Cannot access ADSL modem setup with additional address via specific devices

Question

Hi guys! 
 I am facing a strange issue... 
 I have an ASDL modem/router in bridge mode with IP 192.168.2.1 and have setup an additional address (192.168.2.2) on my UTM in order to access the modem. 
 The WAN interface connected to the ADSL modem/router is using PPPoE and my LAN is on the 192.168.1.x range 
 This has been working great until recently. I could enter http://192.168.2.1 on my smartphone's browser and could normally access the modem's webui (I want to regularly check the speed my adsl router syncs, because I have isp issues) 
 About a month ago, I replaced both my smartphones (company and personal) 
 From those 2 devices I cannot connect to the http://192.168.2.1 address. 
 From my computer, the page loads normally. I tried from my tablet - loads normally, too. 
 BUT , I can access the http://192.168.2.1 address normally from either phone when I am connected to my house using VPN... 
 The only difference between the other devices and my phones is that I have put them in Skip Transparent Mode Source Hosts/Nets & Skip Transparent Mode Destination Hosts/Nets in filtering options. I thought that maybe that was the case and went ahead and removed them, but still the same. 
 The only other thing that has changed since I could access the address via the old phone's browser, is that - due to the fact that I was migrating stuff and a need for more addresses arose, I changed my DHCP internal range and added 10 more IPs (was until .20, now it is until 30). I think this is irrelevant, though, just thought I should mention it... 
 
 Any ideas on where to look? I am really lost, don't know what to check and this thing is puzzling me. 
 I mean I can always connect using VPN (even when I am at the house), but why on earth does it not connect normally?

sachingurung · Answer

Hi, 
 I believe the mobile phones are connected through WiFi, I am interested in knowing what IP address is leased to the mobile devices(same subnet IP address on the other devices which can access the GUI?). Grep this IP address and post the packetfilter.log. 
 Also, take a tcpdump on the source IP(x.x.x.x) and the destination IP(192.168.2.1), show us the dumps. Finally, show me a picture of WebAdmin settings from the management page. 
 Thanks

BAlfson · Answer

I just looked at the entire thread. I was so sure it was something between the UTM and the modem, but I only now "saw" that the modem never responded to the ARP request from the UTM. Strange that the UTM would ARP on the internal NIC rather than the external one. That might be an unintended feature[;)], but let's see if we can outsmart it. What happens if you change the Additional Address to a /30? 
 Cheers - Bob

seroal · Answer

Hi ChriZathens , 
 did I understand you right, that the only difference between the working and the non working devices is, that the devices, that can access the dsl modem&acute;s webfrontend are handled by the transparent proxy and the non working devices are handled by firewall rules? 
 
 If yes, then I think the problem can be be explained easily. For the working devices (using transparent webproxy) the utm automatically masquerades the request behind the address 192.168.2.2 (Proxy Service). 
 For the non working devices, without the SNAT Configuration the clients will not be able to reach the dsl modem, even when firewalls rules are in place. Or did you configure a route for your internal network 192.168.1.0 on the dsl modem? 
 
 Did you configure the SNAT Rule mentioned by Bob? If not, do it. I believe your setup will then work again! 
 
 Let me know ;) 
 
 BR 
 Sebastian

Cannot access ADSL modem setup with additional address via specific devices

Submitted a Tech Support Case lately from the Support Portal?