I can't Access Web Admin via WAN

I try to connect to webadmin from my cell phone's LTE connection to https://dynDNS.hostname:4444 ....then I am in shell then I write tcpdump -nei any port 4444

 then I don't show my cell phone's IP.

I think the request don't reach on my sophos UTM.

Is there other tcpdump to capture      to   cell phone's LTE IP ????

I try to connect to webadmin from my cell phone's LTE connection to https://dynDNS.hostname:4444 ....then I am in shell then I write tcpdump -nei any port 4444

 then I don't show my cell phone's IP.

I think the request don't reach on my sophos UTM.

Is there other tcpdump to capture      to   cell phone's LTE IP ????

your selected option is the one i would use too.

But tcpdump -nei any host xxx.yyy.zz.zz

or

tcpdump -nei any | grep xxx.yyy.zz.zz  is also an option

Thanks you for replying!

Dirk nothing show from cell phone's LTE connection.

The packest can't reach to hostname:4444.....Did you see my topology above? I attach a picture. router behind sophos UTM  forward all packets with iptables. Nonthing block sophos utm. (I think?)

The only thing that works is

1. ONLY https://dynDNS.hostname <--- without 4444 ONLY FROM LAN  show the user portal

2. SSL VPN with port udp 443 ONLY FROM LAN

Something block to reach packets to https://dynDNS.hostname:4444 from wan....

Dirk do you have any idea?

Please for anyone here. I have this problem with CG-NAT over 1 year. PLEASE if someone has bybass CG-NAT I would like to post it here to help me.....

Thank you!

Get a port scanner app on your phone. 

Disable intrusion detection entirely (or at least the port scanning protection).

Create a fw rule at the top to block everything from internet (ipv4/6), service any, destination wan ip. Something like this;

Open utm live log, then run it against your utm public ip. You should be seeing a bunch of hits. Maybe not on all scanned ports, but some/most. If you're not, try scanning specific ports such as 80, 443, 8000, 8080, 8443. These are commonly used for web traffic.  If you see this traffic then it could very well be that your cg-nat lte provider is blocking certain ports.  Surprisingly, att (the cgnat provider I use) has all ports open, even outbound 25 (SMTP).

Edit.  The same of course could be done with tcpdump, but perhaps the utm interface will be easier for you to use/understand.

Your example was illuminating. Jay port scanner show the truth. The only port that was open is port 22 for ssh. I have to say that I have a normal use p2p programs, torrent client and web sites 443 and 80 port. I don't understand why port scanner show only port  22.

Anyway as you see above in my network topology, I have a router (nanostation) that take internet via wifi then via ethernet send all traffic to raspberry that runs wireguard vpn as client  then send to vps that run wireguard server there....then back to raspberry with IP from vps....then send  all traffic via ethernet to utm. All traffic is forwarded with iptables. I cannot explain what is the problem.

I forgot to say that Live Log: Firewall not show something from outside wan when port scanner is working via cell phone's LTE connection

What is next step?

Thank you Jay...

You got too many layers involved.  Need to test each layer to see if traffic is getting passed. Based on your pic, UTM appears to be a far endpoint.

Confirm your vps is even passing such traffic.  Where is the vps?  I haven an aws ec2 instance. I can adjust what ports are allowed in. I would start there.

What do you mean layer? Do you mean devices behind utm? Like nanostation and raspberry? If yes ....How can I test port for those devices?

Jay are you tired to explain me? I used nmap to test ports on raspberry . I used iptables that forward all traffic to vps. then from raspbbery with second ethernet port internet goes to utm. I have internet normal from publi ip from vps.

I think only hostname can't  reach to sophos utm.

Do you have any idea how to check again my raspberry and ubiquiti ? In ubiquiti I tested with ping ....All results are ok.

If you have any idea, please post it here!!!

Thank you Jay