NAT Helper for HTTP

Question

I'd like to expose a Web server available on an intranet (local IP address behind a Firewall + NAT) to another client on Internet or different LAN.

Since I can't do anything on the firewall (ex. port forwarding), my only solution seems to be a NAT-to-NAT as described by UltraVNC.

Does anybody know of a lightweight solution to expose a web server in such a manner?

Answer 1

Lets say your server resides in NetworkWithHttp and client in NetworkWithClient

If Router between those two does NAT for packets traveling from NetworkWithHttp to NetworkWithClient then NetworkWithClient knows nothing about NetworkWithHttp: The whole NetworkWithHttp looks like ONE host (the router) from its point of view.

The easiest way here is to configure port forwarding (aka destination nat, DNAT) but you do not have access to router, right?

If NetworkWithClient is not behind the NAT -- you can create VPN server there (any modern PC OS and many hardware routers support this) and connect server from your NetworkWithHttp to this VPN server.

In other case you need VPN server somewhere in the third place where both networks had access.

NH is an example of such service. It is not VPN but it can forward traffic between client and server.

Answer 2

Sounds like you want to expose a service from a (for example) 10.0.0.0/8 network to another 10.0.0.0/8 network across the internet, with NAT working on both ends.

Unless your network administrator has forwarded specific ports to your internal IP, there is no way you are able to receive incoming connections from hosts outside the LAN. Your host must initiate all connections outside of the LAN for any communication to take place outside of the LAN. Since this is true on both sides, you both are pretty stuck in this regard.

There is one exception: if both you and the other party connect to a third-party VPN service, that will tunnel your connections, then it can work. OpenVPN can be setup this way on a VPS or other accessible location - both your host and the remote host will connect to the OpenVPN instance. Since a connection, initiated by both hosts, exists to the VPN server, and the VPN server will be forwarding traffic between hosts (acting as a router) within the tunnel, you can then accept incoming connections OVER the tunneled, "virtual" network.

OpenVPN is fairly lightweight but it requires a some knowledge to setup (especially if you want to use encryption), and obviously needs to be running in a separate location accessible to both hosts. I'm not sure if something "turnkey" like Hamachi VPN will work in the same way.

I suggest OpenVPN because it uses either TCP or UDP, at your option. A Windows (or Linux) server with PPTP services running could also be used, if either router aren't perchance blocking outgoing GRE traffic. Not sure how involved PPTP server setup is on Windows.