Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

With the original firmware of my router I had port forwarding defined from port 80 to the server in the LAN, which I used in conjunction with an external dynamic DNS service.

I've now upgraded to DD-WRT and alas the port forwarding only works for requests to the external IP from outside the LAN. From inside the LAN I can only access the server by its internal IP.

How can I get the external IP (and thereby the domain name connected to the dynamic external IP) to be properly accessible also from inside the LAN?

I prefer to find out how to achieve it with standard DD-WRT definitions but using e.g. iptables isn't out of the question.

share|improve this question
add comment

4 Answers

up vote 18 down vote accepted

Seems like it's a bug in recent DD-WRT builds.

Use iptables:

iptables -t nat -I POSTROUTING -o br0 -s 192.168.1.0/24 -d 192.168.1.0/24 -j MASQUERADE

(change your subnet according to your specific LAN)

From http://hax.at/text/41

share|improve this answer
    
That was NOT obvious! worked like a charm :) –  Jay Oct 14 '11 at 3:04
    
I set this as a startup command and rebooted the router, but no change — still doesn’t work. –  Timwi Mar 11 '12 at 22:57
    
Worked for me. Thank you very much. Now I can access my ddns assigned IP from my internal network on my DD-WRT routers. –  nusi May 7 '12 at 0:27
    
This worked for me as well. Thanks! –  cmorse Jul 2 '12 at 14:47
2  
This worked for me, but only if I saved it as the firewall script and not the startup script. –  Jarett Jul 29 '12 at 5:00
show 2 more comments

Try disabling "Filter WAN NAT redirection" in the Security->Firewall tab. From the help description:

Filter WAN NAT Redirection Prevents hosts on LAN from using WAN address of router to contact servers on the LAN (which have been configured using port redirection).

share|improve this answer
    
It was already disabled (by default). Any other ideas? –  UrEl May 19 '11 at 10:59
    
That is weird - on my LAN, this setting is exactly what makes the difference. Which build are you using? Maybe you should double-check your port forwarding - maybe there's something wrong there that you missed (maybe the IPs have changed between your external and internal access, thus breaking port forwardings?) –  Tobias Plutat May 19 '11 at 11:12
    
I'm using 16994. In the mean time I found this: hax.at/text/41 –  UrEl May 19 '11 at 11:26
    
Oh, how I love buggy DD-WRT releases! (Establishing a connection from clients used to take ages for some time... until I found out that host names in static leases should only contain alphabetic characters. Arrgh!) –  Tobias Plutat May 19 '11 at 11:37
add comment

It sounds like your real problem is that you need two views of the DNS A record. Externally your dynamic dns points to your network public IP which forwards port 80 to the local host. All you need to do is add an entry in dnsmasq with an A record pointing the same fully qualified domain name to the local host ip for your local hosts. You can do that by adding the following on the Services page/Additional dnsmasq options:

 address=/www.mydomain.com./xx.xx.xx.xx

just replace the xx's with the local ip and the domain name with your domain name. Don't forget the trailing dot or it will append your local domain name to it.

share|improve this answer
add comment

In spirit of UrEl's answer: A self-configuring iptables script that can just be copy-pasted without further adaptation can be found on the DD-WRT forum:

insmod ipt_mark 
insmod xt_mark 
iptables -t mangle -A PREROUTING -i ! `get_wanface` -d `nvram get wan_ipaddr` -j MARK --set-mark 0xd001 
iptables -t mangle -A PREROUTING -j CONNMARK --save-mark 
iptables -t nat -A POSTROUTING -m mark --mark 0xd001 -j MASQUERADE 

As noted by Jarett, this has to be used as Firewall script and not as Startup script.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.