Port forwarding on G1100 Router for Minecraft Server (bedrock)

[saranova]

I have a bedrock minecraft server running minecraft 1.19.51.01 on UDP port 19132 on my LAN at 192.168.1.182, which I'd like to make publicly accessible.

I've attempted to forward UDP port 19132 to 192.168.1.182:19132 on my Verizon G1100 router (details below), but when someone outside my LAN tries to connect (running bedrock 1.19.51.01, same as my server), they get this error: "Unable to Connect to World"

I can access the server via two devices (also running bedrock 1.19.51.01) on my LAN (the windows 10 machine running the server and a galaxy tablet), so I think that means the server is fine and the router is to blame (I've also tried disabling the minecraft server's firewall to no effect).

When I use nmap on the public IP, port 19132 shows up as "open|filtered":

$ sudo nmap -sU -p 19132 xxx.xxx.xxx.xxx

Starting Nmap 5.21 ( http://nmap.org ) at 2023-01-17 08:17 MST
Nmap scan report for xxx.xxx.xxx.xxx

Host is up (0.082s latency).
PORT STATE SERVICE
19132/udp open|filtered unknown

(where xxx.xxx.xxx.xxx is my router's public IP, hidden for privacy)

And when I do that, my minecraft server displays this message twice:

"ATTENTION! Received EMPTY UDP packet - potential UDP ports scanning."

There is no notification in the router's firewall log about blocked traffic. If I try a different port that I have never attempted to forward, I get the same message from nmap, but I don't get the response from the minecraft server:

$ sudo nmap -sU -p 19135 xxx.xxx.xxx.xxx

Starting Nmap 5.21 ( http://nmap.org ) at 2023-01-17 08:17 MST
Nmap scan report for xxx.xxx.xxx.xxx

Host is up (0.082s latency).
PORT STATE SERVICE
19135/udp open|filtered unknown

If I go to "canyouseeme.org" and scan the 19132 port, it says
"I could not see your service on xxx.xxx.xxx.xxx on port (19132). Reason: Connection timed out"

The minecraft server on 192.168.1.182 does not react when scanned via canyouseeme.org (maybe it's using TCP?). 

I have a G1100 Verizon router with firmware version 02.03.00.14. I've tried many variations of setting up a port forward, but the one I believe should be correct is:

1) Firewall -> Port Forwarding
2) Select 192.168.1.182 from "Select IP from menu"
3) Custom port in "Application to Forward", select UDP 19132

I've also set the IPv4 firewall settings to be "minimum security (low)" and unchecked "Advanced -> Universal Plug and Play -> UPnP Enabled" (the radio buttons to change the IPv6 settings were greyed out).

There are a couple threads on port forwarding with this router, but none come to a resolution:

https://community.verizon.com/t5/Home-Internet/I-can-t-forward-my-ports-and-it-s-driving-me-nuts-any...

https://community.verizon.com/t5/Home-Internet/Unable-to-set-up-port-forwarding-Verizon-G1100-Router...

Does anyone have any insight?

[Cang_Household]

I need to see your Port Forwarding configuration page on G1100.

Don't adjust the Firewall to Low. Whoever said that was incorrect. PF takes precedence over canned Firewall rules;

[saranova]

Thanks! Here you are:

I added a forward for TCP to see if it helped with nmap or canyouseeme.org, but it didn't. 

[Cang_Household]

Try the following, I still have a G1100 laying around, so I can show you the GUI. G1100 is not in a lab setup any more, so I couldn't actually test whether the PF works.

G1100 PF 19132

As a word of caution, G1100 may be EOL soon, so please upgrade to a G3100 or CR1000A/B if you would still like a Verizon router to help troubleshooting.

[saranova]

Thanks. That was a particular combination I hadn't tried before. Unfortunately, I get the same behavior as the previous setup.

It must be working at some level if the UDP port scan is noticed by the minecraft server. Perhaps I need to double check my remote partner's setup for typos.  But it's odd that canyouseeme.org, shieldsup, and nmap don't see it, even if I also forward TCP traffic.

Does EOL mean no more updates, or no more internet? Do I really need to spend $280 on a new router for a basic feature like port forwarding?

[Cang_Household · Accepted solution]

Could you really detect a UDP open port? Those port detection programs need to see a response in order to detect. UDP is stateless, so no handshake is required. At this point, I believe the problem lies on your inner host.

EOL means no more security updates. So when someone hacks your router, it is on you.

Port forwarding is not a "basic feature." Router routes between 2 networks and that's the complete qualification for a device to be called a router. Doing anything extra is added amnesties.

Nonetheless, PF should work on G1100. You don't need to upgrade unless you want.

[saranova]

nmap saw "open|filtered" (which was the same as other -- non-forwarded -- ports) but when scanning with UDP packets, the minecraft server replied that it saw an empty UDP packet. This was not the case without the port forward I set up. canyouseeme.org never saw anything.

The inner host (the computer running the minescraft server, right?) works with other computers inside the LAN. What failure modes remain?

[saranova]

I connected one of my LAN computers to a mobile hotspot to make it a WAN connection and it worked!

So I guess the problem was with the remote person's setup.

It's frustrating that things like https://canyouseeme.org/ are misleading.

Thank you!