0

I'm trying to set up port forwarding for a server behind an Airport Time Capsule that's behind a Comcast Arris modem. I'm trying to avoid changing the Arris modem to bridge mode, and instead using DMZ to solve this problem.

So currently, I have DMZ set up on my Comcast modem to forward to the IP address of my Airport Time Capsule, and then in Airport Utility I set the Enable default host at: option to my local IP address (10.0.1.10).

But when I try to telnet to port 80 of my external IP address (I have pow running locally), it doesn't return anything.

What can I do to fix this? I can post anything needed.

1 Answer 1

2

The pow development web server works by installing a firewall rule that redirects connections to 127.0.0.1:80 to the actual port pow runs on. 127.0.0.1 is the "loopback" IP address that's only accessible from the machine pow runs on. If you want pow to be accessible from other machines, you must edit that rule (or add another rule) in /Library/LaunchDaemons/cx.pow.firewall.plist so that it redirects from port 80 on your host's LAN IP address (10.0.1.10, I believe you said) to the port that pow runs on.

Then, make sure that another LAN machine can access your site by going to http://10.0.1.10/ .

Next, make sure a machine can access your site by going to the WAN IPv4 address of your AirPort Time Capsule. Note: This is NOT your Arris cable modem's public IP address. This is probably a 192.168.x.x address.

Finally, once all of the above are working, try going to your Arris cable modem's public IP address.

Edited to add:
If you use a LAN machine to go to the Arris cable modem's public IP address and it still doesn't work, it may be that your Arris cable modem doesn't do "Hairpin NAT" correctly; that's where a NAT gateway has to take a seemingly outgoing (LAN to WAN) packet, and realize that it actually is for its own public IP address, and that incoming NAT (WAN to LAN) processing needs to happen on the same packet, to get it to the port-mapped server or DMZ.

To see if a lack of hairpin NAT support is your problem, use an external machine to connect to your Arris cable modem's public IP address and see if you can get to your website. There are "web server testing" web apps out there, or you could just turn off Wi-Fi on your smartphone or 3G/4G tablet to force it to use 3G/4G data service, making it an external device.

5
  • That was a huge help! I actually do have pow accessible already, but the idea to go directly to the Time Machine IP helped me at least figure out which DMZ rules were set correctly. The problem actually is that when I'm behind the Time Capsule on Wi-Fi, I can't access the public IP. My guess is there's some sort of loopback that's causing a problem?
    – Waynn Lue
    Mar 4, 2014 at 18:20
  • @WaynnLue I've updated my Answer to also answer your followup question.
    – Spiff
    Mar 5, 2014 at 0:03
  • The second part of your edit was actually how I discovered the problem originally -- is there a specific rule to set up in the Arris modem that'll fix this? The other solution I've thought of is to use a local DNS that maps to the internal IP, and a global DNS that maps to the external IP.
    – Waynn Lue
    Mar 5, 2014 at 1:02
  • I doubt there's any rule you could set via the web admin UI to fix this. It just means their NAT gateway code sucks. If you had root on that box, and it's running Linux or another embedded Unix, you might be able to add NAT/firewall rules that could fix this. Your split-horizon DNS solution might be your best bet. Just going to the internal IP address directly (without an /etc/hosts or DNS mapping) usually doesn't work, because your web server will usually at some point give you a URL that uses its hostname, which would break without some kind of split-horizon DNS solution.
    – Spiff
    Mar 5, 2014 at 2:09
  • I'm actually thinking of setting up file servers or something, since pow actually does work already using xip.io, but that's a good point. Thanks again for your help!
    – Waynn Lue
    Mar 5, 2014 at 6:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .