Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to set up port forwarding for a server behind an Airport Time Capsule that's behind a Comcast Arris modem. I'm trying to avoid changing the Arris modem to bridge mode, and instead using DMZ to solve this problem.

So currently, I have DMZ set up on my Comcast modem to forward to the IP address of my Airport Time Capsule, and then in Airport Utility I set the Enable default host at: option to my local IP address (

But when I try to telnet to port 80 of my external IP address (I have pow running locally), it doesn't return anything.

What can I do to fix this? I can post anything needed.

share|improve this question
up vote 2 down vote accepted

The pow development web server works by installing a firewall rule that redirects connections to to the actual port pow runs on. is the "loopback" IP address that's only accessible from the machine pow runs on. If you want pow to be accessible from other machines, you must edit that rule (or add another rule) in /Library/LaunchDaemons/cx.pow.firewall.plist so that it redirects from port 80 on your host's LAN IP address (, I believe you said) to the port that pow runs on.

Then, make sure that another LAN machine can access your site by going to .

Next, make sure a machine can access your site by going to the WAN IPv4 address of your AirPort Time Capsule. Note: This is NOT your Arris cable modem's public IP address. This is probably a 192.168.x.x address.

Finally, once all of the above are working, try going to your Arris cable modem's public IP address.

Edited to add:
If you use a LAN machine to go to the Arris cable modem's public IP address and it still doesn't work, it may be that your Arris cable modem doesn't do "Hairpin NAT" correctly; that's where a NAT gateway has to take a seemingly outgoing (LAN to WAN) packet, and realize that it actually is for its own public IP address, and that incoming NAT (WAN to LAN) processing needs to happen on the same packet, to get it to the port-mapped server or DMZ.

To see if a lack of hairpin NAT support is your problem, use an external machine to connect to your Arris cable modem's public IP address and see if you can get to your website. There are "web server testing" web apps out there, or you could just turn off Wi-Fi on your smartphone or 3G/4G tablet to force it to use 3G/4G data service, making it an external device.

share|improve this answer
That was a huge help! I actually do have pow accessible already, but the idea to go directly to the Time Machine IP helped me at least figure out which DMZ rules were set correctly. The problem actually is that when I'm behind the Time Capsule on Wi-Fi, I can't access the public IP. My guess is there's some sort of loopback that's causing a problem? – Waynn Lue Mar 4 '14 at 18:20
@WaynnLue I've updated my Answer to also answer your followup question. – Spiff Mar 5 '14 at 0:03
The second part of your edit was actually how I discovered the problem originally -- is there a specific rule to set up in the Arris modem that'll fix this? The other solution I've thought of is to use a local DNS that maps to the internal IP, and a global DNS that maps to the external IP. – Waynn Lue Mar 5 '14 at 1:02
I doubt there's any rule you could set via the web admin UI to fix this. It just means their NAT gateway code sucks. If you had root on that box, and it's running Linux or another embedded Unix, you might be able to add NAT/firewall rules that could fix this. Your split-horizon DNS solution might be your best bet. Just going to the internal IP address directly (without an /etc/hosts or DNS mapping) usually doesn't work, because your web server will usually at some point give you a URL that uses its hostname, which would break without some kind of split-horizon DNS solution. – Spiff Mar 5 '14 at 2:09
I'm actually thinking of setting up file servers or something, since pow actually does work already using, but that's a good point. Thanks again for your help! – Waynn Lue Mar 5 '14 at 6:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .