Who is blocking external IP access behind NAT?

M

mk76

Guide
I am trying to test web server setup on raspi-3. Installed Apache, changed port, set up port forwarding in router (N66U).
- Server is up and accessible from LAN
- External sites show port is open
All good till here.

However, when I try to access my web server, it times out. Came across a post where someone suggested using vpn ... and it works.

So what blocks external IP access from within the LAN and why? Can this be overridden?
@vivek.krishnan - advice needed
 
Some more information required here, I too run a test web server of a RPI-2, however do not face such an issue, which ISP are you using, how are you connected?
 
Using Den Broadband. Have a static ip from ISP, with ports open.

upload_2016-6-17_21-59-12.png
 
vivek.krishnan said:
You need hairpin NATing done mate - look it up. It does not work like that internally. Check on your mobile or another device with outside access.
Click to expand...

Thanks Vivek. But I will need some help to set this up on the router. Mine is N66U and I could not find any documentation on how to do that.
Dummy of router page - http://event.asus.com/2012/nw/dummy_ui/en/Advanced_NATPassThrough_Content.html

Below post asked the same question. They fixed it by resetting the router, which I have already done.
http://www.snbforums.com/threads/asus-rt-ac66u-nat-loopback-is-not-working.17760/[DOUBLEPOST=1466252301][/DOUBLEPOST]This is from the router
upload_2016-6-18_17-48-10.png
 
Last edited:
Yes its Asus Merlin. I am trying to figure out the instructions given in 2nd link you shared. Looks like Asus merlin does not have /etc/firewall.user.

What I found out that last time I updated to a diff Fork (380.58) from one I was using John's (374.43). I'm now updating this to latest in same fork. Will post, how it goes.[DOUBLEPOST=1466268354][/DOUBLEPOST]=> iptables -t nat -A prerouting_rule -d 112.196.155.7 -p tcp --dport 5555 -j DNAT --to 192.168.1.44

gives following error. "iptables: No chain/target/match by that name"
 
Last edited:
Was reading a bit about Asus Merlin, it already has NAT loopback (2 options Asus / Merlin) settings in the firewall section. Now I dont have any idea how that is enabled for a policy / rule.

Can you give it a shot first
 
Nop. doesn't work. I put those commands in jffs/scripts/nat-start. It does get called .. but nothing.[DOUBLEPOST=1466270358][/DOUBLEPOST]This is the firewall section
upload_2016-6-18_22-48-49.png
[DOUBLEPOST=1466271680][/DOUBLEPOST]Ok. Finally it worked (partially).

The iptables commands on this page helped -> http://serverfault.com/questions/205040/accessing-the-dnatted-webserver-from-inside-the-lan
-> But it did not work via the NAT script.
-> I had to run the commands manually in SSH
-> The web server response is very slow. Home page (Apache test page) loaded after 15 sec

Will explore futher
 
Last edited:
Back
Top