Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 0 down vote favorite

I have a home lan network which is connected to internet using Dlink DIR-825 router. ISP:s dhcp has given one external ip (eg. 91.154.214.101 which is for security reasons not my true ip) and it can be accessed using external hostname (eg. mydns101.dlinkddns.com which is for security reasons not my true hostname).

I have a port forwarding rule (Dlink router use term Virtual Server), which forwards traffic to port 80 to a local centos6 server which has a local ip 129.168.0.120 (see image below).

I want to access this local server only from my home lan, but using url https://mydns101.dlinkddns.com. Now I can access https://mydns101.dlinkddns.com from everywhere.

How can I restrict access to this server so that it can be accessed only from my home lan (91.154.214.101), but using external address https://mydns101.dlinkddns.com?

I can of course access it by using local ip 129.168.0.120 and not to use any port forwardings, which means that it cannot be accessed from elsewhere, but this way I cannot use external address https://mydns101.dlinkddns.com.

And I can of course restrict access using local server's httpd.conf, but that is not the way I want to use, because the purpose for this home server is to be a 1-1 development server for a live server and I want to use identical httpd.conf:s in both of them. I want to use Dlink Router for restricting access.

Because 91.154.214.101 is my ip, I think allowing access from it and denying access from other ip:s is the way to go. So, I have tested all combinations using Inbound Filters (see http://support.dlink.com/emulators/dir825/Advanced.html#Inbound_Filter):

Name    Action  Remote IP Range      
ALLOW   Allow   0.0.0.0-91.154.214.100, 91.154.214.102-255.255.255.255      
DENY    Deny    0.0.0.0-91.154.214.100, 91.154.214.102-255.255.255.255      
ALLOW2  Allow   91.154.214.101-91.154.214.101       
DENY2   Deny    91.154.214.101-91.154.214.101

and attach those filters into "Virtual Server" forwarding rules this way:

enter image description here

but none of those rules work as desired. They either restrict access from everywhere or allow access from everywhere, which is not the desired behavior.

share|improve this question

1 Answer

up vote 1 down vote accepted

Try adding the wanted translation rule in the hosts file on the client. How this is done will depend on the client OS (/etc/hosts on *nix systems).

If you're using a local DNS you could fix it there, but otherwise you will need to do it on a client basis somehow, and the hosts file should be a global and easy way.

Just add the line

129.168.0.120 mydns101.dlinkddns.com

to each wanted client's hosts and see what happens. Block the web server externally as you described if you don't want external access.

share|improve this answer
This worked! May be this like thing is not possible in router side and have to be done in client's /etc/hosts. Am I right in these three assumptions when those lines are added into client's /etc/hosts: 1) I can remove port forwards in router (because no external access needed and /etc/hosts handles the needed forwarding)? 2) 'mydns101.dlinkddns.com' can be whatever string that is not in public dns servers, because external dns lookup are not made at all? 3) /etc/hosts of the local centos server (named as mydns101.dlinkddns.com) has no need for anything pointing to mydns101.dlinkddns.com? – Timo Mar 6 at 20:35
@Timo: Only the clients that you want to reach the server via that hostname will need the /etc/hosts entry. The hosts file simply "hijacks" the DNS request on the client and takes precedence, so an external DNS server is never consulted. You would not need any external port forwarding in your router, since the requests will stay inside the LAN at all times. – Daniel Andersson Mar 7 at 14:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.