Home Internet - Port Forwarding not working

I was able to get port forwarding to work. In my setup I use the T-Mobile Gateway → USG-3P → Home Network. In this case I have a router behind another router. In the home network I have a Plex Media server. Here's the steps I used to get the Plex Media server to talk to devices outside (Internet) the home network.

1. Change the IP address of the T-Mobile gateway from 192.168.1.1 to 192.168.1.2
2. I left the USG-3P address range at 192.168.1.x
3. Enabled port forwarding on the USG-3P so that 32400 would reach my Plex server. Essentially nothing changed on the USG-3P, this was what I had when it was connected to a Comcast modem.
4. On the T-Mobile Gateway I enabled the DMZ and put the USG-3P into it.
5. I disabled all Wifi capability of the T-Mobile Gateway, and only used a single LAN connection directly into the USG-3P.
6. I disabled ALL firewall settings on the T-Mobile Gateway. I figured this is okay because the only outlet is directly into my USG-3P router that has all it's firewall enabled. Again, all Wifi is disabled on the T-Mobile Gateway and the only outlet is a LAN port directly into the USG-3P which firewalls my home network.
7. I set the virtual server routing on the T-Mobile Gateway for port 32400 to point to the USG-3P.

After that I was able to successfully get devices on the external Internet to talk to my Plex server. Logically it seemed that I would only either need to enable DMZ or Virtual Server, and it seemed like I shouldn't have to disable all the T-Mobile Firewalls, but it wouldn't work unless I did all the above steps. Again, I would not recommend this unless you have a dual router situation, you disable Wifi on the T-Mobile router, and you place your entire home network behind a second router that has the proper Firewall protections.

Chris,

I was offered T-Mobile Home Internet Friday evening. The sales rep was very nice but could not answer some of my pressing questions. I understand as she wasn't trained at that level. I would prefer bridge mode for the gateway. I was told Sunday by Tech Support the Gen 1 gateways do not support. It is "rumored" that the next gen will support bridge mode but no confirm rumor or expected date. I access a single board controller and Node-Red from the outside now with a land DSL service. No problems there but T-Mobile is much faster at a lower cost if I change to VOIP. Tech Support told me they could not give me a static public IP as I have now. My after the sale research shows that LTE type Internet doesn't work the same and that's not going to happen. Even with a static public DHCP and a DDNS it looks like double NAT'ing is the only remote possible option. The bottom line is I need to be able to log into my Raspberry Pi and Node-Red port from anywhere. It looks like even with bridge mode the lack of an IP address I am still out of luck. I would not be so terribly opposed to a DDNS service but search engine research indicates this is not possible with T-Mobile LTE Home Internet. l I just don't think this is prime time unless unless you want to play on social media and check email. Please tell me I'm missing something. Regards, Alvin

Unfortunately, until T-Mobile implements bridge mode, and offers static IP service, I cannot use them for my ISP.  :-(

+1000 for bridge mode.

I am port forwarding for Plex access from the outside which seems to be working fine:

And then on the internal router another forward from 16824 to Plex port on my QNAP NAS.

The Plex settings indicate "Not available outside your network" but my iOS devices connect just fine.

I'm with you @jonsteinmetz​ it appears that the LTE Internet service uses IPV6 and I think that an port request is not reaching the LTE/WiFi device. Even with DMZ turned on and pointed to an internal box with open ports, I can see using "ShieldsUP!" by Gibson Research Corp that my public IP address is showing all ports closed and in stealth mode.

Reproduction steps

Public IP: While connected directly to the LTE/WiFi device, look up the public IP address via ipchicken or any other IP presentation service.

Port Scan: Scan for specific or all ports via "ShieldsUP!"

This solution has not worked for me. I am wondering if there is a difference in the functionality of the DMZ and port forwarding between hardware versions of this router. I've had mine since jan/feb, so it's pretty old. Neither feature seems to actually DO anything on my end.

In case it helps anyone, my firmware/hardware version are below. 

We definitely need Bridge Mode on the next iteration of this hardware if this is going to be considered comparable to other ISPs.

DETAILS:

Firmware version installed: 

02944

Versión del hardware 

REV.5

What an unfortunate waste of time this was. Just got the modem today and was excited to see the decent speeds I could get, only to find out it's impossible to connect to my security cameras or any other devices in my home when I'm not there even over IPV6. The NAT situation is a PITA enough as it is but to now find out about IPV6 not working…  Super frustrating. The Home LTE service can't even talk to IPV6 only websites, like IPV6.google.com, whereas, my TMobile phone can. 

I have no choice but to keep my Comcast service and pay twice as much for Internet.

I cannot find any settings for port forwarding in the GUI. I do see NAT, UPnP and, ALG https://support.t-mobile.com/docs/DOC-39518#app8

Where specifically are you configuring the port forwarding?

The virtual server/NAT settings are port forwarding. For the internal IP just put the port you are forwarding. If it is a range I usually do 30 below the highest number.

It works. My xbox now has full upnp as well ad open nat unlike on the mobile hotspot through my phone. Port forwarding for mobile hotspot would be great

Glad you could get it working! Not sure we are gonna be able to do advanced network config stuff on a smartphone mobile hotspot as it is simply designed to provide internet to other devices and not networking.