3

I am using BSNL BroadBand connection and a DSL Router is provided that can act as a Default Gateway to many wireless devices. One such device is my server. I have bought a static ip on lease. So that all the traffic on the to that ip directed to the Router.
But to forward the request from the router to the my server (which connected using wifi) requires port forwarding (got help from here). Port forwarding for BSNL DSL Router can be done by going to the VIRTUAL SERVER section of the NAT section. There I have forwarded all the requests on port 8080 (my JBOSS uses port 8080) to the server, which has an internal ip address 192.168.1.7.
I am able to connect to internet from the server (192.168.1.7), all the devices connected to the Router via wifi are able to ping each other. But traffic on port 8080 is not being directed to the server.
What can be the possible reasons for this?

NOTE

I am able to access the server when my request url is http://192.168.1.7:8080/myapp. But When my url is http://118.XXX.XXX.XXX:8080/myapp. I am not able to access it. 118.xxx.xxx.xxx is the public ip of the router.

Improve this question

6 Answers 6

Reset to default
12

It won't work from inside your LAN. It will only work from the rest of the Internet. Here's why:

  1. You try to reach your public IP address from a LAN machine.

  2. The machine sees that the address is outside the LAN and sends the packet to the router.

  3. The router NATs the destination to the LAN machine, but the source address is unmodified (still the LAN machine that originated the request).

  4. Your server receives the request and sends a response to the source of the connection (still the LAN machine).

  5. The LAN machine receives a response from the server, but it was expecting a response from the router (since it connected to the public IP address, it must get a response from the public IP address, not the server's LAN address). Since the reply has the wrong source address, it is not accepted. Oops.

Port forwarding (rewriting the destination address) only works from the outside to the inside, not from the inside to the inside. For that, you need hairpin NAT which rewrites the destination address in addition to the source.

Improve this answer
22
  • This is what I was trying to say but couldn't got together correctly :) A great explanation.
    – Hasan Manzak
    Jul 27, 2012 at 17:52
  • 1
    @David Schwartz : it works! I tried it from a different network. thanks:) . In the previous scenario is the connection terminated during tcp handshake itself? one more doubt - in point 3 you said, "The router NATs the destination to the LAN machine, but the source address is unmodified (still the LAN machine that originated the request)." When the packet has reached the router, isn't it the routers responsibility to change the source address at layer three to the public ip address (since this is the function of NAT)?
    – Ashwin
    Jul 27, 2012 at 18:14
  • 1
    @Ashwin: 1) The TCP handshake will never complete because the source machine will never receive the reply it is expecting. 2) Port forwarding doesn't involve changing the source address, just the destination. When you port forward to a server, the server still sees the unmodified origin IP address for the connections forwarded to it.
    – David Schwartz
    Jul 27, 2012 at 19:37
  • @DavidSchwartz : I think I am still confused. I am trying to access 74.125.236.165 (public ip of google) from one of the devices (forget the server). In this device, during layer 3 encapsulation, the source ip is 192.168.1.5. This is forwarded to the router (which is the default gateway). The router has to hide this private source address. So it functions as a NAT. Doesn't it change this source ip to the public ip of the router? (hiding many private ip's behind on single public ip)
    – Ashwin
    Jul 28, 2012 at 7:43
  • @Ashwin: Yes, of course. But we were talking about port forwarding (inside destination), not masquerading (outside destination). Masquerading changes the source but not the destination. Port forwarding changes the destination and not the source.
    – David Schwartz
    Jul 28, 2012 at 18:49
3

A lot of routers do not allow connections they had forwarded from the local network to its WAN port to traverse back into the LAN (NAT loopback or hairpin). The WAN IP is then inaccessible from inside and you would have to use different addresses to contact the router or the machines to which ports have been forwarded, in your case 192.168.1.7. You can test the port forward from outside. With a web server, the easiest way to do this would probably be to use a proxy such as http://hidemyass.com.

If you want to access the server through a domain name, you will run into the same problem. The DNS servers will direct you towards the public IP address. By editing the hosts files on local machines, you can have them point to the local IP of the server instead, and you would be able to use the same address everywhere.

Improve this answer
1
  1. Check if you are able to access 8080 directly (using your 192.168 IP)
  2. then in your router, forward 8080 to your jboss server 8080, sometimes router itself might be listening on 8080, in such a case, change your port no
Improve this answer
1
  • I am directly able to access 8080 using 192.168.1.7 (my server's ip).
    – Ashwin
    Jul 27, 2012 at 17:25
1

Routers bought from BSNL mostly internally disabled the Port Forwarding facilities. That is , even though you able to see the port forwarding pages and able to set it, the internal lock will block port.

Buy a third party router such as netgear , linksys .. so you can use port forwarding.

Improve this answer
1

2)

It's probably because your router doesn't support NAT lookup. You won't be able to access internal computers using your external IP while in the LAN, but the external IP will work to the rest of the world.

If you want to test a website through external IP, then you can use a proxy. I like Anonymouse, but you can choose from thousands of them at proxy.org.

See Is NAT Loopback on my router a security problem? for some debate on whether NAT lookup is safe or not.

Improve this answer
0

There could be some firewall issues. Some DSL routers may have a firewall in it. Despite port forwarding, sometimes you need to create a rule or completely disable that internal firewall.

Also check the server's firewall. Srin's 1st recommendation points to this, too.

Improve this answer
2
  • see my comment for Srin's first answer.
    – Ashwin
    Jul 27, 2012 at 17:30
  • This is related to routing then. You can't NAT the 118.x.x.x traffic from the lan interface. http://118.XXX.XXX.XXX:8080/myapp traffic have to arrive from wan interface of the router in order to be NATed and forwarded to your server. Have you tested your server from outside?
    – Hasan Manzak
    Jul 27, 2012 at 17:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .