Skip to main content

  • Home

  • Getting Started

    • Offers

J
japh81
1st Topic
1st Reply
1st Like

Visitor

 • 

9 Messages

Tuesday, January 17th, 2023 8:51 PM

Closed

Can't connect to FTP or Remote Desktop

I'm a relatively new Xfinity customer and recently discovered that my FTP, remote desktop, SQL Server Management Studio, etc. connections I have for doing web work will just timeout when I try to connect. Web chat support and then a phone supervisor both told me that it's not possible to connect to a private IP using the Xfinity Gateway modem/router with a residential account; my options were either to upgrade to a business plan, or use my own third party modem.

I hooked up a new Netgear Nighthawk CM2000 in place of the Xfinity Gateway with my existing TP-LINK AC-3150 router, but I still get timeouts happening for these connections.

Anyone else experience this? Was I given bad guidance, or is there something else to change on my end?

In a tracert, this is the final successful hop before everything thereafter times out (same result before/after the modem switch):

14    26 ms    30 ms    23 ms  csrkld-gwa01-to70.roc.colospace.net [69.84.222.50]

Any insights/help would be greatly appreciated.

Thanks!

Question

 • 

Updated 

2 years ago

759

9

0

Was this helpful?

flatlander3

Problem Solver

 • 

1.5K Messages

2 years ago

Is this inbound traffic to your residential account that you are trying to setup?

Is the netgear set to bridge mode, or gateway mode?  Double nat with your TP-Link?

You know RDP and unprotected SQL and FTP servers exposed directly to the internet are a bad idea right?

0

0

japh81

Visitor

 • 

9 Messages

2 years ago

Outbound -- I'm trying to connect to a remote server and getting timeouts.

0

0

flatlander3

Problem Solver

 • 

1.5K Messages

2 years ago

OK, but do you have the netgear in bridge mode?  The difference between that and gateway mode, is that if are running a double nat -- netgear has an internal network the TP-Link connects to, then the TP-LINK runs yet another internal network -- then you may have some issues with things like UDP, higher port numbers and uPnP  traffic while connecting to remote services, and it's really going to be messed up if you are using the same subnet on both internal networks.

Hard to guess your network topology.

0

0

BruceW

Gold Problem Solver

 • 

26K Messages

2 years ago

... do you have the netgear in bridge mode? ...

The CM2000 is a straight cable modem, so it's always in bridge mode.

0

BruceW

Gold Problem Solver

 • 

26K Messages

2 years ago

... this is the final successful hop before everything thereafter times out ...

Please post the entire trace.

Please be aware that there are 2 kinds of responses in this Forum: Replies and Comments. When you Comment on a post by scrolling down to "Comment on this post here...", I am notified of your response. But if you select Reply, I am NOT notified and may not be aware of your response.

1

0

japh81

Visitor

 • 

9 Messages

@BruceW​ Here's the trace (redacted the target IP for privacy):

Tracing route to ... over a maximum of 30 hops

  1     1 ms     2 ms    <1 ms  192.168.0.1
  2    13 ms    19 ms    30 ms  100.92.34.3
  3    11 ms    11 ms    11 ms  68.87.151.21
  4    21 ms    18 ms    13 ms  68.87.146.29
  5    10 ms    10 ms    10 ms  162.151.148.21
  6     *        *        *     Request timed out.
  7    15 ms    12 ms    16 ms  162.151.52.34
  8    15 ms    15 ms    15 ms  be-1003-pe02.onesummer.ma.ibone.comcast.net [68.86.90.173]
  9    14 ms    15 ms    13 ms  50.208.232.122
 10    14 ms    15 ms    17 ms  ae-0.tvc-albany.bstnma07.us.bb.gin.ntt.net [131.103.116.226]
 11    18 ms    18 ms    17 ms  be21.mnchnhptcr1.ip.firstlight.net [66.152.98.33]
 12    20 ms    21 ms    19 ms  be32.ptmonh07er1.ip.firstlight.net [66.152.98.114]
 13    17 ms    18 ms    18 ms  66-152-97-114.static.firstlight.net [66.152.97.114]
 14    26 ms    30 ms    23 ms  csrkld-gwa01-to70.roc.colospace.net [69.84.222.50]
 15     *        *        *     Request timed out.
 16     *        *        *     Request timed out.
 17     *        *        *     Request timed out.
 18     *        *        *     Request timed out.
 19     *        *        *     Request timed out.
 20     *        *        *     Request timed out.
 21     *        *        *     Request timed out.
 22     *        *        *     Request timed out.
 23     *        *        *     Request timed out.
 24     *        *        *     Request timed out.
 25     *        *        *     Request timed out.
 26     *        *        *     Request timed out.
 27     *        *        *     Request timed out.
 28     *        *        *     Request timed out.
 29     *        *        *     Request timed out.
 30     *        *        *     Request timed out.

Trace complete.

2 years ago

0

flatlander3

Problem Solver

 • 

1.5K Messages

2 years ago

nmap can be a better utility, and it's free (nmap.org).  A lot of firewalls aren't going to allow ICMP due to flood ping hassle.  I don't.  You're trying to check a service, not an ICMP response.  What do you see on this for FTP. 

# nmap -Pn -p 21 [ip address/dns name]

Should say:

PORT   STATE  SERVICE
21/tcp open ftp

If you hook up Ethernet with something to the netgear and reboot the netgear, then try it again (direct from netgear to laptop/desktop).  You might have a local firewall issue as well.  Or anti-virus, or Windows Defender firewall public/private network issue -- if using windows.  On Windows, if it asks and spawns a pop-up, say public network when you hook up directly.  You are trying to narrow down the problem.

0

0

BruceW

Gold Problem Solver

 • 

26K Messages

2 years ago

... Tracing route to ... over a maximum of 30 hops ...

Thank you. I'm not sure if it's relevant to the problem, but you should be aware that the second hop is a "carrier-grade NAT" IP address. See https://whois.arin.net/rest/net/NET-100-64-0-0-1/pft?s=100.92.34.3 and https://en.wikipedia.org/wiki/Carrier-grade_NAT. It's something we began seeing Comcast use for the first time a few months ago.

Please be aware that there are 2 kinds of responses in this Forum: Replies and Comments. When you Comment on a post by scrolling down to "Comment on this post here...", I am notified of your response. But if you select Reply, I am NOT notified and may not be aware of your response.

0

0

japh81

Visitor

 • 

9 Messages

2 years ago

I will try connecting directly to the modem to see if that helps. The carrier-grade NAT seems like it could be an issue, but wouldn’t more customers have the same problem?

10

0

flatlander3

Problem Solver

 • 

1.5K Messages

@japh81​ Direct to modem is just testing interference with your TP-link, and see if something is different when you don't use it. nmap reports:

open -- service is there

closed -- firewall open, but service is stopped

filtered -- no response at all

open/filtered -- you 'may' have gotten through a firewall, but got nothing after that.  undetermined.

FTP is easy to pick on.  If you get filtered on both (tp-link and without), then you want to look at the OS you are trying to connect with.  Anti-virus/firewall/auto-vpn or proxy from anti-virus, etc.

(edited)

2 years ago

0

japh81

Visitor

 • 

9 Messages

@flatlander3​ Using nmap (through tp-link), I see: 

Host is up.

PORT   STATE    SERVICE
21/tcp filtered ftp

I'm on Windows 10 Pro, and I've already tried disabling the domain firewall, private firewall, and adding win-scp to the list of applications allowed through the firewall; no luck yet.

The kicker is that nothing has changed with my system between when it worked months ago to now, other than changing ISP to Comcast/Xfinity...

I'll still have to try bypassing the tp-link, I guess.

2 years ago

0

flatlander3

Problem Solver

 • 

1.5K Messages

@japh81​ There's a bunch of stuff that can get wrapped around the axle with windows, and it's not particularly helpful with logging.  Don't forget to disable windows defender advanced firewall and your anti-virus utility for a temporary test.  Those can be blocking it too.

2 years ago

0

user_6a795a

Visitor

 • 

1 Message

For what it's worth, DO NOT disable windows firewall and AV if you plan on plugging your computer directly into your modem.

In fact, I wouldn't do that period. 

2 years ago

0

flatlander3

Problem Solver

 • 

1.5K Messages

@user_6a795a​ I'm not talking about leaving it off forever, but if you are trying debug a firewall issue, it's not helpful.  Yeah. Windows is a pile.

An Ubuntu live cd is much more helpful for debugging stuff, but seeing that's what he was working with.......

2 years ago

japh81

Visitor

 • 

9 Messages

2 years ago

As it turns out... the host simply needed to rerun their firewall initialization scripts as something must have been corrupt. I can now connect as I did before.

Thanks all for your feedback and teaching me a few things along the way!

0

forum icon

New to the Community?

Start Here