Three Home Broadband blocks incoming connections

[Ihuss]

Does anyone know why Three blocks incoming connections on their 5G Home Broadband network and how I can circumvent this?

I need to be able to remotely access devices such as NAS, Media server, DVR/NVR, VPN, etc hosted on my home network which was I was able to easily do before with previous ISPs (like Virgin Media, Sky, BT). I have the 5G Outdoor Hub set as IP Passthrough/Modem mode but the traffic is not even reaching my internal firewall router and Three Technical Support said they can't help as it's not supported to port forward and I can cancel my contract within the 30 day cooling off period. 

[Anonymous]

Just wanted to chime in here to say I'm having the same issue. I've googled this and found similar posts from Three customers so I've tried various suggestions and nothing so far works.

Hub APN is set to 3Internet. I was being given a public IP so not behind CGNAT. Even set the hub network settings to IP only rather than IP and IPv6 as it is by default.

Port is forwarded correctly in router and I also use DDNS. I know this setup works fine and has no issues because I used it previously with my last ISP and their router (Sky). The only difference now is I'm with Three and use their equipment and it no longer works. So whatever the problem is my conclusion is it's either the hub (which seems unlikely as it's set by default to IP Passthru mode so shouldn't be blocking anything and just passing it to the router) or Three are in fact doing something on there end - even if they're not actively blocking ports they're doing something that has that effect.

Only thing I have seen suggested that I haven't tried is to contact customer support and ask them to set the account to an IPv4 profile (or something to that effect).

[Ihuss]

Hi Xandros

If you manage to get this working your side then please do share the solution here.

I couldn't get any help whatsoever from customer/technical support since they just read from a script and they simply say reset the hub.

[Anonymous]

I have solved the issue (at least for me). Took me all morning but I suddenly realised I had an expert to help me: ChatGPT. Amazing what AI can do these days (even the free model works nicely). Hopefully you can take some pointers from this anyway Ihuss and fix it for yourself too.

The short answer is that it turns out I had a double NAT, so I was wrong in assuming it was Three's network. It was my own (of course it was).

Basically I had the 3 Hub connected to the WAN port of my router, which may largely be acceptable for basic use when it's in IP Passthrough (and it did) but it was creating a double NAT environment because I didn't realise that IP Passthrough isn't just another name for "modem only" mode. As such even though the 3 hub disables a lot of routing options when it's in IP Passthrough mode, it still acts as a router and does NAT which is not ideal if you also have a router in the network doing NAT, and above all else it seems to have the added downside to stopping port forwarding from working and will likely interfere with a lot of other things too.

In a nutshell to correct this I switched the 3 hub to routing mode. I then switched my router into Access Point mode (this disables a lot of it's features unfortunately but things like DHCP/Port forwarding/UPNP and the like can then be configured in the hub instead). And most importantly, I plugged the hub into one of the ethernet ports on the router and not it's WAN port as I had before. Then finally configured port forwarding in the hub instead.

After I power cycled everything I tested it and port forwarding now works.

I have no idea if this could apply to your situation of course Ihuss. If you're using your own router like I do or even the eeros router Three supply it may or may not support being switched into AP mode (it may refer to it as bridge mode too, though from what I understand Access Point mode and Bridge mode are actually slightly different to each other). In any case some pointers for you to try. Good luck.

[Ihuss]

Hi Xandros

I'm glad you got this sorted.

Unfortunately this solution doesn't work for me.. There is no double NAT taking place on my network. The Three 5G Outdoor hub is set to IP Passthrough/Modem mode and the WAN IP address successfully transverses across to the WAN interface on my firewall router (with no NAT). The incoming connections (from the internet, e.g. 443, UDP 500/4500, 22, etc) still do not reach my router firewall as they are being dropped by the Three network or their equipment.

I just hope for a solution soon other I may have to switch back to a home fibre connection.

[Anonymous]

Well as I said, I didn't think I had a double NAT either but I did. It was hiding in plain sight.

Anyway I'll try and help you but I need you to try something first and tell me some more details. Firstly load up a Windows 10 or 11 PC/Laptop on your network, open command prompt and type "tracert 8.8.8.8" (without the quotes), what is the result?

Secondly what other equipment have you got besides the 3 outdoor Hub that forms the backbone of your network? So in other words you have the 3 Hub, that's plugged into what make and model of router? And which port is it plugged into? And lastly are there any other access points or do all your other devices connect only to that router in one way or another?

[Ihuss]

Trace route as follows:

1. 192.168.0.1 1ms (5G outdoor hub)
2. 172.20.198.129 17ms
3. 172.20.250.9 20ms
4. 172.20.231.158 14ms
5. 208.85.255.77 17ms
6. 172.253.65.211 17ms
   
7. dns.google 18ms

5G hub > WAN interface on Meraki MX68W > DHCP clients

Clients typically connect via a wired connection or Wi-Fi to the MX68W

[Anonymous]

Well the trace route may not necessarily show an issues but, oof, that's quite the complicated router you've got there. If I'm brutally honest I don't think I'm going to be able to help you because of that. You'd probably have to talk to Cisco support or ask for help on their forums and see if anyone with knowledge of these kind of SD-WAN routers can help you configure it all properly to work, assuming you even can (I mean after all that's an enterprise level router you're trying to use with a consumer level device, and outward appearances suggests they appear to not be particular compatible). Good luck.

[Ihuss]

Thanks Xandros

I have all the knowledge to configure the router with any environment, it’s my job 😉

Compatibility with my router is also not an issue, it’s never been a problem with other ‘consumer level’ modem routers like those provided by Virgin, Sky, BT, Plusnet etc. 

I’ve even tried the connection with a couple of less complicated routers and I have the same problem.

It appears to me that either the 5G outdoor hub provided by Three does not function properly as a modem or in ip passthrough mode or there’s something weird going on on their network where the connections are being dropped. Unless Three can sort this I will have to jump ship and go back to a proper ISP

[Ihuss]

Hey Pete

Thanks for getting back to me.

The IP changing is not the issue as I had dynamic IPs with other ISPs like sky, bt yet never had the issue I’m now having with Three home broadband. Beside I use a DDNS service anyway to connect. I am also using 3internet APN since the 5G outdoor hub comes preconfigured with it.

Any attempts to connect to my home network resources that sit behind the 5G outdoor hub fail within a matter of seconds as if the connection is being dropped before it hits my firewall and also port scans show all ports as being closed despite being opened on my firewall.

is there anything I can try to be absolute sure that the Three network/5G outdoor hub is not dropping the incoming connections?

is there anyone else in this community that is having the same problem as me?

please assist further.