NR7101 gets secondary WAN IP

max7101

I am using the NR7101 in passthrough mode with Hutchison 3 for quite some time without any Zyxel related issues.

I just found out when my publicly facing IP is for example 165.233.23.240 the NR7101 UI is publicly accessible on 165.233.23.241

How can this happen?
Why would my ISP gift me a second IPv4 address?
How can I stop the Zyxel being accessible on that second address?

Management from WAN is disabled in NR7101 settings but this only affects the normal 165.233.23.240 address.
165.233.23.241 is not shown anywhere, I just found it by mistakenly ping 165.233.23.241 instead of 165.233.23.240

Internetheavyuser

It is Zyxel's design in IPPT mode for the user to access GUI of NR7101 from the LAN side.

You can try use another PC from the WAN side to access the GUI of 165.233.23.241. Which is not possiable.

If you can ping 165.233.23.241 from the WAN side that might be another device.

max7101

Sorry if I may seem rude but it really annoys me again everytime in any forum that weird observations or things no one has heard before lead to assumptions like "myself doing it wrong" just because you don't understand what is going on (like me) it is still exactly what's happening

One additional information tho, it is just reachable from different WAN if both WAN connection are from same provider and also it seems you have to land in a "lucky subnet".

Sometimes it's one IP higher than public, sometimes it's one lowe, in this example it could have been eiter 42+41 or 42+43

Edit:
Yes, this is from the same network (hairpin / nat loopback) but it's the same using online ping service.
After disconnecting NR7101 both pings are failing also from outside.

Internetheavyuser

It seems like you are using the same WAN.

Dont use the IPPT IP (165.233.23.240)from the NR7101 (AKA the device connect to NR7101).

Because you can access the GUI from the IP+1 (165.233.23.241) or IP-1 (165.233.23.239)(according to the subnet). In your first post it was (165.233.23.241)

Use another device which is not using the network of NR7101 to connect 165.233.23.241. You will find out that you cannot access GUI. (There is a great chance it can ping.)