How to set up port mapping on Tianyi gateway? There's no such entry in useradmin, so I ran two backend layers to remotely connect to the NAS

last month on a business trip, I wanted to connect to the NAS at the hotel to download a file at home, but after running through the app for a long time, I couldn't get through. I clearly configured the port forwarding on the Xiaomi router at home, and after three checks, there were no issues. It wasn't until 11 a.m. that I realized—the problem wasn't with the router at all, but with the telecom optical modem in front of it. The optical modem uses routing modem; the public IP is actually in the hands of the optical modem. The door I open on the router is the "optical modem internal network" door, and packets from the external network are blocked as soon as they reach the optical modem. To let outside traffic into your home, you need to map ports on the optical modem. This article will record the entire process of running two layers of backend on Tianyi Gateway.

clarify first: why map on the optical modem, and the trade-off between two paths

most current telecom optical modems come in router modem, with dialing done by the optical modem, and the public IP address (if you have one) is also attached to the optical modem's WAN. If your router is connected below the optical modem's LAN port, you only get an internal network address assigned by the modem.

this creates a two-layer access control: the outer gate is on the optical modem, and the inner gate is on the router. You set up port forwarding on the router, only opening the inner layer door; the outer layer is always locked, so the data can't reach the router's level.

two ways to solve it. One is to the optical modem to switch to a bridge , allowing the router to dial directly and get the public IP, so that future mapping will be done on the router for a permanent solution. But the change is in WAN connection mode, so IPTV and landline are easily affected. the record of the night I switched to bridge and failed to save IPTV is still here. The other is the main character of this article: the optical modem doesn't change, but in the backend, the modem sets a port mapping to the router's address, turning it into 'dual-layer forwarding.' It works, but the trade-off is that every new rule added in the future requires changing two parts (one for the optical modem, one for the router). Too many rules can easily cause confusion. If you want to avoid hassle or have many devices, it's recommended to go straight for bridging; If only one or two devices need exposure and don't want to bridge it, the optical modem mapping is sufficient.

the first layer door: useradmin enters, searches the menu, but no port mapping

at first, I thought it was pretty simple. The sticker on the back of the modem showed the account, so I entered it and logged into the 192.168.2.1 backend. My optical modem is a Huawei HS8145V5, and my regular account just starts with the useradmin on the sticker—one code, one device.

was stunned when he went in. The left menu has only a few items: Status, Network, WLAN, Security, Management. I clicked through every item, and no port mapping, no NAT, no virtual server , not even an "Apps" menu. At first, I thought the firmware was too old, so restarting the optical modem and entering it was still the same menu.

later realized it wasn't the menu that was hidden, but the permissions had been removed. Telecom divides backend accounts into two sections. The useradmin file is a regular account that only performs "surface settings": changing WiFi name and password, checking connected devices, and restarting. Port mapping, which requires changing forwarding rules, is in the super admin account's category. So if you're stuck at this step, don't bother flipping through the menu. It's not that your eyesight is bad, it's that the backend doesn't even give you this feature.

By the way, for a few models (I've seen a Bell machine), useradmin goes to 'Apps' and has a simplified DMZ setting that lets you enter the router address directly, which acts as a halfway door. But DMZ means full port bare driving. Cameras with weak passwords must not be exposed like this. The difference between port forwarding and DMZ I have written about this before I won't elaborate here.

second layer door: get the telecomadmin super admin password, the path is hidden in the application

want port mapping, you must log in to the super admin account. The super admin account for the telecom custom machine is telecomadmin, and the password is not printed on the sticker; it is written by the installer during installation. How to get it? the scripts and pitfalls I made when calling 10,000 I wrote a separate article. Here, I'll just say one thing: call customer service and say, "I have my own router at home, need port forwarding and remote monitoring" is much more likely to pass than "I want to try optical modem." I asked the installer to help change it remotely and got the password at the same time, so I didn't spend any money.

get the password, log in again to 192.168.2.1, and change the account to telecomadmin. You can immediately tell the difference at first glance: the left menu opens up a large section: System Tools, Security, WAN Connection, and the previously unavailable "Apps." Port mapping is hidden within the application, and different model names may differ slightly:

interface is simple, just a table with a 'Add' button. Don't be scared—there's not much to fill in.

four steps to complete the mapping, fill in three wrong grids and make it all blank

add a new dot, and the form pops up with several boxes, each with its own details. I made two mistakes on my first trip.

Step one: Choose the correct WAN connection name. the dropdown box contains a string of connectors, like "1_INTERNET_R_VID_4634" or "2_OTHER_B_VID_45." Make sure to select the one labeled with 'INTERNET' and ending with R (Routing Mode). The numbers after the VID vary by company, so you don't need to worry about the exact number. Don't accidentally pick IPTV or VOIP—those are the channels between the TV and landline. Mirroring it and hanging it will cause screen distortion.

Step two: Agreement. web services, choose TCP; if unsure, choose TCP/UDP full protocol. For home use, there's no need to skimp on this.

Step 3: Start/terminate external ports. this is the house number used for accessing the external network. don't use 80 and 443. Jiakuan is basically blocked on both ports. My first trip was 8080, but later I found that in some regions, even 8080 was on block lists, so I decided to use high-level ports like 18080 for stability.

Step 4: Internal IP and Internal Port. the internal IP to fill in the device address where the traffic will ultimately go—if the optical modem is directly attached to the NAS, enter the NAS's IP; For example, for someone like me with a router under the optical modem, enter address of the router's WAN port here ( visible in the device list on the optical modem), then the router transfers the traffic to the NAS. The internal port should be the service port. My NAS web management port is 8080.

After

save, some models require restarting the optical modem for it to take effect. My HS8145V5 took effect immediately. After setting it up, don't rush out to test it. Take your phone's data (note: always turn off WiFi for data, otherwise you'll still be testing the internal network) and try it out. Once it works, you'll wrap up.

is it still hard to connect? Three pits, one by one

mapping rule still doesn't work. Don't doubt your life yet—ninety percent of the following is one of the three pitfalls.

Pitfall 1: Your home doesn't even have a public IP address. this is the most common and deadly one. Nowadays, many telecom home broadband routers are by default placed behind CGNAT, and the optical modem's WAN port gets shared addresses starting with 100.64. In this case, no matter how well you map it correctly, it doesn't matter—the door is on someone else's wall. The method is simple: check the WAN port IP in the backend of the optical modem, then use your phone's data to search for "local IP." If the two numbers don't match and the WAN port is between 100.64 and 100.127, that's CGNAT. The solution is to call number 10000 to report 'I have storage devices at home that need remote access' and apply for a public IP address. It's free, I've done the full .

pitfall 2: ITMS pushed rules away in the middle of the night. can connect today, but can't connect again in a couple of days. When I check the backend, the mapping rules disappear entirely—this is done by Telecom's remote management platform ITMS, which stores the standard configuration of your optical modem. If it finds local changes, it will push a "correct configuration" update at midnight to cover it. Port mapping, like bridging, is a high-risk change item and has a high probability of being pushed back. The solutions I have tried and the trade-offs about deleting TR-069 written in the ITMS article. Here, a reminder is enough: when mapping rules suddenly disappear, think of them first.

Pitfall 3: The device IP changes, and the mapping points to an empty address. the internal IP bar is written to death, if the device is reassigned by DHCP, the mapping still points to the old address, and the package is inserted and the user cannot be found. So before mapping, first perform DHCP static assignment on the router for the devices you want to expose (or set fixed IPs on the device). The complete procedure for this step in the article on static IP binding. My NAS hasn't changed its address for two years since it was properly bound.

optical modem mapping or switching to bridging? Take it personally

finally clarify how to choose between these two paths: don't tear down the entire wall and rebuild it just for one door:

remote access, DDNS, intranet penetration, and IPv6 routes are suitable for different users. I compared in my NAS remote access article, port mapping is just the foundation for one of these paths.

Sequence Summary: First, use mobile data to confirm that the external network connection is indeed unreachable. → Check the WAN port IP on the optical modem to exclude CGNAT (starting with 100.64, first enter 10000 for the public IP address). → Get the telecom admin password. → Add mapping in the app, use a high bit for external ports, and make sure the INTERNET connection is the one for WAN connections. → Bind the device to a static IP → Actual mobile data test. Once you get through, save a screenshot of the rules. If you can't connect, check directly—chances are, it's either ITMS pushback or IP drift—these two old folks.