Trouble getting remote connection to DDC Controller

[buffaloxl]

Hi there everyone. 

The heating company recently installed a new controller, and we have been trying to get the remote connection from their software set up (enteliWEB).  The connection runs over UDP, port 47808.  He has it configured to reach out to our public IP (static) and I have it configured in the firewall to NAT on UDP to the IP of the controller on 47808.  I have attached pictures of the rules, as well as a rule that I tried to just let anything through just to see.  None of them worked. 

On his end, he gets a pseudo-connection where it says it has a UDP connection, but it does not lock in and he cannot see the controller. 

We connected the tech's laptop internally, and he was able to see the controller in his software, so the internal wiring and hardware seems to work.

I went to the connection live view and sorted by port 47808, and there was traffic coming in from the WAN, even a couple from his office's public IP, but nothing showed as rejected, it was all showing as getting passed through in both directions.  One thing of note, I was not seeing consistent traffic in from his office's public IP, so I suspected maybe my ISP was messing with it something somehow.  A long call with them was fruitless, I don't think they're blocking anything.

We set up a fake controller on a linux server with the same IP, and got someone off site to send packets to our public IP on port 47808, and the server was able to see the messages, so we were pretty sure our firewall rules were passing traffic.  Of note here, it was not consistent, there was a time where this just stopped working for no obvious reason.  But, at least some of the time, the firewall was passing traffic.

This morning, I turned on the attached rule to allow everything through to see, and that did nothing.

Both me, a more senior IT guy here, and the tech at the heating company are stumped at this point.  Any help would be appreciated.

[viragomann]

The heating company recently installed a new controller, and we have been trying to get the remote connection from their software set up (enteliWEB).  The connection runs over UDP, port 47808.  He has it configured to reach out to our public IP (static) and I have it configured in the firewall to NAT on UDP to the IP of the controller on 47808.  I have attached pictures of the rules, as well as a rule that I tried to just let anything through just to see.

So the controller uses a public IP inside your network?

Run a packet capture on the internal interface, which the controller is connected to and check if you see both, request and response, packets.

[buffaloxl]

Sorry, when I say public IP, I mean the one on the WAN side of my router.  The controller has a standard private IP inside our network.  I'll do the packet capture.

[viragomann]

Your rules are showing a public IP though.

[buffaloxl]

Ah, I see the confusion.  We own a /24 of the shown IP.  We use it as our internal IP range. 

[buffaloxl]

Packet capture from both the LAN and WAN side shows packets coming in and going out.  Seems like it should be working