0

I port forwarded different services on the public interface of my router (ports 22, 80, 443). It works fine when I access the services from another public ip.

For example: Computer A (public ip: 1.1.1.2) -> My router (public interface: 1.1.1.3:80) I can access the website correctly on 1.1.1.3:80 from Computer A

My issue is that I cannot access the forwarded ports from any device on the LAN no matter if it's by using the public or private ip address of the router. I always get redirected to the router configuration page (in case of port 80 for port 22 bound to anything).

For example: Computer B (192.168.0.2) -(LAN: 192.168.0.0/24)-> (Private interface: 192.168.0.1) My router (public interface: 1.1.1.3:80) I cannot access the website on 1.1.1.3:80 from Computer B, instead I get the router configuration page.

It seems the router detects I am in the LAN and in that case does not apply the port forwarding rules. I would like to prevent this behavior and be able to reach my services from my router public ip no matter if I am or not in the LAN. Remote service access is disabled on the router (I cannot access the admin interface from another public ip)

Do you know if there is anything to prevent this? I could not find anything relevant.

I appreciate your help. Thank you!

Improve this question
2
  • 1
    This is called nat hairpin, your router most likely doesn't support this feature.
    – Tim_Stewart
    Apr 10, 2021 at 6:12
  • Thank you very much for your reply! I didn't know this feature.
    – Dyde
    Apr 10, 2021 at 7:26

1 Answer 1

Reset to default
0

You have to configure hairpin NAT on your router which is essentially source-NAT in addition to the destination-NAT you already configured.

Unfortunately, I didnt find any manuals of your router in a language that I understand.

Improve this answer
2
  • Thank you for your reply! It seems the router does not support this feature.. I will have to find another way, probably by using different DNS configurations on local and remote.
    – Dyde
    Apr 10, 2021 at 7:35
  • That's certainly an option. If you only have a small number of hosts for which you are willing to create a manual configuration you could add a destination-NAT directly to the hosts. For example, on linux you can achieve that by cresting a DNAT rule in the PREROUTING chain using iptables.
    – jvda
    Apr 10, 2021 at 8:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.