how to port forwarding pace 5268ac

The reason you shouldn't put your ASUS in the DMZplus mode is that what DMZplus mode does is forward all non-solicited requests to that IP address.  Since your ASUS isn't operating in router mode, it is not expecting traffic bound for any host but itself and it will end up refusing/discarding all the non-sequitor traffic.

When using the ASUS as an Access Point, you'd have to do all the port forwarding to your cameras on the U-verse Gateway just as if the ASUS were not there.

Understood.  I did manage to get Xbox Live NAT fully open the other night by port forwarding to the static NAT setup on that device.  I previously had set static IP Addresses for both cameras and I can see them statically allocated in my ASUS configuration when in router mode, however the Pace modem does not seem to be picking them up for some reason.  I've checked both the wireless and wired (not using) MAC addresses on the cameras and they do not show up in LAN IP Address allocation.  This is really strange and I believe the reason I'm unable to connect to either camera is they currently do not have the correct ports forwarded.  I've tried pinging both IP Addresses and they respond to ICMP, however they still don't show up in the LAN allocation.

So I figured out the issue using my wireless Foscam's and port forwarding.  I had to log into each camera using the URL (https://+) and change the gateway and DNS servers from my ASUS router to the AT&T Pace mode.  Problem solved and ports are now forwarded using the Application pinholes feature.

After 2 hours on phone with ATT (Tier II) Tech Support, could not resolve similar problem: could not open ports(s) for security camera DVR even though user-defined application on Pace  model: 5268AC showed "Configuration Successful." While there is no other router downstream, I will verify DNS server entry on the DVR's network page and report back with results. Thanks BROCKO9M3 for leading me to this next troubleshooting procedure. Am hopeful this will resolve problem as I have seen this before and should've thought to check DNS settings.

I have a personal website that I have been hosting through my Pace 5268 modem.  Recently, something happened and all incoming traffic is blocked. What might be happening here?  BTW, my Symantec Endpoint Protection won't update and I can't reach the Symantec website to manually update my virus definitions.  These two issues may be related, but I don't know how to resolve this.  Any ideas?

I got support and resolved issue, chat with "Cha..." and got a follow up call 877 xxx on 09/08/2017: 10PM EST to my att cell . Thanks to Support Team.
Steps:
====
1] reset the pace 5268ac by pressing red button at the back.
2] go to http://192.168.1.254 --> Home --> scroll to bottom - look at Home Network Device Lists, check any device start with unknown###########, expected none. if exists not down.
3] connect foscam with Ethernet
4] check again a new device added with unknown###########, note down this is the foscam device in Ethernet, this referred as newFoscamEthernet
5] go to http://192.168.1.254 --> Settings-->Firewall --> click on "Applications, Pinholes and DMZ"
6] go to
2) Edit firewall settings for this computerclick on add new user -defined application
7] enter foscamportno as profile name,select TCP, enter port range from and to.and save..
8] select the newFoscamEthernet that found in step 4 1) Select a computer
9] wait for the newFoscamEthernet selected to be displayed
10] in 2) Edit firewall settings for this computer
select foscamportno in application list and click Add and click on save.
11] go to http://192.168.1.254 --> Home --> scroll to bottom - look at Home Network Device Lists,
click on details for the newFoscamEthernet, the port range added to this device should be dispalyed below "allowed application lists"
12]Connect foscam to wifi and remove the ethernet cable and follow the step from 4 to 10 skip 6,7Hope this helps.

It seems to me that there is a disconnect regarding terms.

Port forwarding would allow the user of the router device to direct (for example) port 80 traffic to a specific machine on the internal network. The firewall rules available do not appear to include port forwarding. They appear to offer only passthrough of a specific service to a specific port on a specific machine, not redirection of traffic from a specific port on the router to a specific ip address. Port Forwarding inherently entails redirection.

This doesn't work because AT&T is blocking port 3389 on some of their networks.  I implied "some" because most of you have reported 3389 being blocked but not all of you. 

The only way to successfully use RDC through an AT&T Residential Gateway is to put the Pace5268AC into DMZ mode and use a router to forward port 3390 to your designated machine on your LAN.  Port 3390 isn't (currently) being blocked.  You will need to go into regedit to change your designated machine for RDC to port 3390 which Microsoft has good documentation on.

I'll post a followup step by step guide but for now wanted to share what I have learned through dozens of hours of research and phone calls with AT&T support.

---

@Stevester wrote:

This doesn't work because AT&T is blocking port 3389 on some of their networks.  I implied "some" because most of you have reported 3389 being blocked but not all of you. 

The only way to successfully use RDC through an AT&T Residential Gateway is to put the Pace5268AC into DMZ mode and use a router to forward port 3390 to your designated machine on your LAN.  Port 3390 isn't (currently) being blocked.  You will need to go into regedit to change your designated machine for RDC to port 3390 which Microsoft has good documentation on.

I'll post a followup step by step guide but for now wanted to share what I have learned through dozens of hours of research and phone calls with AT&T support.

---

Nobody in this thread mentioned wanting to use RDP or TCP 3389.  Perhaps you've posted in a thread other than the one you intended to?  Further, per http://about.att.com/sites/broadband/network AT&T does not mention blocking 3389 in their network.  It would normally be blocked as unsolicited incoming traffic, though.  If, for some reason, you did need to use port 3390 over the Internet for RDP, you could simply remap the port in your port mapping, rather than try to change the listener port on the Windows server.  You still need to specify the alternate port in the client (MSTSC or whatever).