Vigor 2860 - Been using for a few years, successfully using port forwarding to access a number of computers on my LAN for (S)HTTP, SSH, FTP...  'Suddenly' stopped working, that is ports no longer forwarded, and so couldn't access any of my stuff from the internet.  After much fiddling, I gave up and replaced the router with Vigor 2135ax with same port forwarding settings.  Worked fine.  For two months.  Rebooting fixed it.  For a week.  Then for a couple of hours.  I've both upgraded and downgraded the firmware - same situation.

Eventually I put my main server into DMZ, and used reversed proxies to handle HTTP traffic to other servers, and so I'm ok with most remote access needs, and SSH tunneling, but I shouldn't have to.  Port forwarding should just work.

Any ideas?  I don't think I made any other changes.  Computers are all Linux.  I have a couple of home-hosted websites, and need to access Zoneminder and Calibre remotely.  As I say, it seems ok with the server hosting those services in DMZ, but I shouldn't need to do that.  What's really weird is that rebooting seemed to fix things - for a short while.

 

Odd behaviour. Long shot but do you have any automation managing any of the config like the IP filter? I was about to say that perhaps your ISP has put you behind a CGNAT.....but if a reboot resolves the problem for a while and then it returns it won't be that.

If I were in your position, I'd install syslogd on a Linux box and turn up the logging on the Draytek and point it to syslogd...and reboot. Then wait for the port forwarding to stop working and review the logs raising a case with Support if necessary. 

Thanks very much for your advice. I shall try to make sense of the router logs. Unfortunately, port forwarding is simply not working at present, in spite of rebooting.
The problem appears to be above my pay grade, but I can try to learn.
Fortunately I am getting by ok with DMZ, reverse proxying and NoMachine. Still, it would be nice to have everything working as it once did.

Ah so the DMZ function works. That's telling. What is your Draytek plugged into? An ONT or something else?

It's an Adtran ONT - ISP is Community Fibre. I can access websites and web servers (Zoneminder, eg.) on my server in the DMZ - eg. goldstein88r.co.uk/massage. Using reverse proxies, I can also access (S/HTTP) other LAN servers, including my router, via, eg. goldstein88r.co.uk:nnnn.

Previously, I could do all that using port forwarding, and so could use Remmina to access various computers on my LAN via VNC and/or SSH - in addition to having access to, say, Zoneminder, when away from home. It was all so easy.

Following your suggestion, I've succeeded in setting up rsyslog on this Linux box and enabling logging from the router, but, so far, have not been able to see any sign of NATed traffic - but I'm still learning about the logging facility.

All a bit depressing, as everything was fine for years, and I didn't need to gain 'deep knowledge.'

Thanks again for your response.