How can a device without a default gateway be accessed using port forwarding?

To access a device remotely, a port forwarding rule to the device’s IP address must be configured in the router. In addition to the IP address, a default gateway must also be configured on the device so that the remote request can be answered. 

In certain cases, however, the router’s LAN IP address cannot be configured as the default gateway on the device:

• The device does not support configuring a default gateway.
• The device’s network configuration cannot be changed.
• The device is intended to use another router as its default gateway, for example in fallback scenarios.

Without a configured default gateway, the device cannot be accessed remotely via port forwarding, as the device cannot reach the sender’s IP address.
 

Solution

To enable the device to be accessed remotely via port forwarding despite the absence of a default gateway, LAN masquerading must be enabled on the router. This means that the device receives the router’s LAN IP address as the destination address for the reply instead of the external requester’s IP address. The reply packets are therefore sent directly to the router, which then forwards them to the external requester. 

Here you will find instructions for configuring LAN masquerading for the respective router models:
Teltonika router
Advantech router

Warning:
Masquerading makes the device assume that the request is a secure request from the LAN. This can pose a security risk, particularly when using a public IP address, if this causes the device’s firewall to be bypassed. 
 

Teltonika router

To enable LAN masquerading, follow these steps:

1. Log in to the router’s WebUI; see also Local access to the router’s web interface (WebUI)

2. Under Network → Firewall → Zones , enable Masquerading (on) for the source lan and save it by clicking Save & Apply.

   

   (In older firmware versions, for example R_00.07.06, you will find this setting under Network → Firewall → General Settings in the Zones section.)

The connected device will now also respond to remote access requests if the router’s LAN IP address is not configured as the default gateway on the device or if the device’s firewall blocks access from other IP address ranges.

Advantech router

To enable LAN masquerading, follow these steps:

1. Log in to the router’s web interface; see also Local access to the router’s web interface (WebUI)
2. Under Configuration, click the Scripts → Startup menu item

3. Check whether the following blue-highlighted masquerade entries are present:

   
    

4. If these entries have been disabled by a preceding hash symbol (#), remove the hash symbol (#) before these three entries to enable masquerading and apply the change by clicking Apply:

   If these entries are missing, add the following lines and click 'Apply'.

   # Masquerade LAN disabled (Can be enabled by removing #)
   iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE
   iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
   iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

5. For the rules to take effect, you must then reboot the router.

The connected device will now also respond to remote access requests if the router’s LAN IP address is not configured as the default gateway on the device or if the device’s firewall blocks access from other IP address ranges.