Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am having an issue where I can't connect to my home-server from my LAN when using the public IP address of the DD-WRT router. I am essentially having the same problem as detailed here: DD-WRT: How to allow port forwarding to apply to requests originating from inside the LAN?; however, none of the solutions provided are working for me. I am fairly certain that I am have modified the correct values for it to apply to my LAN setup. The router is a Netgear WNR834B v2 and it is running DD-WRT v24-sp2 18777. I am using the default IP ( for it and I know that the domain an the port forwards work ordinarily.

EDIT: Got it! I found that I needed to enable Local DNS and use this answer from the linked question.

share|improve this question
If you ssh into the router and manually enter the correct iptables command, what happens? Do you get an error message? Does it work? – David Schwartz Apr 30 '12 at 23:27
I have tried that (w/ telnet). It seems to work (in that I don't get any errors), but it doesn't work when I try connecting. – Matchlighter May 4 '12 at 8:01

1 Answer 1

up vote 2 down vote accepted

DD-WRT is likely not configured for hairpin routing. Connecting to the Public IP from the LAN is usually a bad idea, and you will not be able to identify the connection source. The best option is to connect directly to the desired server from inside the network.

The Shorewall FAQ 2 covers doing configuring the router so that it will work. Shorewall builds an iptables firewall from a set of specification file, so the steps are not the required iptables commands, but map fairly easily to iptables. I believe you should be able to run shorewall-lite on DD-WRT, in which case you will need to build all your firewall in Shorewall rather than the DD-WRT tool.

Using split DNS is far easier and I would recommend that approach. A tool like dnsmasq can provide the necessary internal DNS from a /etc/hosts file. It acts as a caching server for addresses on the Internet. It also provides DHCP, do if you don't run it on your DD-WRT router, you will want to decide which DHCP server to enable. If you have the memory you can install in on DD-WRT as a replacement for the default DHCP server.

EDIT: If you choose to use dnsmasq it is best to set it up as the active DHCP server. If you don't run it on your router, disable DCHP on the routers. Alternatively, use fixed addresses outside the DHCP address range for the servers your want to route to. Using fixed addresses is a good idea for servers anyway. Add the addresses of the servers to the /etc/hosts file on the host running dnsmasq, and restart dnsmasq. If you configure dnsmasq with a domain, you can also lookup DHCP clients by name.

Determine the address of the dnsmasq host. (This should be a private network address like Configure your DHCP server to list this address as the first DNS nameserver. For linux hosts and others with a /etc/resolve.conf file use this address for the first nameserver entry. For other servers with static nameserver entries make this address the first specified address.

DHCP clients will need to have their DNS data updated. Triggering a DHCP renewal should update the data. Many systems have internal DNS caches, so the changes may not be visible immediately. Rebooting clients after all the server configuration has been done should clear all caches and reload DHCP specified configuration.

share|improve this answer
NAT-loopback should show the private IP as the source, shouldn't it? As otherwise, how would there be communication? I'm not in a position to test right now (on my phone). – paradroid May 1 '12 at 1:02
NAT-loopback will show the router's private IP address, rather than the internal user's IP address. – BillThor May 1 '12 at 1:07
One of the solutions in the linked question mentioned dnsmasq, but it didn't work when I tried it. What is the correct way to set it up in DD-WRT? – Matchlighter May 1 '12 at 1:13
You are making it sound like I need an actual server running dnsmasq. If that is so, what is the dnsmasq section in the Services->Services tab about? – Matchlighter May 4 '12 at 8:08
Your DD_WRT can act as the dnsmasq server. If you are port forwarding to a linux/Unix server it can work as well. – BillThor May 6 '12 at 12:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.