No access via WAN

This has been raised before, and I would prefer not to raise this issue again, but I seem to overlook something here.

Firstly, access to the Wiser via LAN works perfectly, both with the PC or the Android app, wireless or via CAT5.
However, no success from the WAN side. So let me outline what I have:

Software: Piced 4.12.0, Toolkit 1.12.5, Android app 1.0.5.

Wiser runs as LAN device behind an ASUS router. Wiser is on static IP outside the router DHCP pool. Wiser DHCP server is disabled.
Wiser IP, CNI IP and router IP are all on 192.168.1.xxx, same subnet mask.
Wiser is the white version where the CNI and Wiser are actually separated.

There are a few things which I find to be not quite up to scratch, but can't really think that any are very serious:

Can't switch off remote access on Wiser WEB UI under admin. It simply returns activated after reboot.
However, thankfully I can change remote access port away from 8080.
Can't update firmware. Neither via Piced, nor on web interface.
In Web UI, Admin, Status, firmware is shown as 1.30.0 (May 23 2013)
while in Web UI, Admin, WISER, firmware is shown as WISER15_1.29.61
Same applies to firmware transfer via Piced, whereby it reports 1.29.61 and wants to update to 1.30 every time you connect for a project transfer.
I have tried this with two new Wisers, same result. It must be noted though that the firmware update goes through the motions quite correctly, but the firmware update simply doesn't take.
I am wondering if it is a firmware identification issue.

Piced:
In Project / Wiser / Access, if I tick Enable Project Update, it comes up with an old Dlinkddns address. I cannot delete this or alter it.
This made me think that this could be the issue which prevents me from getting remote access.
But I tried the project with or without the Enable Project Update box ticked. No difference.
Also, starting with a blank new project, the old dlinkddns does not come up, but no change to access.

When you create a new Wiser project and you add the first area, you get an exception error.

When trying to connect from internet (WAN) via Wiser, I get to "authenticating XML socket" then "error authenticating: Gateway Timeout". Password is not the issue, as I can log on from WiFi.

Port forwarding is done per manual (8080, 8336, 8337, 8888, 8889, 14000) and activated.
I have verified that these ports are open as far as my ISP is concerned, and that is all fine. I have done this by setting my routers' remote management port to those ports, one by one, and I can log onto my router from the WAN side with any of them.
There is no difference if I use the WAN IP shown by my router, or the DYNDNS address.
It works for router maintenance but not to get to the Wiser.

Lastly, I have gone through the same trouble with the first version of Wiser (black), and on two different Dlink routers. I bought the ASUS one primarily because I suspected that the Dlink routers, which were cheap models, don't handle the port forwarding correctly.
However, now I can exclude this as well, and am battling to think of anything else I can do.

Does anyone have some suggestions as to what I am missing?

 

Hi Thomas,

Just read your post but as I'm about to go out for the day (hey, its the weekend and sunny!!!) here's a few quick ideas that you've probably already checked.

1. You mention port forwarding 'by the book' yet also claim to have changed the Wiser port away from 8080. I am sure you realise, but just checking you did also change the port forward to the new port?

2. Check that on the first page of router config, it does have the default gateway set to point at router's 192.168.1.x outbound port?

3. check 'Allow Access to Wiser LAN Ports' is ticked and the same correct IP address, default gateway address is also entered into PICED Project Options --> WISER --> LAN section.

Brad

 

Hi Brad,

Thank you for your reply, especially when it's a nice weekend over there!

In answer to your point 1, the port which I changed away from 8080 is the Administration / Management section of the Wiser Router. This is something which I do not want to use in any case, and is similar to the management section of my ASUS router. It can be switched on and off, and does not influence the general functionality of the router.
That, as far as I understand it. However, just to be sure, I changed it back to 8080, and the result is unfortunately still the same.

Your point 2 is not clear to me. I assume that you refer to Piced / Project / LAN, where I would point to the ASUS router IP. That is done, but I can not find a place where I would point to an outbound port. Did you perhaps mean IP?

Your point 3 is clear and has been done.

While we are at it, I also changed the CNI IP for the gateway to point to the ASUS router IP, then to the Wiser IP. Interestingly, that seems to make no difference, and I would assume that it would in any case influence functionality in general, but as mentioned, has no effect on anything.

 

Hi Thomas,

Sorry, re-read that again and you're right, it was confusing.

Point 1 was just checking that your port forward was changed to the new port you are using externally. For example, if on your iPhone you have the Wiser WAN IP address set as Your.Ext.IP.Address:19123 where 19123 is the port, your router should have a port forward from that external port 19123 to internal port 80 @ 192.168.1.x where x is your Wiser's IP address, not the CNI IP address.

I added point 2 as I was walking out the door and just moved the old point 2 to point 3, hence they were out of order sorry.

Point 2 and 3 both related to the PICED config. Point 2 (was talking about the Ethernet port - not IP port) is that the default gateway needs to be the IP address of internal Ethernet port of your external router (I assume is probably 192.168.1.1??), usually on the first page of the router's config.

These are the setting for the PICED Project Options --> WISER --> LAN section.

Also the 'Allow Access to Wiser LAN Ports' is ticked. That was about it. Just checking that you are using all LAN ports (and not the WAN/Internet port) to connect to the CNI and outbound router.

Can you get to the external router's external [noparse]IP addressort from a PC?[/noparse] (as opposed to an iDevice) ie is the Flash interface working but not the native iPad/Andoid app? Even from an iPad Safari browser (if your testing using a 3G connection), it should pop up an authentication username/password box, it just won't run past that as it needs Flash.

Brad

 

Thank you Brad,

It seems then that all is set up good so far. I am in the habbit of plugging the WAN port on the Wiser with one of the rubber bungs which come with the C-Bus kit. That way I am not tempted to plug anything in there.

On the phone app there are two ports which can be defined:
One is an HTTP port, set to 8080
The other is the Wiser XML port, which is set to 8888.

This would agree with the port forwarding which I have set up on the Asus router.

As regards access via PC onto the Web interface, no, I get absolutely nothing.

With the phone (I use an Android), also not much. I say not much, because of the following:
I am getting to "authenticating XML socket" Then a time-out.
I assume that this means that I at least reach Wiser, which I assume is handling the XML socket authentication.
If so, I assume that nothing comes back from Wiser.
Further, I assume that traffic from the phone goes in at port 8888, and Wiser uses 8889 for replies. If so, it would point to a problem whereby Wiser doesn't reply. If so, the question would be why
But I am guessing.....

 

Hi Thomas,

Hopefully, some help........

Just checking your ports again I did notice you are using the old 14000 port for your Wiser CNI.

You should find your CNI2 is now at the default port of 10001. This would only effect running Toolkit remotely though and so won't help your problem, as I'm pretty certain the Android app doesn't use the Wiser CNI directly.


I need to preface my ongoing response by the context that I have not programmed one of the white units yet as I have not received my back orders yet. We are told on the forum here that the white unit is identical to the old black Wiser from a programming perspective, so this is what I would do if it was a black unit.

Many people 'hack away' at the config until it works and then don't touch it without understanding why it was or wasn't working initially.

IMHO there are several working ways to configure the Wiser and make it work (which is why there are so many threads about it on here) and here are two ways I have used successfully for a STATIC EXTERNAL IP address config only. Refer to Roosta's good oil in the the 'Pearls of Wisdom' for his DynDNS config.

Others may say 'that is wrong' and I am happy to be the recipient of further details about exactly how it is supposed to work as the developers on here have that information but I don't. This is just what I have found works for me onsite. Both these ways are loosely based on the 'Config B' scenario in the manual.

1. The 'Remote' management port access method -

IMHO, this is best for external routers that can only do MATCHED PORT FORWARDING (same external to internal ports) but can't do DIS-SIMILAR PORT FORWARDING (external port X can map to internal port Y).

and

You mentioned that you had turned off the Remote Management in the Wiser router section and also reset the port to something different. This port is the port referred to in your first point, so if you turn it off, it won't be there to accept your inbound call. Often routing related issues manifest as an 'Authentication Failed' message where it is actually that the ports aren't forwarded correctly.

If you want to use port 8080 or anything else for Wiser GUI remote access, for instance 19123 as in my earlier example, remote management in the Wiser router config area (use [noparse]http://wisers.lan.ip.address/AdminManage.htm[/noparse] to go there quickly) must be on, allow access (initially at least) from all IP addresses and must be set to the 'HTTP port' you are using from your phone, or from the PC remote GUI interface, so it would look like [noparse]http://your.external.ip.address:portnumber[/noparse] in the WAN IP address / HTTP Port setting in the phone, or on the PCs URL line.

I note IMHO port 8080 is a bad choice as most external routers also use it and sometimes forwarding that port to an internal address doesn't work as expected due to the router's internal processes for its own management port. IMHO choose something else.

If you are using this other port, for example 19123, you need to port forward it through your external router.

This entails port forwarding : External Port:19123 Internal Port:19123 TCP to 192.168.x.y

where x.y is your Wiser's IP address in both PICED under WISER in project details, and also set as STATIC in the first page of the Wiser's router configuration section.(use [noparse]http://wisers.lan.ip.address/SetupDHCP.htm[/noparse] to go there quickly)

This is in addition to the following standard port forwards required being:

8336, 8337, only required for remote Toolkit/PICED programming of your network
8888, 8889, Phone GUI interface control
10001 (used to be 14000) for Wiser CNI access through the Wiser

Now for the REALLY INTERESTING bit. After you have done this, the Wiser has been rebooted and now shows a happy remote admin port of 19123 or whatever as being enabled. The external router may have needed to be rebooted to update the port forward (some routers).

On an iPhone, for some reason I can't fathom, you seem to need to initially attach to the Wiser ON THE LOCAL LAN first (ie the WIFI) with the WAN IP address set as [noparse]http://your.external.ip.address:portnumber[/noparse] and the LAN IP address set as [noparse]http://wisers.LAN.ip.address:80[/noparse] then it will thenceforth work from the WAN side (3G). If you just plug from the WAN side first, chances are it will fail authentication.

Thomas, It may be the same issue you are seeing from your Android phone.

2. The remote LAN port access method -

This works for external routers that can do DIS-SIMILAR PORT MAPPING / FORWARDING (external port X can map to internal port Y).

This entails port forwarding/mapping : External Port:19123 Internal Port:80 TCP to 192.168.x.y

once again where x.y is your Wiser's IP address in both PICED under WISER in project details, and also set as STATIC in the first page of the Wiser's router configuration section.

In this case Thomas, you can have the Remote Management in the Wiser set to off, as this comms is just using the standard access port 80. The phone settings are the same as method 1.

This is again in addition to the following standard port forwards required being:
8336, 8337, only required for remote Toolkit/PICED programming of your network
8888, 8889, Phone GUI interface control
10001 (used to be 14000) for Wiser CNI access through the Wiser

In this case, the external router is merely forwarding external port 19123 (or whatever) to port 80 (Normal LAN address) Wiser access interface to the Wiser client, and so it basically works like you are directly on the LAN side.


The two methods above (that work for me) also rely on the PICED config being correct as detailed in my earlier post in this thread, with the 'Allow Access to Wiser LAN Ports' ticked and the same correct IP address and correct default gateway address entered into PICED Project Options --> WISER --> LAN section.


Another possible issue in your case is the firmware. It needs to properly match the version of phone client app that you are running to work properly. It will generally always work OK from a PC Flash GUI/browser, so testing from the internet side using a PC is a good start. If you can get it working on a PC, it makes getting the phone config right a lot easier from a diagnostics viewpoint.

Sorry, this has been like 'War and Peace' but I hope it is thorough enough to get you up and running.


Regards,

Brad

 

Hi Brad,

Thank you for your extensive post. I will go through it all in detail today, and then provide feedback how it went.

Thank you for clarifying where port 14000 came from. I have to admit that I found it strange, but since I hardy use remote Toolkit, it hasn't really been an issue.

The rest will follow later

 

Big Thank You!

Hey Brad,

I am going to do this in stages, mainly because the first thing I tried worked.

I know that my router is allowing for dis-similar port mapping, as I tried this for another app. So I set up port 8555 external to map to port 80 internal to the Wiser IP.
Then I set the HTTP port on the android app on 8555 as well, and it worked.

I'll now go onto the PC access side (from WAN), and try the first method you mentioned, but with less haste.

Thank you for this, I really appreciate it. If you ever come to this side of the world, I'll buy you a couple of beers.

 

Hi Thomas,

Glad to hear it worked. The trouble with the Wiser config is, as I suggested, there are many ways you can use to make it work, but the instructions are only about 90% right and many of the posts on the forum take you down one method or another, not all ways being compatible. I will try to get time to encapsulate all this after you test the second method too and stick it once and for all into 'Pearls of Wisdom' so hopefully it can save everyone some time next time.

I saw from your online hours you were out of Australia, so where are you from? Hopefully it is somewhere I visit some time and I will hold you to those few beers. but really do appreciate you getting back with if Option 1 worked for you also.

Thanks,

Brad

 

Hi Brad,

I am half way through what I want to do, and will post the results here. I think it is a good thing if you put it all together in good English and stick it up there.

I am in South Africa, so we have a bit of a time difference. If you do come here, you'll find that your currency will get you a long way....

 

Results

Hi Brad,

Here are the results of what I have done. For completeness sake, I also repeat the initial positive result.

Basis:
IP setup in Piced must match the actual setup, i.e. Gateway IP must be main router IP.
Wiser IP should be fixed outside the DHCP pool, and must be set accordingly in Piced.
CNI IP must be set to match the Wiser (and main router) IP range. CNI port must be set the same in Piced as in the CNI itself, and must match the port forwarding in the main router.

Port forwarding in the main router must match the IP addresses and ports as set and / or specified in the documentation, with the exception of Toolkit Access port, which must be 10001 default, or whatever you set up within the CNI (and filtered down through the system).

For the white Wiser at least, there is another exception in that it appears that port 8080 does not work, and should be changed to port 80 (internal). If you want to use 8080 to 80, you must ensure that 8080 is not in use by the main router. Any other port will work, depending on your ISP port blocking habits, i.e. 5555 to 80 or whatever you like instead of 5555.
Therefore the HTTP port in the Wiser app needs to be changed to 80.


My testing was done as follows:

For app access I changed ECHO1 routing to:
external port 8555, internal port 80. Point to Wiser IP.
Result: Works.

To test what happens, I did:
Delete port forwarding of port 8888 in main router.
Result: app stops with message: ?connecting to port 8888?.

Re-instate port forwarding 8888 and delete port forwarding 8889 in main router.
Result: App works! ?????
Maybe you can try and replicate this..

Access with PC via Web:
With all port forwarding set correctly as above, enter external IP (as indicated by main router) or Dyndns address and port used to get to port 80 on Wiser, I.e: myhome.dyndns:8555.
Result: Works.

I didn't go and delete any port forwarding rules to test behavior. Maybe another day when I am bored.


Remote management port in Wiser and matched port forwarding:

Firstly, to clarify, the remote management port cannot be turned off in Wiser. But you can change it.

Firstly, I set Wiser's remote management port back to 8080, and changed port forwarding in main router to 8080 to 8080 to Wiser IP.
Result: ?error authenticating: Gateway Time out?.

Then I set port forwarding in main router to 8080 (ext) to 80 (int) to Wiser IP, to see if my main router had an issue with 8080.
Result: Works.

Next I set the Wiser remote management port to 8070 and the port forwarding in the main router to 8080 (ext) to 8070 (int) to Wiser IP so see if the Wiser doesn't want to use 8080.
Result: ?error authenticating: Gateway Time out?.

From that I conclude that Wiser's remote management port does not work at all.
Maybe you can replicate that when you get your white wiser.

Lastly, just for completeness sake I checked remote Toolkit access, using the correct ports (10001) and that works fine as well.


Well, that's it. Once again, Brad, many thanks to you for helping me to get rid of this head-ache, which has bugged me for a long time, and prevented me from recommending this product with confidence.

Have a great week!
Thomas

 

Hi Thomas,

Hopefully I have caught you before you have stripped it all out.

Can you please try port 8070 again, but after first having the Android app set right for both the internal and external IP addresses and then accessing the LAN via WIFI, then after that works, try externally again.

So have

LAN IP address set as http://Wiser.LAN.IP.Address:80 and
WAN IP address set as http://External.Router.IP.Address:8070

Also, can you try it with 8070 external and 8070 internal to Wiser and 8070 in phone?

Brad

 

Hi Brad,

No problem. I have done the setup 8070 to 8070, set the HTTP port in the app, and do not get through.

If I point the internal port to 80, then I can use any external port which I like, and it works.

Further, with the android app, it works without having to first make a connection on the LAN.

I would be interested to know if port 8080 works on the black wiser. I don't have one here, and don't want to mess about on one of my clients'.

I hope this answers your question correctly. If not, please let me know.

Cheers
Thomas

 

Hi Thomas,

Thanks for testing that for me. I will go back into my black lab unit and try port 8080 for you to let you know and report back.

Will also retest the remote management port method again, but it worked for iPhone remote access this morning without problem before I did my post today back to you. My Lab unit is accessed through an external Netgear Router and Netgear Cable Modem/Router in passthru mode.

I need to retest the bizarre 'authentication fail' symptom on iPhone before a local access as I suggest it is not a very plausible sounding symptom, but it did it again this morning during my testing. I installed a black Wiser week before last and the identical thing happened onsite (which had a D-Link router). I had also seen it do this in some other sites previously so added it to my commissioning tasklist.

Glad you're working though.

All the best,

Brad

 

Hi Brad,

If you get a chance, can you check if you get a connection without forwarding port 8889?
If so, it would be interesting to find out why this port is supposed to be forwarded.

 

Hi Thomas,

Will do on the port 8889.

Just giving you (and anyone watching) some feedback.

Once again, scenario is a Black Wiser. Firmware Version Kona_1.29.0

Method of access: Remote Management port in Wiser and matched port forwarding

Port Used: 8080 (default) also tried others such as 19112,19118 etc

Comments: Worked fine remotely via 3G from both iPhone 4S (IOS 6.1.3 - Optus3G) and iPad 2 (IOS 6.1.3-Telstra3G) using app Wiser GUI 1.3.0 and Wiser HD GUI 1.1.0

though it again exhibited the 'First Time Remote Authentication Fail without initial LAN access' symptom when attempting first time connection remotely through 3G, (with the port forward added to the router and the 'remote administration' address properly set) it failed authentication, 3 full times/attempts in a row.

I went straight to enable WIFI. Wiser GUI loaded immediately. All tests OK. Shut Down GUI and ended the APP force-ably. Then went straight into settings, turned off WIFI.

Ran Wiser GU again, no config changes. It asked about 3G OK, and then opened immediately into Wiser GUI. All tests AOK.

All the best,

Brad

 

Thomas, page 40 of the Wiser manual ( http://updates.clipsal.com/clipsalonline/Files/Brochures/W0001133.pdf ) says:
---
8888
&
8889
Ports 8888 to 8889 are used for the
command interface between your web
application or projector application and
Wiser Home Controller. If these ports
are not open or are being blocked by
your internet service provider then
control from the User interface will not
be possible.
---
If I'm not mistaken port 8889 is used for email events, 8888 for C-Bus.

 

I'm not sure I've understood above. Are you saying there's a configuration scenario where the Adobe Flash UI is working but the Wiser HD and iPhone app is not working? By "enable WiFi in above, are you referring to the Basic Wireless Settings->Enabled/Disabled dialog? As far as I know, that shouldn't affect whether or not you have remote access.

As for the remote management port, if you disable remote access using Tools->Remote Access->Projector Control Enabled, then this will override any setting that is made using the non-Adobe Flash configuration-only UI (ie: Administration tab->Remote Access->Enabled/Disabled). Similarly, a PICED project with projector control enabled/disabled setting will override what is set using the configuration-only UI. I think Clipsal should have removed that dialog since it leads to confusion given that it gets overridden.

 

you might want to have a read through this

http://www.cbusforums.com/forums/showthread.php?t=7390

I will help explain a few things

 

Hi Thomas,
The concept of "remote management port" is a little confusing in deed, actually it's based on the view of wiser itself, as you know, wiser is also a router, it has 4 LAN i/f and 1 WAN i/f; to the management port, the default port number is 80 when access through LAN i/f, the default port number is 8080 when access through WAN i/f and this port is called "remote management port".
Service on port 80 is always in position, however for port 8080, it will only be in position when WAN i/f has a valid IP address (IP got by PPPoE or connect WAN i/f of wiser to an external router ).
When wiser connect to an extermal router, normally there is two options:
(a) connect one LAN i/f of wiser to LAN i/f of external router
In this case, wiser actually works as a simple switch of the 4 LAN i/f, no IP address will be assigned to WAN i/f of wiser, so the service on port 8080 will not be available, the manage service will only be provided on port 80. and the IP address to be port mapped to on external router is the one of LAN bridge (not ip address of WAN i/f) of wiser.
I guess your setup is this case, if so your testing result is as expected.

(b) connect WAN i/f of wiser to LAN i/f of external router
In this case, wiser works as a router, WAN i/f will be assgined an IP address from external router(or set a static IP adress) and the manage service on port 8080 will be available, and you can do a port mapping on external router to access port 8080 of wiser, and the IP address to be port mapped to on external router is the ip address of WAN i/f of wiser.
In this case the manage service on port 80 is still available but it can only be access from LAN i/f (includs wifi of wiser) of wiser.

And for the version number you mentioned, it is a normal status.
"In Web UI, Admin, Status, firmware is shown as 1.30.0 (May 23 2013)
while in Web UI, Admin, WISER, firmware is shown as WISER15_1.29.61
"
The version number in Web UI->Admin->Status is the version of whole system.
The version number in Web UI->Admin->WISE is the version of wiser application part.

Hope above helps.

BR,
Xulong Wang