I have a home lan network which is connected to internet using Dlink DIR-825 router. ISP:s dhcp has given one external ip (eg. which is for security reasons not my true ip) and it can be accessed using external hostname (eg. mydns101.dlinkddns.com which is for security reasons not my true hostname).

I have a port forwarding rule (Dlink router use term Virtual Server), which forwards traffic to port 80 to a local centos6 server which has a local ip (see image below).

I want to access this local server only from my home lan, but using url https://mydns101.dlinkddns.com. Now I can access https://mydns101.dlinkddns.com from everywhere.

How can I restrict access to this server so that it can be accessed only from my home lan (, but using external address https://mydns101.dlinkddns.com?

I can of course access it by using local ip and not to use any port forwardings, which means that it cannot be accessed from elsewhere, but this way I cannot use external address https://mydns101.dlinkddns.com.

And I can of course restrict access using local server's httpd.conf, but that is not the way I want to use, because the purpose for this home server is to be a 1-1 development server for a live server and I want to use identical httpd.conf:s in both of them. I want to use Dlink Router for restricting access.

Because is my ip, I think allowing access from it and denying access from other ip:s is the way to go. So, I have tested all combinations using Inbound Filters (see http://support.dlink.com/emulators/dir825/Advanced.html#Inbound_Filter):

Name    Action  Remote IP Range      
ALLOW   Allow,      
DENY    Deny,      
ALLOW2  Allow       
DENY2   Deny

and attach those filters into "Virtual Server" forwarding rules this way:

enter image description here

but none of those rules work as desired. They either restrict access from everywhere or allow access from everywhere, which is not the desired behavior.

1 Answer 1


Try adding the wanted translation rule in the hosts file on the client. How this is done will depend on the client OS (/etc/hosts on *nix systems).

If you're using a local DNS you could fix it there, but otherwise you will need to do it on a client basis somehow, and the hosts file should be a global and easy way.

Just add the line mydns101.dlinkddns.com

to each wanted client's hosts and see what happens. Block the web server externally as you described if you don't want external access.

  • This worked! May be this like thing is not possible in router side and have to be done in client's /etc/hosts. Am I right in these three assumptions when those lines are added into client's /etc/hosts: 1) I can remove port forwards in router (because no external access needed and /etc/hosts handles the needed forwarding)? 2) 'mydns101.dlinkddns.com' can be whatever string that is not in public dns servers, because external dns lookup are not made at all? 3) /etc/hosts of the local centos server (named as mydns101.dlinkddns.com) has no need for anything pointing to mydns101.dlinkddns.com? Mar 6, 2013 at 20:35
  • @Timo: Only the clients that you want to reach the server via that hostname will need the /etc/hosts entry. The hosts file simply "hijacks" the DNS request on the client and takes precedence, so an external DNS server is never consulted. You would not need any external port forwarding in your router, since the requests will stay inside the LAN at all times. Mar 7, 2013 at 14:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .