Problem with Comcast Business Cable Modem/Gateway

[LdGrant]

I am having problems setting up a new Comcast business cable modem gateway and thought someone here might be able to help offer some insight.

First let me start of by saying that everything was setup and working fine, until about 2 weeks ago, I woke up and realized that my Comcast cable modem had been reset and was no longer working. I called Comcast and they confirmed that there was a firmware upgrade and it “did not work” and so they could not even log into the cable modem. So they came out to replace it.

We have 1 static IP address which is used to host our website, and with the previous cable modem it was pretty easy to setup and it was working fine for about 2 years.

For my setup I have it pretty simple:

Comcast Cable Modem
External IP: 173.160.46.xx
Static IP: 173.160.46.yy
Gateway IP Address: 10.1.10.1

Web Server with 2 NICs:
Internal IP Address: 10.1.10.181
External IP 173.160.46.yy (same as the static IP address above)

So far so go, and pretty simple. With the previous cable modem, to get everything working, I just powered on the cable modem, started up the web server, and everything worked fine. Web site traffic coming in on the 173.160.46.yy address went to the web server and all was fine.

Enter the new cable modem.

Initially, we had the same setup, and everything worked fine, but only for a limited time. After some time (no pattern found with how long things worked) but after a while the traffic to the web server would not go through. The web site appeared offline.

After scrambling, I reset the cable modem, and connection was restored. But only again for a limited time. I could not find any pattern or reason why the traffic would stop to the web server. It seemed as if the Comcast cable modem could not find the 173.160.46.yy static IP address of the web server.

I then tried setting up a 1-1 NAT telling the Cable modem to direct any 173.160.46.yy traffic to the internet NIC address of the webserver (10.1.10.181). This now creates a stable enough environment that we don’t drop traffic to the web server.

I’m still not sure of the reason for this, but I guess I have to live with it for now.

My problem/question now is for any computer on the internal LAN, if we try to get to our websites using a browser (ie: www.mycompany.com) we end up at the login prompt of the Comcast cable modem! (basically the same as going to 10.1.10.1). So to get around this now, I have to update the host file on each machine, so that the domain name is mapped to the internal address of the web server (10.10.181).

So my question is how can I setup the Comcast cable modem/router to route any internal traffic that is trying to get to the web server (at the static IP address of 173.160.46.yy over to the actual web server machine using the internet IP address 10.1.10.181?

When I called Comcast, and reviewed the situation, they said since I have the 1-1NAT setup, I can’t route internally now to my web server, and there is no way to setup a static route to it.

Any help would be appreciated,
Thanks
Larry

[YeOldeStonecat]

Get your own business grade router.....and set it up with the SMC so that your router obtains the public IP address on its WAN interface, and the SMC..you log into the web admin and disable its firewall. This way you get the proper functioning firewall features of a good business grade router (purchase one)...like a Cisco RV series.

[LdGrant]

Short of buying more hardware for what seems to be a comcast router problem is there no way to tell the comcast router to direct internal traffic also to the web server internal IP. To direct 173.160.46.yy traffic to the 10.1.10.181 NIC similar to what it is already doing for any outside traffic coming in?

I've been trying to keep the connection going without using the 1-1NAT, but it seems after about 5-10 minutes, the comcast router can't keep the connection. If I simply enabled 1-1NAT and then disable it again, I can get another 5-10 minutes of the connection working, so I know my NIC in the web server is working fine. So far it never seems to lose the connection with the 1-1NAT setting to the 10.1.10.181 NIC.

Get your own business grade router.....and set it up with the SMC so that your router obtains the public IP address on its WAN interface, and the SMC..you log into the web admin and disable its firewall. This way you get the proper functioning firewall features of a good business grade router (purchase one)...like a Cisco RV series.

[YeOldeStonecat]

Sounds like "loopback" issues on the newer model modem. Loopback is when an internal node (such as a workstation on your LAN) calls up another internal node (like your web server) using its public alias. So the traffic originates internally...goes out to the internet side..loops around and comes back into the LAN. Perhaps the newer Docsis 3 gateway they used to replaced your prior gateway has a bug in the particular version of firmware. But you're setting up of 1:1 NAT would be the correct setup..utilizing one of your additional static IP addresses from your block of 5 to assign to your web server.

Are you running active directory..and a domain controller? If so..could just edit the host record for your device there.

Although I have a few dozen of those SMC Gateways out in service at some clients...I don't have any of them running by themselves...I use my own routers on them and disable the firewall of the SMC (so my own routers obtain the pub IP on their WAN interface).

[LdGrant]

Sounds like "loopback" issues on the newer model modem. Loopback is when an internal node (such as a workstation on your LAN) calls up another internal node (like your web server) using its public alias. So the traffic originates internally...goes out to the internet side..loops around and comes back into the LAN. Perhaps the newer Docsis 3 gateway they used to replaced your prior gateway has a bug in the particular version of firmware. But you're setting up of 1:1 NAT would be the correct setup..utilizing one of your additional static IP addresses from your block of 5 to assign to your web server.

Are you running active directory..and a domain controller? If so..could just edit the host record for your device there.

Although I have a few dozen of those SMC Gateways out in service at some clients...I don't have any of them running by themselves...I use my own routers on them and disable the firewall of the SMC (so my own routers obtain the pub IP on their WAN interface).

I am not running a domain controller, but that is an option I did not think about.

Your loopback theory is interesting. The traffic does originate internally, not sure if it gets out to the internet and comes back in. If it comes back in, then I would expect it to work, since external traffic to the web server works just fine. It is as if any traffic that originates internally, is getting stopped by the comcast SMC Gateway, and then never getting past it, and defaults to the gateway login prompt.

I can edit the host file on any windows computer and have it point to the internal address (10.1.10.181) and those work fine, but I am not sure how to do the similar change for any mobile device (iPad, cell phone etc). And since we have upwards of 20 websites running on the web server, it means I need to have host entries for each, and if there are subdomains, also host entries for those.

I am looking into the option of getting a separate router, maybe that is my best bet at this point.

Thanks
Larry

[YeOldeStonecat]

Your loopback theory is interesting. The traffic does originate internally, not sure if it gets out to the internet and comes back in. If it comes back in, then I would expect it to work, since external traffic to the web server works just fine. It is as if any traffic that originates internally, is getting stopped by the comcast SMC Gateway, and then never getting past it, and defaults to the gateway login prompt.

That's exactly what loopback is....originates inside...tries to connect to an internal resource using the external address...and it comes back in. Routers that fail to perform proper loopback will not allow that to happen.

One other thing...the web admin interface, may have to go on a different port if it conflicts with the port of your website. Example...many routers may default to HTTPS for external web administration..and if you run a website on port 443 on a web server behind the router....port forwarding 443 won't work...it will try to connect to the routers web admin.