Problem that the web UI of the Digi Transport router can't be accessible if both end Digi router firewall were enabled?

Digi TransPort WR (Series)
1

FW ver. 5.2.14.5.

2

Hi

if you have enabled the firewall with default firewall there is not a rule to allow http

you would have to add your own rule

regards

James

3

Hi James,

Thank you for the reply. I already tried to add the firewall scripts for port 80 (http) but the problem is still the same. I tried this below:

pass out break end on ppp 1 from any to any port=http flags S!A inspect-state
or
pass out break end on tun 1 from any to any port=http
or
pass out break end on eth 0 from any to any port=http

The computer of where it is connected to this Digi network that has firewall enabled still can’t access the web UI of other device outside this network that uses the same Digi Transport WR44v2 router too (FW ver.5.2.14.5).

Accessing the web UI of other network that uses Cisco router have no problem.

The firewall status have no hits in the block script so i don’t know of where it was stuck up once it tries to open the web UI of the device from other Digi network. So the problem was constraint only within Digi to Digi network on port 80.

It looks like a bug for me when it deals with other Digi once the firewall is enabled.

4

So that rule will allow traffic out of the local lan through the firewall out of the network onto the internet.

the default rules on the other router will not allow traffic in on port 80

you would have to add a rule like this if you know the ip youwill come from x.x.x.x

pass in break end on ppp 1 from x.x.x.x to any port=http flags S!A inspect-state

5

Hi James, thank you for the reply. I tried the one you suggested but no success. Is it ok if you can try this in your lab if that one works or not?

Our setup as follows: the 2 Digi WR44v2 router are connected via VPN (IPSec over GRE - the IP static routing is via GRE tunnel). The Digi on IKE-Main-mode have no firewall enabled so no problem here accessing the web UI of other network device. The Digi on IKE-Aggressive-mode have Firewall enabled because we implemented the Dual SIM weighting and this network have problem to open the web UI of other network device.