The setup:

Router: TomatoUSB running on a RTN16 router is forwarding several ports to my Server.

Server: Windows Server 2012 is host to several VirtualBox Ubuntu VMs.

One VM, using NAT works great.

Another VM, using Bridged, works great on the internal network.

However, when I try to access the same location from the external network I am presented with the site hosted in IIS instead of my VM.


Change is not an option, this is about learning, not giving up.

I have considered the possibility that TomatoUSB is the culprit but do not have the technical expertise to prove it so if you can explain how it's at fault, that's a valid answer.

Tomato is configured to forward external port 8081 to internal port 80 on the Bridged IP (, and so what I'm seeing is that port 8081 is giving me port 80 on the Server's IP (

Per the comments, I attempted a ping to from the bridged VM which returned fine, about 40ms response each time.

Per a request, here's a screenshot of the port forwarding screen on my TomatoUSB. enter image description here

The screenshot tells what I have tested to be true. If I shut off the VM, then try to target port 8081 the site is not found. No redirection. So Tomato is pointing at the right IP. The culprit here is definitely bridged networking, either from the Router's perspective or the VMs.

For further clarification, Tomato clearly shows both the server box and the bridged VM with separate IPs and separate MAC Addresses. Here is another screenshot. enter image description here

I've tested further per IRC. I disabled the NAT VM's port forwarding and the result was unchanged. This is further evidence that Tomato is at fault, and not VirtualBox.


I ran fiddler from a machine trying to access port 8081 and it shows the response header as a 301 redirect. This seems to be an after effect. I'm guessing 8081 is actually what's being sent to the Server IP ( and IIS is redirecting to 80.

I have pcap files.

  • What are the IP addresses involved^ The internal ones. – MariusMatutiae Feb 7 '14 at 6:16
  • @MariusMatutiae edited, added IPs for ya – deltree Feb 7 '14 at 6:17
  • From the bridged VM, can you go to the Internet? Can you ping, for instance? – MariusMatutiae Feb 7 '14 at 6:21
  • @MariusMatutiae yes, added results to question – deltree Feb 7 '14 at 6:23
  • 1
    I don't use Tomato, but your rules seem correct on first sight (although too broad). I found via google multiple similar complaints for Tomato, although some have managed to force it to work. As port-forwarding is pure software and nothing to do with hardware, it would maybe be simpler to try with the latest Asus firmware as probably having the most efficient usage of the hardware. If you need advanced router firmware, I believe more in DD-WRT. – harrymc Feb 14 '14 at 12:41

As it stands the answer to this question is difficult to find: we do not have a culprit yet, let alone a remedy.

Can you run tcpdump on both the router and the VM? It would be helpful if you could just confirm that packets are leaving/reaching the router/server (if they do), but you could also check the destination of the packet leaving the Tomato router to confirm it is intended for

The commands to use are simple: on the router,

   tcpdump -i any -nn dst and port 80

while on the VM

   sudo tcpdump -i any -nn port 80

In the meantime, from some other pc/shell, try to access port 8081. This way you should get a good idea of the flow of packets. I am not sure the Windows firewall is still off the hook, as a suspect.

If you cannot see anything leaving the router, relax the conditions on the command by issuing instead

   tcpdump -i any -nn port 80
  • sure thing. I'll run tcpdump tonight. – deltree Feb 18 '14 at 18:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.