ZTE MF286 LTE Router - remote access not working?

[howardb]

Hi all; firstly, I now very little about remote connections, etc, to please be gentle and dumb it down for me
Recently got a ZTE MF286 LTE router as a bundle deal with my Standard Bank mobile. Installed it at a remote location and everything seems to work fine with the default settings - only thing I changed was the control panel password.

The problem I'm now having is that this router is at a remote location, so it's impractical to keep driving there if I need to reboot it, change settings, etc - so I'm looking at any solution to access this router remotely. One reason is that I want to add some smart bulbs to the property lights, as well as a few wifi cameras in the coming weeks that I can view as needed, but no matter what setting/s I use, I cannot seem to access the router via WAN.

Searched a bit and most articles talk to opening a port, etc, and I've followed their guide, but still no joy. Maybe there's a setting I'm missing; or maybe the router just cannot be accesses remotely?

I've had a DynDNS account for years, not used it much, but setup a web hosting for this router using the current WAN IP, which is say: 41.100.41.41 (example only)
Created a hostname called say: hometest.mine.nu
Cannot seem to get these to link at all, probably missed something...

On the router advanced settings, in the port forwarding option, I get the below settings to input, but not sure which IP address needs to be put there - is it the 41.100.41.41 or the router local IP 192.168.0.1 ?
Port can be anything, so not an issue - tried the default 8080 for remote connection, but not connecting.
Virtual Server Settings are enabled.

My other router at a different location is a TP-Link through a fiber connection, and that works fine accessing remotely without having to change anything - input the hostname set up in DynDNS and I can connect on default 8080 no problem - unsure why I need to do something different with the ZTE?

Any guidance is welcome

 

[PhireSide]

What ISP are you using?

AFAIK, some mobile providers restrict remote (WAN) access unless you request an unrestricted APN from them - Telkom and Vodacom were two that I know if that do it on some contract and prepaid offerings.

Worth a check.

 

[howardb]

What ISP are you using?

AFAIK, some mobile providers restrict remote (WAN) access unless you request an unrestricted APN from them - Telkom and Vodacom were two that I know if that do it on some contract and prepaid offerings.

Worth a check.

Thanks.
As far as I can see, it's an MTN SIM card on a Standard Bank LTE offering with a Standard Bank APN. Will give them a call tomorrow and check.

 

[PhireSide]

I've had a proper read through your post, and if it isn't blocked on the ISP side, you might be able to get it to work.

In the screenshot provided, you'd need to put the router internal IP and forward the port that you want, 8080 in your case. A lot of mobile ISP's use CGNAT which means network traversal into that router could be blocked, unless you apply for it (good luck getting through to someone who will escalate your query though).

Two major issues:
1) this is very insecure, as you are effectively opening the router up to the world and you will surely get attacked from all angles.
2) without a client to keep your dynamic DNS updated, you would lose connectivity to it once your IP address changes which can happen frequently, especially with mobile connectivity. The router may have DynDNS capabilities though.

My suggestion would be to get a cheap Raspberry Pi Zero that you can link up to the router using WiFi. Give it a static IP address, and then install Wireguard on it. You would then need to open Wireguard's ports on the router (use the Pi's IP and WG's port, which is port 51820 UDP IIRC). You can also install a Dynamic DNS update on the Pi to keep it updated with the correct IP address. Then you should just be able to activate the Wireguard VPN and control the stuff that you need controlled from onsite. If the router is smart enough and can do hairpin NAT, you should be able to access the router IP address while the VPN is connected.

You could technically also install Teamviewer Host on it if you wanted a GUI, but if you just need access to web services, the above route should work fine.

Happy to run you through the process in more detail tomorrow if you'd like. Feeling a bit buggered tonight (got the Pfizer jab earlier today) and posting from mobile so please pardon the lack of formatting.

 

[howardb]

I've had a proper read through your post, and if it isn't blocked on the ISP side, you might be able to get it to work.

In the screenshot provided, you'd need to put the router internal IP and forward the port that you want, 8080 in your case. A lot of mobile ISP's use CGNAT which means network traversal into that router could be blocked, unless you apply for it (good luck getting through to someone who will escalate your query though).

Two major issues:
1) this is very insecure, as you are effectively opening the router up to the world and you will surely get attacked from all angles.
2) without a client to keep your dynamic DNS updated, you would lose connectivity to it once your IP address changes which can happen frequently, especially with mobile connectivity. The router may have DynDNS capabilities though.

My suggestion would be to get a cheap Raspberry Pi Zero that you can link up to the router using WiFi. Give it a static IP address, and then install Wireguard on it. You would then need to open Wireguard's ports on the router (use the Pi's IP and WG's port, which is port 51820 UDP IIRC). You can also install a Dynamic DNS update on the Pi to keep it updated with the correct IP address. Then you should just be able to activate the Wireguard VPN and control the stuff that you need controlled from onsite. If the router is smart enough and can do hairpin NAT, you should be able to access the router IP address while the VPN is connected.

You could technically also install Teamviewer Host on it if you wanted a GUI, but if you just need access to web services, the above route should work fine.

Happy to run you through the process in more detail tomorrow if you'd like. Feeling a bit buggered tonight (got the Pfizer jab earlier today) and posting from mobile so please pardon the lack of formatting.

Many thanks, just awaiting the ISP to revert on any locking/blocking/etc.
Did some more searching on this MF286 router model, and it seems there is an option missing on my admin control menus - there should be an option called "Remote Management", which I don't seem to have. It apparently allows the DynDNS details to be entered.
Looking at updating the firmware from the router to see if there is a newer version available and if the remote management option appears.

If that all fails, I will certainly give your suggestions a bash

 

[Ivan Wheatley]

Bought ZTE LTE Router from Cell C Connecta package and have never received more than 2.3 Mbsp download! After numerous emails and calls to the Robots at Cell C they have completely ignored my complaints. Unfortunately there is no telecommunications registrar in South Africa!