I realise that this may be better suited to ServerFault, but this is my home network that I run in a non-professional enviroment.

At home I have my main router connected to the internet which the main family computer and laptop run from. I also have a "development" network with a m0n0wall firewall in a VM to provide internet services. I want to host a website (and eventually other services) on one of the machines on the dev network but cannot figure out how to "port forward" through my main (belkin) router, through to the m0n0wall firewall, and then through to webserver.

The traffic would have to come through the public ip, pass through port 80 of the main router ( then be forwared through the WAN connection of the m0n0wall box (, out of the LAN connection ( and finally into the server. After the configuration is saved I can't work out while it is not working. I can host the site fine behind the main router. There is a firewall rule on m0n0wall to pass port 80 traffic from through but it just isn't working.

I've drawn a very basic diagram below (unfortunately any advanced Visio stuff is currently black magic to me).

enter image description here

  • 1
    small networking questions for personal use are on-topic – James Mertz Aug 23 '11 at 16:05
  • Are you able to access the web server from your family machine? I think you need to get that working first. Once that is working, then getting the belkin working should be easy. – Zoredache Aug 23 '11 at 16:12
  • What does your firewall rule in the m0n0wall look like? – MaQleod Aug 23 '11 at 16:15
  • @MaQleod - i.stack.imgur.com/sFCoJ.png. – tombull89 Aug 23 '11 at 16:22
  • @Zoredache - no. looks like I'll start there. – tombull89 Aug 23 '11 at 16:22
  1. A separate IP range is unnecessary, this will work without it as the firewall sits between the cables.

  2. Your main router should forward to the web server and not to the firewall.

  3. Your firewall should accept any source address, the main router does not overwrite source address.

    This also allows access from your family machine.

  4. Your firewall should also allow traffic going to the other side.

  5. Use Can You See Me and Wireshark for more detailed troubleshooting.

  • Thanks, Tom. The Belkin has a netmask, so it doesn't even give me the option to portforward to (the 192.168.2 bit is hardcoded in) so how can I forward it to the webserver directly? – tombull89 Aug 23 '11 at 16:28
  • I think I may have overestimated my ip addressing abilites... – tombull89 Aug 23 '11 at 16:29
  • 1
    @tombull: Another option is to explicitly forward the port 80 traffic from the external IP of the firewall to the IP of the web server in the firewall config, but I don't know if M0n0wall can do this. Putting everything in the same IP range could solve this problem... – Tamara Wijsman Aug 23 '11 at 16:37
  • @tombull: If M0n0wall cannot forward packets, thenyou are going to need to put them all in the same subnet or have some kind of DNS service running, otherwise the Belkin router will have no idea where the webserver is. – surfasb Aug 23 '11 at 21:36

Right, I have finally worked this out and got it as I wanted. Instead of the m0n0wall box forwarding packets twice I've moved to changed subnets. I now have a DD-WRT-based Linksys E1000 acting in "Client Mode", so that it acts as a "client" to the family wireless and has a DHCP/DNS server serving the wired connections on the development network. I have changed the subnet mask to from to on the Belkin router and on the DD-WRT. The belkin is on and DD-WRT on Machines on each network can see each other, so if I set a machine on my dev network with a static 192.168.2.x the Belkin will be able to port foward to it.

Diagram Time: enter image description here

I have no idea if m0n0wall is able to forward packets, but subnetting seems to have been the easiest way of going about this.

I can reccomend Wolfram Alpha for easy-to-use subnetting info.

  • If anyone thinks I should be better off re-writing my question please say. – tombull89 Oct 10 '11 at 15:08
  • 1
    You might want to point out that you'll need to forward the ports on both routers in order to fully point to the Development Web Server. – James Mertz Mar 20 '12 at 15:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.