Y5-210MU (Outdoor Hub) IP Passthrough (ala modem mode) firewall issues

[darkvader]

Hello, I have recently signed up for a broadband renewal the other day and was given an outdoor hub to go with it. Setup was essentially a direct swap. The speeds are excellent (550mbits down, 100Mbit up) and overall should work much better than the original unit I have been using (A zte mc888). However, there seems to be a bug in the greenpacket modem software. It is excessively filtering my connection to the internet, stopping me from using my at home VPN server (so I can connect to my pc when i'm out).

The new unit seems to work the same way as the old unit, both units use the same APN (3internet) and into the same port on the pfsense router.
I'm not using the Eero, It's not needed as the pfsense box does the same thing. I've also confirmed that the pfsense box is getting a public Ip addresses from the modem (either 92. or 188.), other parts in the chain work correctly and normal browsing is very good/excellent.

Where this gets interesting, even though nothing aside from the sim modem has changed, I now can't reach ports on that public IP address such as my VPN server in IP passthrough mode. The GRC shields up tool shows that the modem is sending port closed messages to the probe (failing the test) but my router never sees these tests. Comparitively the old modem would forward on everything to my pfsense box and the pfsense box would manage everything. (I can provide comparative screenshots and logs if needed, but should be easy to replicate)

Obviously the new modem is still doing some filtering or translation where it really shouldn't. I've seen other posts on the forum that seem to say similar things.

I have managed to work around this by using routing mode on the outdoor hub and setting up port forwarding to my pfsense box. It's not ideal as my pfsense box now isn't directly connected to the internet but VPN clients are now able to connect to the pfsense box.

I conclude that the IP Passthrough feature isn't working correctly and still silently filters connections before they reach a/my router. This is obviously a software bug and needs to be fixed. I'd also imagine that having 2 firewalls doing the same work is going to cause a whole host of issues and I wouldn't be surprised if this buggy greenpacket firewall makes it hard for game consoles to play multiplayer games correctly. This would also affect the Eero unit as well I imagine.

Is there an update to fix this issue? i'm on software 130.00100.113.024 currently.

Hopefully Three is able address the issue. These units are excellent; just a bit half baked I think. Hopefully there's an update soon that is able to fix this.

Cheers

D

[OldVic]

My Y5 210MU arrived yesterday and has a vastly improved signal from the ZTE. I can access the firewall section of the router but am unable to disable it to allow the connection of a network printer. Any ideas?

[MymsMan]

I am probably misunderstanding the problem but not sure why you need to change firewall settings to access a printer!

• If the printer is on your home network it should have a local address and be able to to connect to the eero router (you can give the eero the same network credentials as your older router to avoid the need to setup new network password details on the printer)
• If the printer is on an external network  then you should just be able to access it using its IP adress without router firewall changing
• If the printer is on your home network but you want to use it whilst away from home it is more complicated:
  Three don't offer a fixed IP-adress option and the Y5-210M is prone to frequent changes of WAN IP adresss plus it does not appear possible to connect to an opened IP port on the router.
  To overcome this I use Tailscale to allow external access to all of my local network without the need for opening ports.
   

[darkvader]

Sorry for the delay in replying

I suspect the reason you haven't had issues with those services are because they use a handshake system to aid in moving data around. In IP Phones there's something called 'STUN' that does something similar where it will use a process inside the network to punch a hole and ensure outside clients can maintain a connection. It's fairly standard but OpenVPN doesn't have that capability, or at least not directly via pfsense; hence why I have to use port forwarding on the Outdoor Hub. It's not been a problem before on my ZTE modem and i'm considering going back to it.

To that point, in IP-Passthrough mode, the Modem itself shouldn't do any filtering and allow the device (whether that be the Eero, Pfsense or whatever) to do that filtering instead. That's how the ZTE (and other devices) does it when in bridge mode.

When it comes to the issues that other people have, my understanding of the issue is that they're opening the ports on the Eero for services (say a game server or a VPN) and on paper those connections should be accessible to the internet but then the modem itself filters incoming connections as well, dropping incoming connections before it reaches the Eero to then be forwarded on. That's what seems to be happening with the Pfsense Box because it's not even logging that a connection has been attempted and then blocked... it's just not seeing the connection in the first place. Hopefully that makes sense.

[MymsMan]

I am using th standard Y5-210MU external hub and Eeero combination and I have been able to use both Nord Meshnet and Tailscale to access my home network from remote locations.

I did not need to make any changes to Hub or Eero setting to achieve this so I am not sure what is giving you problems.   

I have not needed to open any ports on the router - there are threads discusiing difficulty doing this with the hub