0

I'm running a server on my local PC on port 8080. I can go to a browser and do http://localhost:8080 and it works.

I'll refer to my public IP as PUBLIC_IP and private/internal as PRIVATE_IP.

In the browser (running on server PC), I can also do http://PUBLIC_IP:8080 and http://PRIVATE_IP:8080 and both work.

I set up port forwarding in the router software as:

TCP external port 8080 >> internal port 8080 to my PRIVATE_IP device.

When I go to canyouseeme.org and enter my PUBLIC_IP and 8080 - I get:

"Error: I could not see your service on PUBLIC_IP on port (8080)"

I looked at the router logs and see:

[LAN access from remote] from 52.202.215.126:55574 to INTERNAL_IP:8080

I assume 52.202.215.126 is the ip address of canyouseeme.org server.

But it seems to be using port 55574 - instead of 8080. And it also changes on each request.

That's the external port that the router sees right?

But looks like the request is getting to the router - just not to my server - getting blocked?

I've turned firewalls off.

Any help appreciated.

Here's the tcldump logs - running on the server PC - so traffic is getting to the server PC.

Fulls-Mac-mini:conf mini$ sudo tcpdump 'tcp port 8080'
tcpdump: data link type PKTAP
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on pktap, link-type PKTAP (Apple DLT_PKTAP), capture size 262144 bytes
16:08:26.451497 IP ec2-52-202-215-126.compute-1.amazonaws.com.48092 > 192.168.1.12.http-alt: Flags [S], seq 3119124296, win 26883, options [mss 1460,sackOK,TS val 298290090 ecr 0,nop,wscale 7], length 0
16:08:26.451570 IP 192.168.1.12.http-alt > ec2-52-202-215-126.compute-1.amazonaws.com.48092: Flags [S.], seq 449444859, ack 3119124297, win 65535, options [mss 1460,nop,wscale 6,nop,nop,TS val 683632630 ecr 298290090,sackOK,eol], length 0
16:08:27.449719 IP ec2-52-202-215-126.compute-1.amazonaws.com.48092 > 192.168.1.12.http-alt: Flags [S], seq 3119124296, win 26883, options [mss 1460,sackOK,TS val 298290340 ecr 0,nop,wscale 7], length 0
16:08:27.449751 IP 192.168.1.12.http-alt > ec2-52-202-215-126.compute-1.amazonaws.com.48092: Flags [S.], seq 449444859, ack 3119124297, win 65535, options [mss 1460,nop,wscale 6,nop,nop,TS val 683633624 ecr 298290340,sackOK,eol], length 0
16:08:28.453107 IP 192.168.1.12.http-alt > ec2-52-202-215-126.compute-1.amazonaws.com.48092: Flags [S.], seq 449444859, ack 3119124297, win 65535, options [mss 1460,nop,wscale 6,nop,nop,TS val 683634624 ecr 298290340,sackOK,eol], length 0
16:08:29.453652 IP ec2-52-202-215-126.compute-1.amazonaws.com.48092 > 192.168.1.12.http-alt: Flags [S], seq 3119124296, win 26883, options [mss 1460,sackOK,TS val 298290841 ecr 0,nop,wscale 7], length 0
16:08:29.453700 IP 192.168.1.12.http-alt > ec2-52-202-215-126.compute-1.amazonaws.com.48092: Flags [S.], seq 449444859, ack 3119124297, win 65535, options [mss 1460,nop,wscale 6,nop,nop,TS val 683635624 ecr 298290841,sackOK,eol], length 0

My internal IP address is 192.168.1.12

The log is a result of https://www.canyouseeme.org/ using my public ip address + 8080.

When I look at Tomcat logs access file - there's no entry. So either it's refusing connection (and not listing it in the logfile) or it's not getting to Tomcat.

Improve this question
5
  • How did you check whether the request is getting to your server or not? – user1686 Mar 13 '20 at 14:41
  • If I try from outside the local network - no it's not getting there. Looking at the router log file - the fact that the inbound port # is not what I set (i.e. 8080) and it changes - I think is causing it not to match the port-forwarding rule. – dashman Mar 13 '20 at 14:54
  • In the router software - for the log file - I enabled just PORT FORWARDING and attempt a connect from outside and it listed an entry - so I'm assuming it's getting forwarded. But I dont see a log file entry in the server. It's a TOMCAT server. – dashman Mar 13 '20 at 15:02
  • Install a packet capture tool (Wireshark or tcpdump) on the server and check that way. – user1686 Mar 13 '20 at 15:02
  • ok just installed wireshark - i have to figure it out - gonna be a while before I make sense of it. thanks – dashman Mar 13 '20 at 15:27
1

No, the connection attempt is correct.

Each TCP packet has two ports: source and destination, which can also be called local and remote. (So the connections don't go "through" a port; instead they go from one port at the sender, to a possibly different port at the recipient.)

The 'source' port is almost always chosen at random (to ensure that each connection has a unique port pair).

The port you see specified in URLs, port-forwarding rules, etc. is almost always the 'destination' port. (This applies to both the "external" and "internal" ports when doing NAT..) You've forwarded port 8080, and CanYouSeeMe is also making a connection to port 8080 on your side – so that's perfectly fine.

Improve this answer
2
  • Thanks - I tested using my phone on it's own network and I was seeing the same log entries. So I think the port forwarding is working (see above comment) - but the TOMCAT server doesn't seem to be getting it. If I do a in network connection it works. – dashman Mar 13 '20 at 15:06
  • The hosts have to exchange several packets back-and-forth after the log message but before the request is actually sent. You haven't checked what happens in between. So install a packet capture tool on the server and take a look at what it's receiving. Add the tcpdump or Wireshark logs in your main post. – user1686 Mar 13 '20 at 15:10
0

I changed the Tomcat server port to 8081 and it worked!

Not sure why 8080 wasn't working.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.