Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a problem with my ISP. They say that they don't block any ports and I have public IP, while I think these both statements are false. Before I talk to them again (which is really tough when my understanding of these terms is different than theirs) I would like to make some things clear.

It seems like my computer is behind NAT (is it possible to have public IP and be behind NAT at the same moment?). When I check my IP, through some external server, and type that IP into browser I get a home page of some router (not mine). Isn't that a proof that my IP isn't public?

Also, I have problems with making connections via some ports. E.g. when I'm trying to connect through some high port (> 1023) via SSH, it doesn't work. Is it possible that certain range of outgoing ports from my computer are blocked? Or is it simply because that my ssh client (PuTTY) can't receive incoming packets because of blocked incoming ports?

To avoid some questions: it's not a problem with my router, I tried connecting my PC directly and it also didn't work, while having connected by 3G using phone with USB tethering, it does work. Thanks!

share|improve this question
Are you sure your issues are not firewall related? – Dave Sep 4 '12 at 14:14
Yes, I'm sure. It works when I use the Internet from plugged phone with 3G. – user1646166 Sep 4 '12 at 14:17
I think that router you think isn't yours actually is yours. (Perhaps you have more than one or you have a modem with a router build in and also a router.) – David Schwartz Sep 4 '12 at 14:19
Can you try to disable the firewall on the router (if it is on). Since tethering via 3G doesn't use the router, this is just one more thing to check. Also, I just did a post about someone having a WAN facing router - can you make sure WAN access is disabled please? Or, name your router a unique name, check it again via a browser with the external IP to test edit As per David's suggestion who beat me by 3 seconds :) – Dave Sep 4 '12 at 14:19
I think @David is correct. You're hitting your modem's config page. When you call your ISP again, I think you want to ask them for a bridged modem. That is, you want whatever device you have behind the modem (your router most likely) to land the real world IP address. If your modem is landing the real world and NATing, then you're dealing with a double-NAT and the ports would need to be opened on both the modem and the router. Ugh... overly complicated. Either bridge the modem, or do your port config on the actual modem. – JoshP Sep 4 '12 at 14:24

my understanding of these terms is different than theirs

OK, lets try to clarify the relevant terms.

I would like to make some things clear … is it possible to have public IP and be behind NAT at the same moment?

Public IP

Everybody with an internet connection has a "public IP" that is an IP-address which is visible to the general public.

This public IP-address is sometimes referred to as an external IP-address. It is usually allocated to your router by your ISP.

It can be dynamic or static. Some ISPs charge more for a static addrsss. Dynamic ones are allocated from a pools, in this case your public IP-address can change from time to time


Traditional IP addresses are IP version 4 addresses. These are running out. To stave-off address exhaustion, some ranges were reserved for private use (e.g. and Network Address Translation (NAT) was invented so that a router could edit (translate) addresses in IP packets and change a private IP-address to a public one. That way a business or home with tens or thousands of computers could all share a single public IP-address.

So yes, most people have a public IP-address and are behind NAT.

is it simply because that my ssh client (PuTTY) can't receive incoming packets because of blocked incoming ports?

Outbound connections

TCP connections are started by a client sending a packet to a server (as part of a "three-way handshake"). The router sees this packet, edits the from-address and keeps a note in an internal list of connections of the internal source IP-address, source port and translated source port (it has to cope with two PCs both using the same source port getting their source IP-address translated to the same public IP-address). Since it keeps track of connections, when the router receives reply packets it can work out which internal PC to forward the (edited) packets on to.

So no, replies to an outbound SSH connection should not be blocked.

connections initiated from the outside are a different matter:

Inbound connections

When the router receives an inbound request to create a connection on a specific port (e.g. 80) - if it doesn't provide a service on that port itself (e.g. router admin interface) it won't know what to do and will refuse the connection.

Port forwarding

If you want friends, random strangers (and criminals) to have access to your PC, you can tell the router that when it receives a connection request on port n to forward that request to one of your computers.

share|improve this answer
Some ISP's put you behind their firewall, which blocks most ports, i had this issue with one of my isp's years back, I called and requested a "public ip" for a few $$ more a month, then my port forwarding worked. – Moab Sep 4 '12 at 14:15
@Moab. I've heard of ISP blocking inbound ports (connections initiated from outside) but not of them blocking outbound SSH connections. Horrid! – RedGrittyBrick Sep 4 '12 at 14:33
Only encountered this once in my life, it was a wifi isp service out in the boonies. – Moab Sep 4 '12 at 14:46

When you connected your PC directly WITHOUT your router in the middle, what IP address did you get from your ISP?

If it's in one of the "private" IP ranges - 10.X.X.X, 192.168.X.X, or 172.[16-32].X.X (would probably be 10.X.X.X) - then your ISP has you behind some sort of NAT.

If you get any other address WITHOUT your router in the middle, then you are very likely NOT behind an ISP NAT.

If you are getting a "normal" address WITHOUT your router in the middle, then you're getting a publicly accessible address from your ISP. Failure to connect is then caused by a misconfiguration on your end or your ISP blocking ports.

Typically the only ports ISPs block outgoing are DHCP, Windows file sharing, and SMTP ports.

Blocking incoming ports is a different matter. Some draconian ISPs may indeed block incoming connections on most ports unless you upgrade to a business tier account. However, it's unlikely your ISP would lie to you - although you may have reached an untrained customer service representative when you last contacted them. It may be helpful to do some googling on your ISPs name and see what other customer experiences are like regarding blocked ports.

You can't "connect to" an SSH client (such as PuTTY), your SSH client needs to connect to an SSH server. If you aren't running an SSH server, then that could be a cause why what you are trying to do won't work. If this is a Windows system and you want to quickly set up a test SSH server, look into MobaSSH. Make sure you also open port 22 TCP on the Windows Firewall via the Control Panel.

share|improve this answer

see this answer It explains all your doubts. when you point to your public IP address and you get a router configuration page that's your router... when you set port forwarding you will get the right http server.

share|improve this answer
I don't see how your linked answer is relevant to the question. You have a fine explanation of NAT there, but this OP seems quite familiar with the concept of NATing. Also, setting port forwarding on a router that is behind an unbridged modem will not "get the right http server." – JoshP Sep 7 '12 at 12:36
the OP question tells me he is not really familiar with NAT and publics IPs and besides that I do not have to waste my time explaining you why my answer is 100% valid even if it is not a correct one. – Pat Sep 7 '12 at 12:42
my answer is 100% valid even if it is not a correct one What does that mean? – JoshP Sep 7 '12 at 12:58
A valid answer is the one that fits the site requirements; from valid answers is the OP who decides the right one or best one available. Over and out. – Pat Sep 7 '12 at 15:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.