I've set-up a Raspberry Pi home server attached to my router. I have a dynamic IP. I can access the server within my network using the internal IP ( I can also access the server outside my network using the network's public IP and a noip.com domain I created.

The problem is I can't ssh into the server inside the network using either the public IP address, or the noip.com domain. I can however, strangely, navigate (while on my network) to the noip.com domain in a web browser and it gives me the "It works" default Apache page (this is not due to caching, I've checked on a few devices).

After a bit of Googling, I've found that I need to set up NAT loopback on my router. My router (an ISP-provided one) doesn't seem to support NAT loopback via their web interface, I.e. via

Telnet access is to the router, however, enabled. It runs busybox, and the `iptables' command is available.

I found a command written by a customer on my ISP website's forum: http://www.skyuser.co.uk/forum/sky-router/47273-nat-loopback-dlink-2640s.html

I use putty for telnet but you can use any.

my server is 192.168.0.x (my web server) wan ip is 2.x.x.x (replace with your own) the server port 443 (https for me but you may want that to be different iptables you need 2 commands:

iptables -t nat -A POSTROUTING -d -s -j SNAT --to-source
iptables -t nat -A PREROUTING -d 2.x.x.x -m tcp -p tcp --dport 443 -j DNAT --to-destination 192.168.0.x

you can leave out --dport 443 then it just send all port to your server.

Now the problem is that every time your wan ip changes you have to redo the 2nd command (Anyone know how frequently this happens?) Also you will lose this on rebooting the router.

That section of the second command -- "iptables -t nat -A PREROUTING -d 2.x.x.x" -- containing the public IP address: how do I make it so it just means "the current public IP address"?

If this is possible, will this slow down all requests to the router due to the resolving involved?


iptables resolves to DNS names, so in your rules you can use the noip.com DNS name instead of 2.x.x.x I have this working on my own iptables configuration:

iptables -t nat -A PREROUTING -d whatever.noip.com -m tcp -p tcp --dport 443 -j DNAT --to-destination 192.168.0.x

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.