Cannot Connect to RailPro Server

[DavidMcC]

I work in a Hobby Store and we have Dell computers running Windows 10 with ESET NOD32 Antivirus.

I have excluded the RailPro Assistant Revision 4.01 from all the places I can find in both ESET and Windows 10 Security. - firewall, scans etc. but it still can not connect to the RailPro server.

Does anyone have any suggestions as to what I am missing?

 

[Alan]

Does your store use a network with its own firewall? The Ring server cannot connect problem is popular. Take a look at this thread: https://rpug.pdc.ca/index.php/topic,656.msg5047.html#msg5047

[William Brillinger]

The Ring server cannot connect problem is popular.

I wouldn't say "popular" anymore, I can't recall the last new customer I had that had this issue.

I'm sure our resident guru in these matters, "the other Tim", will be online soon and he'll have some suggestions for you.

One thing I know is that RPA has some issues with Antivirus software. Excluding it is not enough in some cases. Try disabling ESET completely and test again.

[Alan]

Let me rephrase... of the few RP problems that people post on this forum, connection with Ring server or related Internet issues seem to be the most popular. Rarely does someone have problems with the hardware itself. Search "internet connect" on this forum. Quite a few results.

[William Brillinger]

Let me rephrase... of the few RP problems that people post on this forum, connection with Ring server or related Internet issues seem to be the most popular. Rarely does someone have problems with the hardware itself. Search "internet connect" on this forum. Quite a few results.

Yes, I agree, it's probably been the largest issue facing Railpro overall , but looking over the search results, you'll see there are far fewer posts about this issue in 2019 than in previous years.

[G8B4Life]

I guess that's my cue...

David, I'm confident your problem isn't Nod32 or Windows security but rather that you have a CGNAT internet connection (going out on a limb here and assuming that a hobby shop doesn't have any enterprise networking in place).

There are a couple of ways to test for this:

If you know how to you can login to the store's modem and find the WAN IP address. If The WAN IP address of the modem falls in the number range 100.64.0.0 to 100.127.255.255 then you have a CGNAT connection.

If you don't know how or don't have login access to the store modem you can use the UDP test tool (found in the files section here on RailPro User Group) to run a PAT test. This will show you if the port numbers change (which would indicate a CGNAT connection if they do change). Do please read the documentation accompanying the UDP test tool if you wish to use it.

You can also try disabling Nod32 completely and trying RPA again to completely rule Nod32 out. I'd try that only after a CGNAT connection has been ruled out though.

Unfortunately if you do have a CGNAT connection there isn't a whole lot you can do expect:

1. Complain to Tim Ring that he still hasn't fixed the CGNAT problem
2. Ask your Internet Service Provider for a public IP address (they'll usually charge extra for this)
3. Ask your Internet Service Provider if they can give you the port that RPA uses (unlikely to happen)
4. Wait for an unknown amount of time until I can get a proxy sever running to negate the CGNAT issue.

Let us know how you go and we can take it from there.

Yes, I agree, it's probably been the largest issue facing Railpro overall , but looking over the search results, you'll see there are far fewer posts about this issue in 2019 than in previous years.

But is that, as a statistic, an accurate representation of the issue? I'd say we have but a fraction of the number of RP users out there on this forum, and of the users on this forum only a fraction of them post anything. I think it's reasonable to assume that the issue is more widespread than we think it might be; it's just that we don't hear about it here.

- Tim

[William Brillinger]

But is that, as a statistic, an accurate representation of the issue? I'd say we have but a fraction of the number of RP users out there on this forum, and of the users on this forum only a fraction of them post anything. I think it's reasonable to assume that the issue is more widespread than we think it might be; it's just that we don't hear about it here.

As a reseller, I have a broader picture than this forum. Not nearly all of my clients are on here, and in 2018 I had a much higher number of new clients who had connection issues, whereas in 2019, the number has been much much lower. Of those in 2019, the problem for over half of them was Avast Antivirus killing RPA.

[G8B4Life]

That's a fair call with being a reseller and the broader picture. I would have imagined that many who had connection issues wouldn't have come back to you but gone straight to TR instead.

Interesting on Avast, since 2016 Avast and AVG have been owned/made by the same company and I never had an issue with AVG and RPA.

I guess I'll have see if I can test Nod32 and see what it does with RPA.

- Tim

[Alan]

I use Avast and yes it does block Ring just as it should. Windows Defender does also. I would question any threat protection that does not intercept Ring's payload as its signature looks suspicious - no publisher, etc.

[G8B4Life]

Looks like I might need to test Avast too.

Alan, what blocking does Avast do? Is it the firewall blocks the connection or does Avast pick the program up as a threat (malicious or potentially unwanted program)? If it's a threat/pup it's reporting I'd expect Avast to question you on what you wanted to do (quarantine or ignore) and I'd expect Nod32 to do the same. I've only ever once had an antivirus not let me access/run a program regardless that I specified to ignore the threat but I've run some truly questionable (to an Antivirus program) software in my research before, much more dubious than RPA so I'm kinda surprised that Avast, and possibly Nod32 would flag RPA to the level of not being able to ignore it permanently.

- Tim

[Alan]

Looks like I might need to test Avast too.

Alan, what blocking does Avast do? Is it the firewall blocks the connection or does Avast pick the program up as a threat (malicious or potentially unwanted program)? If it's a threat/pup it's reporting I'd expect Avast to question you on what you wanted to do (quarantine or ignore) and I'd expect Nod32 to do the same. I've only ever once had an antivirus not let me access/run a program regardless that I specified to ignore the threat but I've run some truly questionable (to an Antivirus program) software in my research before, much more dubious than RPA so I'm kinda surprised that Avast, and possibly Nod32 would flag RPA to the level of not being able to ignore it permanently.

- Tim

Picks up the program as a threat. Avast does give you the option to ignore and proceed. Works as expected afterwards. Windows Defender same same.

[G8B4Life]

Thanks for the info Alan.

It would be possible to submit RPA to Avast as a false positive (https://www.avast.com/en-us/false-positive-file-form.php) however I don't use Avast and I'm not giving them my email address so they can send me junk for the privilege of reporting the false positive. It might be worthwhile for someone who does use Avast (and has given Avast their email address previously) to file the false positive report.

Anyway, back to waiting for the OP to come back with anything further.

- Tim

[Alan]

It would be possible to submit RPA to Avast as a false positive.
- Tim

Already did. Twice when I first purchased RP. Also made Tim Ring aware of the Avast submission at the time.

[DavidMcC]

The port test to the PAT Test site gave me tests that both fail and are probable passes.

PAT Test  for RailPro
Test Results
---------------
Your IP Address: 24.45.178.133
Sockets created

Result
1  4608  4608 55072  Fail.
2  9121  4608 55072  Fail.
3  4608 57253 57253  Probable Pass. 
4  9121 57254 57254  Probable Pass.
5  4608  4608 55072  Fail.
6  9121  4608 55072  Fail.
7  4608 57255 57255  Probable Pass.
8  9121 57256 57256  Probable Pass.
9  4608  4608 55072  Fail.
10 9121  4608 55072  Fail.
11 4608 57257 57257  Probable Pass.
12 9121 57258 57258  Probable Pass.

I am guessing that probably means CGNAT and that I am out of luck for now.

[G8B4Life]

It certainly appears to be CGNAT but there is something about the results I was not expecting.

In the first, second, fifth, sixth, ninth and tenth tests columns 2 and 3 do not match (Fail). This is a hallmark that Port Address Translation (CGNAT) is being used. That column 3 is the same number in those tests was not expected.

The rest of the tests displayed expected and unexpected results. As expected the port numbers in column 3 are increasing by one each time the test is run but the fact that column's 2 and 3 are the same is unexpected. In this scenario it appears that your PC has chosen port numbers that just happen to match the range allocated to you by your ISP (fixed range allocated to you) or that your ISP is using a dynamic port range which I think is the case.

The fact that the first, fifth and ninth tests failed with a changed source port and these are the tests that use both the same source and destination ports as RPA yes you are pretty much out of luck at the moment. I've got no idea how long it'll take me to implement a CGNAT breaking proxy for RPA (there is only one thing I can not figure out how to do yet that is stopping it) so my suggestion would be to take any or all of the suggestions I made in my first post.

- Tim