result?

Secondly what other equipment have you got besides the 3 outdoor Hub that forms the backbone of your network? So in other words you have the 3 Hub, that's plugged into what make and model of router? And which port is it plugged into? And lastly are there any other access points or do all your other devices connect only to that router in one way or another?

Re: Three Home Broadband blocks incoming connections

Ihuss — Mon, 21 Apr 2025 21:42:35 GMT

Trace route as follows:

192.168.0.1 1ms (5G outdoor hub)
172.20.198.129 17ms
172.20.250.9 20ms
172.20.231.158 14ms
208.85.255.77 17ms
172.253.65.211 17ms
dns.google 18ms

5G hub > WAN interface on Meraki MX68W > DHCP clients

Clients typically connect via a wired connection or Wi-Fi to the MX68W

Re: Three Home Broadband blocks incoming connections

Anonymous — Tue, 22 Apr 2025 00:57:54 GMT

Well the trace route may not necessarily show an issues but, oof, that's quite the complicated router you've got there. If I'm brutally honest I don't think I'm going to be able to help you because of that. You'd probably have to talk to Cisco support or ask for help on their forums and see if anyone with knowledge of these kind of SD-WAN routers can help you configure it all properly to work, assuming you even can (I mean after all that's an enterprise level router you're trying to use with a consumer level device, and outward appearances suggests they appear to not be particular compatible). Good luck.

Re: Three Home Broadband blocks incoming connections

Ihuss — Tue, 22 Apr 2025 11:49:41 GMT

Thanks Xandros

I have all the knowledge to configure the router with any environment, it’s my job 😉

Compatibility with my router is also not an issue, it’s never been a problem with other ‘consumer level’ modem routers like those provided by Virgin, Sky, BT, Plusnet etc.

I’ve even tried the connection with a couple of less complicated routers and I have the same problem.

It appears to me that either the 5G outdoor hub provided by Three does not function properly as a modem or in ip passthrough mode or there’s something weird going on on their network where the connections are being dropped. Unless Three can sort this I will have to jump ship and go back to a proper ISP

Re: Three Home Broadband blocks incoming connections

Barnbow_Tech — Fri, 09 May 2025 00:02:51 GMT

Same problem for me as well. I have tried many different options but no traffic gets to the ports I have set for NAT/Forwarding on my internal router when the hub is in IP Passthrough mode. I've tried different APN settings, disabled the SPI firewall (enabled routing mode first to do this, then put back in passthrough mode), ticked all sorts of options but nada! I put my laptop direct in to the Hub in Passthrough mode running a web server and still nothing.

I did get the port forwarding to work to my laptop web server in routing mode, but I don't want this feature as I intend to run a firewall with multiple VLANs (which neither the Hub nor Eero support).

I will try calling Three Support, as I am a Business customer then I am hoping they may be a bit more clued up on NAT settings! Anyone found a solution in the meantime?

Re: Three Home Broadband blocks incoming connections

Barnbow_Tech — Fri, 09 May 2025 01:15:46 GMT

Just as an update, I took a look at the syslog for the Hub and can clearly see that iptables (firewall service) is running, even when the "SPI firewall" option is unticked and the device is in IP Passthrough mode. I am fairly convinced that this is a bug as the option should stop iptables running in this case.I'll see if Three Business Support have any info here.

Logs for info:
Line 3539: Fri May 9 01:02:04 2025 user.notice firewall: Reloading firewall due to ifup of wan (ccmni2)
Line 3649: Fri May 9 01:02:05 2025 user.notice firewall: Reloading firewall due to ifupdate of wan (ccmni2)
Line 3718: Fri May 9 01:02:06 2025 user.err : 10573:[src/firewall_server_ubus.cpp,FirewallNotifyEventHandler,235]wanType:DATA wanStatus:Connected
Line 3719: Fri May 9 01:02:06 2025 user.err : 10573:[src/firewall_server_ubus.cpp,FirewallNotifyEventHandler,255]wanIfName:ccmni2 wanIpAddr:92.40.73.41
Line 3724: Fri May 9 01:02:06 2025 authpriv.notice sudo: firewall : PWD=/ ; USER=root ; COMMAND=/usr/sbin/iptables -t filter -F FILTER_FORWARD_IP
Line 3729: Fri May 9 01:02:06 2025 authpriv.notice sudo: firewall : PWD=/ ; USER=root ; COMMAND=/usr/sbin/iptables -t mangle -F MANGLE_PREROUTING_MAC
Line 3734: Fri May 9 01:02:06 2025 authpriv.notice sudo: firewall : PWD=/ ; USER=root ; COMMAND=/usr/sbin/iptables -t filter -F FILTER_INPUT_PORT
Line 3737: Fri May 9 01:02:06 2025 authpriv.notice sudo: firewall : PWD=/ ; USER=root ; COMMAND=/usr/sbin/iptables -t filter -F FILTER_FORWARD_PORTF
Line 3739: Fri May 9 01:02:06 2025 authpriv.notice sudo: firewall : PWD=/ ; USER=root ; COMMAND=/usr/sbin/iptables -t nat -F NAT_PREROUTING_PORT
Line 3772: Fri May 9 01:02:06 2025 authpriv.notice sudo: firewall : PWD=/ ; USER=root ; COMMAND=/usr/sbin/iptables -t filter -F FILTER_FORWARD_PORTN
Line 3791: Fri May 9 01:02:06 2025 authpriv.notice sudo: firewall : PWD=/ ; USER=root ; COMMAND=/usr/sbin/iptables -t filter -F FILTER_FORWARD_DOMIN
Line 3800: Fri May 9 01:02:07 2025 authpriv.notice sudo: firewall : PWD=/ ; USER=root ; COMMAND=/usr/sbin/iptables -t filter -F FILTER_INPUT_PARENTAL
Line 3807: Fri May 9 01:02:07 2025 authpriv.notice sudo: firewall : PWD=/ ; USER=root ; COMMAND=/usr/sbin/iptables -t filter -F FILTER_FORWARD_PARENTAL
Line 3815: Fri May 9 01:02:07 2025 authpriv.notice sudo: firewall : PWD=/ ; USER=root ; COMMAND=/usr/sbin/ip6tables -t filter -F FILTER_INPUT_PARENTAL
Line 3817: Fri May 9 01:02:07 2025 authpriv.notice sudo: firewall : PWD=/ ; USER=root ; COMMAND=/usr/sbin/ip6tables -t filter -F FILTER_FORWARD_PARENTAL
Line 3818: Fri May 9 01:02:07 2025 authpriv.notice sudo: firewall : PWD=/ ; USER=root ; COMMAND=/etc/init.d/miniupnpd stop
Line 3825: Fri May 9 01:02:07 2025 authpriv.notice sudo: firewall : PWD=/ ; USER=root ; COMMAND=/usr/sbin/iptables -t filter -F FILTER_FORWARD_DMZ
Line 3828: Fri May 9 01:02:07 2025 authpriv.notice sudo: firewall : PWD=/ ; USER=root ; COMMAND=/usr/sbin/iptables -t nat -F NAT_PREROUTING_DMZ

Re: Three Home Broadband blocks incoming connections

Ihuss — Sat, 10 May 2025 23:34:21 GMT

Hi Barnbow_Tech

This is very interesting because if the firewall is still enabled despite the gui saying otherwise then this may be the root of the issue. Thanks for your efforts with this.

If you do get anywhere with Three support then please do post your findings here

Re: Three Home Broadband blocks incoming connections

Barnbow_Tech — Sun, 11 May 2025 08:16:00 GMT

Hi Ihuss,

Sadly I got nowhere with Three. I'm on a business contract where you would think more need and more support for features such as port forwarding but I was told my Customer Care that they can't support any extra configuration setup like that!

I didn't try actual technical support as I just thought that would be a dead end anyway! It may still be an option but at this stage my hub appears broken anyway so I have asked for a replacement, in the hope that another one works 🤞.

It appeared to stop getting a signal entirely and is displaying "on" on the display after customer care suggested I changed the APN to IPv6 mode only. I'd not tried that mode on its own (had used IP4v6 with no success) so I guess it was worth a shot, but most likely wouldn't work anyway seeing as the firewall service appears to be still running despite being off.

I will post again with an update on the replacement hub. Am hoping it comes with a slightly older firmware as I was on the latest one with the current hub (Three didn't really help when I asked about other firnware, but I am sure when I first got the hub it asked to update).

Re: Three Home Broadband blocks incoming connections

WM1990 — Wed, 14 May 2025 23:28:26 GMT

Just wanted to say I had the exact same problem as you, I tried changing the hub from IPV4v6 setting just to see what effect it might have on port forwarding, and just like that the device no longer connects to the Three network, even if I change the setting back or do a factory reset by holding a pin in the reset button. I'm just getting ON, neither the 5G or 4G lights illuminate and the eero displays a red light.

Totally mad that a user can effectively brick the device by changing an innocuous network setting.

Re: Three Home Broadband blocks incoming connections

Barnbow_Tech — Wed, 14 May 2025 23:42:05 GMT

Oh wow! Sorry to hear that. Definitely seems like some form of bug in the firmware in that case. Factory reset via the pin method did nothing for me either 😕.

Presumably you had the latest version? Mine was on 130.00100.113.024.

It would be good if we could get some form of support via Greenpacket themselves but I know that's not going to happen! I am instead now waiting on a replacement hub which I was told was arranged last Friday but on checking with them yesterday they hadn't even filled out a form for the return! Hopefully it is coming tomorrow.

I will then have about a week to test before cancelling my contract within the 30 day cool off period!

I'll try post an update as soon as I have any more info.

Did you contact support or arrange a replacement already WM1990?

Re: Three Home Broadband blocks incoming connections

WM1990 — Thu, 15 May 2025 17:48:21 GMT

Weirdly if I put the Three SIM card into my phone the 5G works fine. It's just the Outdoor Hub that is busted. So I am currently using my smartphone with the Three SIM as a wifi hotspot at home temporarily.

I called Three today, I opened with "you need to send me a new outdoor hub" due to the above reasons.

There followed two hours of mostly being on hold or waiting for a call back - and I listened to genius advice like "take the SIM card out and reinsert" or "try a factory reset," - which is something I suspect might actually contribute to the device failing - all the while I'm saying "you need to send me a new device".

This has resulted in the support guy "logging a ticket" and they will reply to me "within 7 days", all while I have no internet from the hub.

He also cannot give me a reference number for the ticket.

It might actually be worth it to start a new outdoor hub contract, use that device until this one is exchanged and then cancel the new one in the cooling off period.