With the original firmware of my router I had port forwarding defined from port 80 to the server in the LAN, which I used in conjunction with an external dynamic DNS service.

I've now upgraded to DD-WRT and alas the port forwarding only works for requests to the external IP from outside the LAN. From inside the LAN I can only access the server by its internal IP.

How can I get the external IP (and thereby the domain name connected to the dynamic external IP) to be properly accessible also from inside the LAN?

I prefer to find out how to achieve it with standard DD-WRT definitions but using e.g. iptables isn't out of the question.


Seems like it's a bug in recent DD-WRT builds.

Use iptables:

iptables -t nat -I POSTROUTING -o br0 -s -d -j MASQUERADE

(change your subnet according to your specific LAN)

From http://hax.at/text/41

|improve this answer|||||
  • That was NOT obvious! worked like a charm :) – Jay Oct 14 '11 at 3:04
  • I set this as a startup command and rebooted the router, but no change — still doesn’t work. – Timwi Mar 11 '12 at 22:57
  • Worked for me. Thank you very much. Now I can access my ddns assigned IP from my internal network on my DD-WRT routers. – nusi May 7 '12 at 0:27
  • 3
    This worked for me, but only if I saved it as the firewall script and not the startup script. – Jarett Millard Jul 29 '12 at 5:00
  • @Timwi - As Jarett mentioned, I too had to put this in the "Firewall" section, not the "Startup" section. – dan_linder Feb 22 '14 at 3:53

In spirit of UrEl's answer: A self-configuring iptables script that can just be copy-pasted without further adaptation can be found on the DD-WRT forum:

insmod ipt_mark 
insmod xt_mark 
iptables -t mangle -A PREROUTING -i ! `get_wanface` -d `nvram get wan_ipaddr` -j MARK --set-mark 0xd001 
iptables -t mangle -A PREROUTING -j CONNMARK --save-mark 
iptables -t nat -A POSTROUTING -m mark --mark 0xd001 -j MASQUERADE 

As noted by Jarett, this has to be used as Firewall script and not as Startup script.

|improve this answer|||||
  • This solution worked for me better than UrEI's one because the latter made my SIP phone unable to connect. – jamix Sep 24 '14 at 10:09
  • What's the difference between this and @UrlEl's rule (besides dynamically getting wan interface and ip address)? – Piotr Dobrogost Feb 20 '17 at 21:23

Try disabling "Filter WAN NAT redirection" in the Security->Firewall tab. From the help description:

Filter WAN NAT Redirection Prevents hosts on LAN from using WAN address of router to contact servers on the LAN (which have been configured using port redirection).

|improve this answer|||||
  • It was already disabled (by default). Any other ideas? – UrEl May 19 '11 at 10:59
  • That is weird - on my LAN, this setting is exactly what makes the difference. Which build are you using? Maybe you should double-check your port forwarding - maybe there's something wrong there that you missed (maybe the IPs have changed between your external and internal access, thus breaking port forwardings?) – Tobias Plutat May 19 '11 at 11:12
  • I'm using 16994. In the mean time I found this: hax.at/text/41 – UrEl May 19 '11 at 11:26
  • Oh, how I love buggy DD-WRT releases! (Establishing a connection from clients used to take ages for some time... until I found out that host names in static leases should only contain alphabetic characters. Arrgh!) – Tobias Plutat May 19 '11 at 11:37

It sounds like your real problem is that you need two views of the DNS A record. Externally your dynamic dns points to your network public IP which forwards port 80 to the local host. All you need to do is add an entry in dnsmasq with an A record pointing the same fully qualified domain name to the local host ip for your local hosts. You can do that by adding the following on the Services page/Additional dnsmasq options:


just replace the xx's with the local ip and the domain name with your domain name. Don't forget the trailing dot or it will append your local domain name to it.

|improve this answer|||||
  • This is what I did, and it works! But is it possible to do this for certain ports? This will only work if you're forwarding ports to a single computer. If you're forwarding ports to multiple computers, it won't work... – rinogo Jun 30 '15 at 19:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.