Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a weird port forwarding problem. I tried to open my port 22 to the outside network. I was able to access it as long as I am not inside the LAN. I can access it from my office for example. But from within the LAN, I can access the port using the local ip, but I can't access the port using the external IP. It's as if the router is blocking the loopback. I've check all my router settings, turned off anything firewall/filtering related. Any ideas?

share|improve this question
add comment

5 Answers

up vote 3 down vote accepted

Assuming Spiff is correct, and your router can't handle port forwarding to the external ip from within the network there is a small work around (and it does sound like this is the case);

You can edit the hosts file, which can be found at /etc/hosts in most unix-systems and in C:\Windows\system32\drivers\etc\ on Windows.

if you add

192.168.0.15  example.com

in that file, your computer will go to the ip spesified whenever you try to access example.com. You will of course have to do this on every computer that you wish to use within the network.

You can check the wikipedia article for more details on where to find it: http://en.wikipedia.org/wiki/Hosts_file

share|improve this answer
add comment

Given that you mentioned port forwarding, I assume your home gateway is acting as a NAT -- or more specifically NAPT -- gateway. What you're trying to do is called "hairpin NAT" or "NAT hairpinning", in reference to the way a literal hair pin doubles back on itself (the same allusion is used by the term "hairpin turn" for a sharp bend where a road doubles back on itself).

Some NAT gateways are crap and don't support hairpinning. It may be time to explore your upgrade options.

share|improve this answer
    
This is a pretty new router so I doubt that's the problem. –  erotsppa Apr 28 '10 at 2:11
3  
"New" doesn't mean "high quality". There's always plenty of crap on the market at any given time. –  Spiff Apr 28 '10 at 3:30
add comment

From what I understand from running an OpenBSD router with NAT, Spiff is correct in his response: the problem you are experiencing is caused by the NAT gateway not supporting what you're trying to do.

Your workstation is sending packets with a source IP of an internal address (say, 10.0.0.2), but the destination address is your exernal IP. When the packets arrive at your (SSH?) server on port 22, the server replies to your workstation directly and there's no NAT happening; now, when your workstation gets a reply from 10.0.0.3 when it was expecting a reply from your external address, it drops the packets.

It seems like a trivial issue at hand, but it can be resolved by updating your workstation's HOSTS file, adding an internal DNS server (or editing the DNS server's entries), or creating a NAT rule to handle the internal->external->internal traffic.

share|improve this answer
add comment

There is a real simple answer to this one. The NAT is getting in the way.

  1. Your computer opens a connection to [ExternalIP]
  2. Your Router forwards that connection to [SSHInternalIP]. Your SSH server sees a connection from [YourInternalIP].
  3. Your SSH server sends its packets to [YourInternalIP].
  4. Your computer sees a strange packet coming from an IP it never talked to and discards it.
  5. Your connection to TCP/22 fails because the TCP 3-way handshake never completes.

You're trying to talk to a Public IP, but the replies are coming from an internal IP. Your computer can't make the two work together. The solution is to use the Internal IP whenever you're behind the router. I work around this problem on my laptops by using different ssh connection strings depending on where I am.

share|improve this answer
add comment

Read this. Think it'll help you to understand the problem.

share|improve this answer
    
At least summarise and quote the link. –  random Apr 28 '10 at 8:09
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.