Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am using BSNL BroadBand connection and a DSL Router is provided that can act as a Default Gateway to many wireless devices. One such device is my server. I have bought a static ip on lease. So that all the traffic on the to that ip directed to the Router.
But to forward the request from the router to the my server (which connected using wifi) requires port forwarding (got help from here). Port forwarding for BSNL DSL Router can be done by going to the VIRTUAL SERVER section of the NAT section. There I have forwarded all the requests on port 8080 (my JBOSS uses port 8080) to the server, which has an internal ip address 192.168.1.7.
I am able to connect to internet from the server (192.168.1.7), all the devices connected to the Router via wifi are able to ping each other. But traffic on port 8080 is not being directed to the server.
What can be the possible reasons for this?

NOTE

I am able to access the server when my request url is http://192.168.1.7:8080/myapp. But When my url is http://118.XXX.XXX.XXX:8080/myapp. I am not able to access it. 118.xxx.xxx.xxx is the public ip of the router.

share|improve this question

6 Answers 6

up vote 4 down vote accepted

It won't work from inside your LAN. It will only work from the rest of the Internet. Here's why:

  1. You try to reach your public IP address from a LAN machine.

  2. The machine sees that the address is outside the LAN and sends the packet to the router.

  3. The router NATs the destination to the LAN machine, but the source address is unmodified (still the LAN machine that originated the request).

  4. Your server receives the request and sends a response to the source of the connection (still the LAN machine).

  5. The LAN machine receives a response from the server, but it was expecting a response from the router (since it connected to the public IP address, it must get a response from the public IP address, not the server's LAN address). Since the reply has the wrong source address, it is not accepted. Oops.

Port forwarding (rewriting the destination address) only works from the outside to the inside, not from the inside to the inside. For that, you need hairpin NAT which rewrites the destination address in addition to the source.

share|improve this answer
    
This is what I was trying to say but couldn't got together correctly :) A great explanation. –  The_aLiEn Jul 27 '12 at 17:52
1  
@David Schwartz : it works! I tried it from a different network. thanks:) . In the previous scenario is the connection terminated during tcp handshake itself? one more doubt - in point 3 you said, "The router NATs the destination to the LAN machine, but the source address is unmodified (still the LAN machine that originated the request)." When the packet has reached the router, isn't it the routers responsibility to change the source address at layer three to the public ip address (since this is the function of NAT)? –  Ashwin Jul 27 '12 at 18:14
1  
@Ashwin: 1) The TCP handshake will never complete because the source machine will never receive the reply it is expecting. 2) Port forwarding doesn't involve changing the source address, just the destination. When you port forward to a server, the server still sees the unmodified origin IP address for the connections forwarded to it. –  David Schwartz Jul 27 '12 at 19:37
    
@DavidSchwartz : I think I am still confused. I am trying to access 74.125.236.165 (public ip of google) from one of the devices (forget the server). In this device, during layer 3 encapsulation, the source ip is 192.168.1.5. This is forwarded to the router (which is the default gateway). The router has to hide this private source address. So it functions as a NAT. Doesn't it change this source ip to the public ip of the router? (hiding many private ip's behind on single public ip) –  Ashwin Jul 28 '12 at 7:43
    
@Ashwin: Yes, of course. But we were talking about port forwarding (inside destination), not masquerading (outside destination). Masquerading changes the source but not the destination. Port forwarding changes the destination and not the source. –  David Schwartz Jul 28 '12 at 18:49

2)

It's probably because your router doesn't support NAT lookup. You won't be able to access internal computers using your external IP while in the LAN, but the external IP will work to the rest of the world.

If you want to test a website through external IP, then you can use a proxy. I like Anonymouse, but you can choose from thousands of them at proxy.org.

See Is NAT Loopback on my router a security problem? for some debate on whether NAT lookup is safe or not.

share|improve this answer

Routers bought from BSNL mostly internally disabled the Port Forwarding facilities. That is , even though you able to see the port forwarding pages and able to set it, the internal lock will block port.

Buy a third party router such as netgear , linksys .. so you can use port forwarding.

share|improve this answer

A lot of routers do not allow connections they had forwarded from the local network to its WAN port to traverse back into the LAN (NAT loopback or hairpin). The WAN IP is then inaccessible from inside and you would have to use different addresses to contact the router or the machines to which ports have been forwarded, in your case 192.168.1.7. You can test the port forward from outside. With a web server, the easiest way to do this would probably be to use a proxy such as http://hidemyass.com.

If you want to access the server through a domain name, you will run into the same problem. The DNS servers will direct you towards the public IP address. By editing the hosts files on local machines, you can have them point to the local IP of the server instead, and you would be able to use the same address everywhere.

share|improve this answer

There could be some firewall issues. Some DSL routers may have a firewall in it. Despite port forwarding, sometimes you need to create a rule or completely disable that internal firewall.

Also check the server's firewall. Srin's 1st recommendation points to this, too.

share|improve this answer
    
see my comment for Srin's first answer. –  Ashwin Jul 27 '12 at 17:30
    
This is related to routing then. You can't NAT the 118.x.x.x traffic from the lan interface. http://118.XXX.XXX.XXX:8080/myapp traffic have to arrive from wan interface of the router in order to be NATed and forwarded to your server. Have you tested your server from outside? –  The_aLiEn Jul 27 '12 at 17:40
  1. Check if you are able to access 8080 directly (using your 192.168 IP)
  2. then in your router, forward 8080 to your jboss server 8080, sometimes router itself might be listening on 8080, in such a case, change your port no
share|improve this answer
    
I am directly able to access 8080 using 192.168.1.7 (my server's ip). –  Ashwin Jul 27 '12 at 17:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.