2

I have a PC running a web server on port 8080, and SSHd running on port 22. In my router settings, I have forwarded port 8080 to 80, and set up an ANAME record on my domain pointing to the public IP. I am able to access my site on both my public IP port 80 and on my domain. However, I am not able to access the port using the private IP, or SSH into the PC. The PC has a static IP configured. How can I fix this?

Edit: per use request, the output of ss -tulpn on the server is:

Netid     State       Recv-Q      Send-Q                               Local Address:Port           Peer Address:Port     Process
tcp       LISTEN      0           128                                        0.0.0.0:22                  0.0.0.0:*         users:(("sshd",pid=799,fd=5))
tcp       LISTEN      0           511                                              *:8443                      *:*         users:(("node",pid=1251,fd=21))
tcp       LISTEN      0           511                                              *:8080                      *:*         users:(("node",pid=1251,fd=20))
tcp       LISTEN      0           128                                           [::]:22                     [::]:*         users:(("sshd",pid=799,fd=7))

And the relevent output of nmap -sV -Pn <server ip> on the client is:

PORT     STATE  SERVICE         VERSION
22/tcp   open   ssh             OpenSSH 8.3 (protocol 2.0)
8080/tcp open   http            Node.js (Express middleware)
8443/tcp open   ssl/http        Node.js (Express middleware)

Edit: network sketch: network

Edit: additional issue, probably should have mentioned earlier: For a short time after booting up the server, I am able to interact with it. However, if I wait more than a few hours, or reboot my laptop, then the server appears dead to my computer.

Edit: Something weird: I set up a continuous ping on the server to the client (in fish, ping <client> & disown), and now I can access the server normally. Don't know what to make of this...

  • 1
    (1) Do you mean by "private IP" the local IP on the local network and you are connecting from within this network? (2) What error are you getting? (3) What are the IPs of the server, the computer trying to connect and the local IP of the router? (4) Try using telnet IP port to connect and report on error if it arrives. – harrymc Aug 3 '20 at 8:25
  • 1
    @dirdi I posted the output of both commands; see above. – sugarfi Aug 3 '20 at 13:50
  • 1
    This sounds quite impossible. You might need to recheck your assumptions. – harrymc Aug 3 '20 at 15:43
  • 1
    Every aspect mentioned in the comments and answers. – harrymc Aug 3 '20 at 15:45
  • 1
    How about client isolation then? Do you have it disabled? – Ondřej Xicht Světlík Aug 4 '20 at 18:27
0

For a standard router, the forwarding only works from the "outside", i.e. where the public IP lives. Therefore you cannot access from inside using the local IP and expected the forwarding to work.

[BTW: You wrote "forwarded 8080 to 80", but in fact it is the other way round, right? You forwarded 80 on the external IP to 8080 on your PC.]

For SSH to work from outside, you need to set up a similar port forwarding. Actually I would recommend to use a non-standard port on the external IP to (at least) reduce the number of attacks a bit.

  • I know that I cannot access non forwarded ports on my private IP. The problem is I cannot access ports 8080 or 22 on the private IP; all ports on the public IP work fine. – sugarfi Aug 3 '20 at 13:36
  • You cannot access the port from within the LAN via the private IP? Ok, but then this has nothing to do with the forwarding rules on the router - right? Sorry if I misunderstand your scenario, but it is not too easy to image without any network scetch or the like. – fratester Aug 3 '20 at 13:49
  • Not really sure what a network sketch is meant to look like, but I'll edit one into the question. – sugarfi Aug 3 '20 at 13:58
  • Host unreachable from a ping? Assuming you got the right private IP, I would recommend to take a look into the firewall rules via iptables -nL and iptables -t nat -nL. What do you see? – fratester Aug 3 '20 at 14:08
  • On the server or client? – sugarfi Aug 3 '20 at 14:10
0

You can not access your site using public IP and domain name as per mention in question. because HTTP uses default port 80 for request and your webserver is running on port 8080. how it's working for you?

Also, you have forwarded 8080 to 80 via router and router forward request to port 80 on private IP, and none of the service running on port 80.

Might you have forwarded port 80 to 8080 and written opposite while typing question?

0

This sounds like you are either not reaching the host or that the firewall on the server with static IP is filtering out the traffic. Could you pleas print your (a) firewall tables on the server, (b) output of ping to the server and could you tell us if you are accessing using hostname or IP address. Please also post the network configuration (topology, gateways and IP addresses) of the sectiom betweem server and client.

0

Not sure how this worked, but I spawned a separate process on the server, pinging the client, and now I am able to access the server normally.

  • This may suggest an ARP-type problem that is being hidden and isn't resolved. It's a very odd thing to need to do... – Attie Aug 5 '20 at 17:19
  • @Attie yeah... I think it either has to do with maintaining a connection between the two or one of the NICs going to sleep. – sugarfi Aug 7 '20 at 2:51
0

To me this sound s like one of two possibilities -

  1. Server or Client PC has been configured to allow the NIC to sleep after a period of no activity

  2. One of the two devices( server or client ) are configured to use DHCP and getting differing IP addresses.

Suggestion - Perform all three tasks below

  1. confirm both devices have those respective NIC configured for STATIC IP

  2. Configure STATIC Route (if needed)

  3. Verify and configure as required so the nics used on each device are set not not use power saving modes and disallow sleep mode.

Best of luck.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.