I have a host on 192.1681.6 NATed behind my router public IP address X.X.X.X The router is a Huawei HG658. I can access the router page X.X.X.X from my phone on separate network. that is serving a web page on port 8081. From within internal network I am able to browse the page on successfully.

I want to make this page accessible to the outside world on X.X.X.X:8081

I have set up the router as per configuration page:

Protocol: TCP/UDP
Remote host: empty / any host
External start port: 8081
External end port: 8081
Internal host:
Internal port: 8081
Mapping name: test

At the moment, browsing to X.X.X.X:80 works for the router title page but X.X.X.X:8081 just displays connecting message until timing out. An nmap scan shows the port as filtered.

    Nmap scan report for XXX-XXX-X-X.ma.de (X.X.X.X)
    Host is up (0.0016s latency).
    8081/tcp filtered blackice-icecap

    Read data files from: /usr/bin/../share/nmap
    Nmap done: 1 IP address (1 host up) scanned in 0.37 seconds
               Raw packets sent: 6 (240B) | Rcvd: 1 (28B)

I turned off webserver and ran nc an listener and that seems fine but still no luck.

netstat -anutp | grep 8081
tcp        0    0*  LISTEN      28062/nc 

I believe current router and host settings are fine but can't seem to find the issue. Please let me know if I've missed anything or need to clarify.

  • is there any firewall installed ? – Manoj Purohit Sep 7 '16 at 9:18
  • I agree, its almost certainly your router's WAN facing firewall. What router are you using? – Argonauts Sep 7 '16 at 11:25
  • @Argonauts Thanks guys, I have updated the firewall make and model in the body. There is no firewall installed and the router firewall level is turned to off when testing. I have also tried different combinations of external and internal ports in the config. – user1330734 Sep 7 '16 at 22:57
  • I'm assuming you ran nmap from a remote PC (i.e. over the internet)? Try (temporarily) configuring the router to treat the IP address of the web server as a DMZ (wide open to the internet - no security) - via the router's web interface it's configured by following following these links Internet -> network security -> DMZ The other option is that the port is filtered by your ISP. You can try using different ports to evaluate that; you only need to change it on the router, just have the router forward it to the original port on the NAT'd web server – Argonauts Sep 8 '16 at 0:11
  • @Argonauts I added the internal IP to the DMZ as suggested and tried several different ports but no success. Also checked around online, fairly confident the ISP does not block ports. – user1330734 Sep 8 '16 at 10:54

Router: Huawei HG658 Settings to allow port forwarding (current settings working):

Advanced/NAT/DMZ/ - DMZ Disabled

Advanced/NAT/Port Forwarding
As in question above

Safety note: I suggest allowing admin access to the router from the internal network only. By default, this was ON for WAN access on my router.

Go to:
1. Advanced/ACL
2. Ensure HTTP and HTTPS 'Service Type' entries have 'Access Direction' attribute set to LAN only. Read 'Access Direction' as 'Access From' (the English on the router's pages is a little poor :( ).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.