V3 Suresignal IP addresses and ports to allow on firewall

[wigwammer]

Hi,

We have successfully installed a Suresignal V3 on our network. However at the moment the firewall is allowing all ports from all IP addresses. We did try the device with the recommended settings from this document

https://www.vodafone.co.uk/cs/groups/public/documents/webcontent/vftst061123.pdf

But this did not work. While the device was attempting to register with these settings we could also see it trying to communicate with the following IP addresses on port 4500.

88.82.13.174

88.82.13.171

We would like to configure the firewall to include only ports and ip addresses that are absolutely necessary for the suresignal. So my question: Is there an updated version of the above document to allow proper configuation of the firewall.

Regards

[Rahim]

@ChalgroveBlue Vodafone Sure Signal devices are designed to work directly with routers via the supplied ethernet cable. 

Please can you take a look at our Sure Signal Troubleshooting thread, and then post back your results if you’re not directed to an existing thread?

[ChalgroveBlue]

Hi Rahim, thanks for replying.

I know these devices are designed to use directly with a router, however our router is set up in bridge mode and all static IPs are used by the router anyway, so if it's possible, we'd love to get it working from behind the firewall. We managed to get our O2 (sorry) Boost Box working, so I was hoping we could repeat that (somewhat unexpected) success with the Sure Signal.

I've had a look at the troubleshooting tips on that page and my exact problem is not listed. It suggested that I post these results (below) if my problem wasn;t listed, so here goes....

The issue you’re experiencing: Sure Signal can't access the Vodafone system (that's what the booklet that came in the box says the lights mean). 

What light sequence you're seeing:From left to right:

Power light: flashing red

Internet light: not lit

Service light: steady amber

In Use light: steady amber

Your speed test results from here.

18.50 Mbps down

20.54 Mbps up

Your external IP address from here.

185.15.205.58

Your Sure Signal serial number:

42153660784

The results of a traceroute:

C:\>tracert 212.183.133.177

Tracing route to 212.183.133.177 over a maximum of 30 hops

1 <1 ms <1 ms <1 ms 192.168.209.1
2 1 ms <1 ms <1 ms 185.15.205.57
3 26 ms 25 ms 25 ms 185.15.205.174
4 3 ms 3 ms 3 ms 185.15.204.2
5 11 ms 3 ms 3 ms 80.77.2.213
6 5 ms 5 ms 3 ms xe-4-1-0.0.cji01.ldn004.flagtel.com [62.216.129.146]
7 4 ms 3 ms 4 ms ae0-1802-xcr1.lsw.cw.net [195.66.224.182]
8 3 ms 3 ms 3 ms ae22-xcr1.lns.cw.net [195.2.30.61]
9 * * * Request timed out.
10 * * * Request timed out.
11 * * * Request timed out.
12 * * * Request timed out.
13 * * * Request timed out.
14 * * * Request timed out.
15 * * * Request timed out.
16 * * * Request timed out.
17 * * * Request timed out.
18 * * * Request timed out.
19 * * * Request timed out.
20 * * * Request timed out.
21 * * * Request timed out.
22 * * * Request timed out.
23 * * * Request timed out.
24 * * * Request timed out.
25 * * * Request timed out.
26 * * * Request timed out.
27 * * * Request timed out.
28 * * * Request timed out.
29 * * * Request timed out.
30 * * * Request timed out.

Trace complete.

Does that give you enough information to help us further?

Regards

John

[Rahim]

@ChalgroveBlue Our Vodafone Sure Signal isn't designed to work over a bridge connection unfortunately, therefore we're unable to suggest a resolution to your issue. 

If you're able to connect the device directly to your router, then you'll be able to get it working. 

However, we appreciate this may not be possible. 

[ChalgroveBlue]

@Rahim Thanks for your help, I do appreciate that the device is designed (and marketed) to be plugged directly into a router and that setting it up behind a firewall is non-standard - so thanks for your time helping me out.

I was hoping though, that as @JaKubWz @wigwammer and @mhumphrey managed it I might be able to do so too, but as much as I hate to say it, I guess it's not to be.

Unless anyone else out there has any ideas, I guess I'll have to tell the boss we need a separate ADSL line for the VSS, or that we should migrate to O2 and use the Boost Box, as that's working lovely.

Thanks again Rahim.

[Retired-EricChe]

@ChalgroveBlue

Apologies that your Sure Signal still isn't working. As Rahim advised, we're unable to advise on bridge connections.

[ChalgroveBlue]

OK, thanks for your help anyway

John

[aditya1011]

Could you please help us with Sure Signal. We have recently moved to Virgin Media Business Broadband and since the router has been changed to Hitron-CGNV4, the Sure Signal isnt working. We have asked Virgin media and they said we need to obtain port forwarding details from Vodafone. 

I have done Tracing as you mentioned, please see the details below.

Tracing route to 212.183.133.177 over a maximum of 30 hops

  1     2 ms     2 ms     6 ms  Hitronhub.home [192.168.0.1]
  2     *        *        *     Request timed out.
  3   267 ms   178 ms    28 ms  perr-core-2a-ae16-0.network.virginmedia.net [62.253.138.245]
  4     *        *        *     Request timed out.
  5     *        *        *     Request timed out.
  6     *        *        *     Request timed out.
  7     *        *        *     Request timed out.
  8    23 ms    35 ms    32 ms  nrth-ic-1-ae1-0.network.virginmedia.net [62.254.42.218]
  9    22 ms    22 ms    59 ms  m674-mp2.cvx1-b.lis.dial.ntli.net [62.254.42.162]
10     *        *        *     Request timed out.
11    30 ms    22 ms    24 ms  uk-lon03a-ri1-ae2-0.aorta.net [84.116.135.46]
12    24 ms    23 ms    26 ms  213.46.174.130
13    25 ms    28 ms    31 ms  ae32-xcr1.lns.cw.net [195.2.24.126]
14     *        *        *     Request timed out.
15     *        *        *     Request timed out.
16     *        *        *     Request timed out.
17     *        *        *     Request timed out.
18     *        *        *     Request timed out.
19     *        *        *     Request timed out.
20     *        *        *     Request timed out.
21     *        *        *     Request timed out.
22     *        *        *     Request timed out.
23     *        *        *     Request timed out.
24     *        *        *     Request timed out.
25     *        *        *     Request timed out.
26     *        *        *     Request timed out.
27     *        *        *     Request timed out.
28     *        *        *     Request timed out.
29     *        *        *     Request timed out.
30     *        *        *     Request timed out.

Trace complete.

Any help/information to resolve this issue will be much appreciated.

Thanks.

[Tash]

Hi @aditya1011, thanks for providing us with these details.

To allow port-forwarding, please use our list of ports and IP addresses. If you need further assistance with setting this up, please provide these details to your Internet Service Provider (ISP).

[jgbreezer]

FIXED!

Making the following change to firewall rules after applying the official ones linked to here fixes mine and other people's SureSignal v3's (1 earlier in this thread).

I followed the official guides linked to in this post and elsewhere, but they are INCOMPLETE as of now (or just out of date?)! I don't know if Vodafone have updated them since and the links are out of date, but a previous poster found out via inspection that the SureSignal v3 ALSO needs access to this IP range too (scroll up, but repeating here for people who don't read them). Then the LEDs should indicate its all working; this is the ONLY thing that was stopping mine from working, and it worked immediately after I did the change:

ADD firewall rules to allow OUTBOUND (only) connections from your SureSignal, TO IP range:

88.82.13.171 - 88.82.13.180 on PORT 4500

I had limited space in my router for more firewall rules so I just added the single range using 88.82.13.168/27

which should cover it even if they add a few more IPs to give extra capacity in near future, or the range above (from inspection) is not quite the full range. I believe the risk of that cover-a-slightly-wider-range choice going bad from privacy/security view is very low indeed.

BTW Now I have a 4G-capable phone, with not great 4G signal but excellent 3G signal from SureSignal, that causes issues where my phone will prefer newer tech 4G to older 3G even though 3G has a way better signal. Only workaround is disallow 4G while at home by changing phone settings, then re-enable it when I leave home if I want faster data when out and in a good 4G area (am in a well-connected city, so thats most places). Rather Annoying, and not automated it using Tasker very well yet (due to permissions needed to change the network type it'll use).     My provider sent a SIM update when I complained about it that didn't help one bit.

[JohnJ]

@jgbreezer Thanks for letting us know 

If you need any further help in the future, we're always here to help you