7

I realise that this may be better suited to ServerFault, but this is my home network that I run in a non-professional enviroment.

At home I have my main router connected to the internet which the main family computer and laptop run from. I also have a "development" network with a m0n0wall firewall in a VM to provide internet services. I want to host a website (and eventually other services) on one of the machines on the dev network but cannot figure out how to "port forward" through my main (belkin) router, through to the m0n0wall firewall, and then through to webserver.

The traffic would have to come through the public ip, pass through port 80 of the main router (192.168.2.1) then be forwared through the WAN connection of the m0n0wall box (192.168.2.2), out of the LAN connection (192.168.10.2) and finally into the server. After the configuration is saved I can't work out while it is not working. I can host the site fine behind the main router. There is a firewall rule on m0n0wall to pass port 80 traffic from 192.168.2.1 through but it just isn't working.

I've drawn a very basic diagram below (unfortunately any advanced Visio stuff is currently black magic to me).

enter image description here

Improve this question
7
  • 1
    small networking questions for personal use are on-topic
    – James Mertz
    Aug 23, 2011 at 16:05
  • Are you able to access the web server from your family machine? I think you need to get that working first. Once that is working, then getting the belkin working should be easy.
    – Zoredache
    Aug 23, 2011 at 16:12
  • What does your firewall rule in the m0n0wall look like?
    – MaQleod
    Aug 23, 2011 at 16:15
  • @MaQleod - i.stack.imgur.com/sFCoJ.png.
    – tombull89
    Aug 23, 2011 at 16:22
  • @Zoredache - no. looks like I'll start there.
    – tombull89
    Aug 23, 2011 at 16:22

2 Answers 2

Reset to default
2

  1. A separate IP range is unnecessary, this will work without it as the firewall sits between the cables.

  2. Your main router should forward to the web server and not to the firewall.

  3. Your firewall should accept any source address, the main router does not overwrite source address.

    This also allows access from your family machine.

  4. Your firewall should also allow traffic going to the other side.

  5. Use Can You See Me and Wireshark for more detailed troubleshooting.

Improve this answer
4
  • Thanks, Tom. The Belkin has a 255.255.255.0 netmask, so it doesn't even give me the option to portforward to 192.168.10.250 (the 192.168.2 bit is hardcoded in) so how can I forward it to the webserver directly?
    – tombull89
    Aug 23, 2011 at 16:28
  • I think I may have overestimated my ip addressing abilites...
    – tombull89
    Aug 23, 2011 at 16:29
  • 1
    @tombull: Another option is to explicitly forward the port 80 traffic from the external IP of the firewall to the IP of the web server in the firewall config, but I don't know if M0n0wall can do this. Putting everything in the same IP range could solve this problem...
    – Tamara Wijsman
    Aug 23, 2011 at 16:37
  • @tombull: If M0n0wall cannot forward packets, thenyou are going to need to put them all in the same subnet or have some kind of DNS service running, otherwise the Belkin router will have no idea where the webserver is.
    – surfasb
    Aug 23, 2011 at 21:36
2

Right, I have finally worked this out and got it as I wanted. Instead of the m0n0wall box forwarding packets twice I've moved to changed subnets. I now have a DD-WRT-based Linksys E1000 acting in "Client Mode", so that it acts as a "client" to the family wireless and has a DHCP/DNS server serving the wired connections on the development network. I have changed the subnet mask to from 255.255.255.0 to 255.255.252.0 on the Belkin router and on the DD-WRT. The belkin is on 192.168.2.1 and DD-WRT on 192.168.1.1. Machines on each network can see each other, so if I set a machine on my dev network with a static 192.168.2.x the Belkin will be able to port foward to it.

Diagram Time: enter image description here

I have no idea if m0n0wall is able to forward packets, but subnetting seems to have been the easiest way of going about this.

I can reccomend Wolfram Alpha for easy-to-use subnetting info.

Improve this answer
2
  • If anyone thinks I should be better off re-writing my question please say.
    – tombull89
    Oct 10, 2011 at 15:08
  • 1
    You might want to point out that you'll need to forward the ports on both routers in order to fully point to the Development Web Server.
    – James Mertz
    Mar 20, 2012 at 15:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .