Good Day All.
Sorry for the really dumb question, which I can probably find by searching the forum, but I am under intense pressure to get this running.
We have an application on port 7788, which needs to be accessed over the internet.
I am not able to get the port forwarding correct, and I need the app server to be connected to ether3, but don’t seem to be able to create a static route.
This is my current setup:
(I don’t wish to post my public IP in full)
Addresses:
Flags: X - disabled, I - invalid, D - dynamic
ADDRESS NETWORK INTERFACE
0 105.27.xx8.154/30 105.27.xx8.152 ether1
1 192.168.1.2/24 192.168.1.0 ether2-master
2 105.29.xx.232/29 105.29.xx.232 ether1
3 105.29.xx.235/29 105.29.xx.232 ether1
4 192.168.0.100/32 192.168.0.0 ether3
Routes:
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 A S 0.0.0.0/0 105.27.xx8.153 1
1 ADC 105.27.178.152/30 105.27.xx8.154 ether1 0 (Internet Gateway)
2 ADC 105.29.89.232/29 105.29.xx.232 ether1 0 (Public IP)
3 ADC 192.168.0.0/32 192.168.0.100 bridge 0 (App Server)
4 ADC 192.168.1.0/24 192.168.1.2 bridge 0 (To LAN gateway)
Firewall:
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; defconf: masquerade
chain=srcnat action=masquerade out-interface=ether1
Your dstnat rule takes tcp connections to 105.29.xx.235:7788 and forwards them to internal 192.168.0.100:7788, so it looks ok. Things to check:
Server does have access to internet, i.e. three’s no misconfigured gateway or anything like that
Application really listens on tcp/7788
Server’s firewall allows acces to this port from anywhere
Firewall on router allows access to this forwarded port
For the last one, you didn’t post anything about router’s firewall. If it’s default one, it should be ok. If it’s your own one, make sure that you have forwarded port allowed in filter. Either by specific rule, or all at once using:
Check what happens, you can see packets using Tools->Torch (incoming on ether1, and if they successfully passed through router on ether3). Or you can add logging rules in prerouting/postrouting, to make sure you don’t miss any.
Server is listening on 7788 on 192.168.0.100
Server has no internet access via 192.168.0.100 - should I be using 192.168.0.1 as gateway?
Cannot ping router, and vice versa.
Was using default firewall, added your line - no difference.
Torch shows no packets routed to ether 3.
Your config is strange. I was focusing on dstnat and missed few other obviously wrong things.
You try to forward port to 192.168.0.100, but you have the same address assigned to router (ether3). Not only that, but it’s some strange point-to-point config, where the other end is 192.168.0.0.
If it should work, you probably want 192.168.0.1/24 on router’s ether3, and then let the server use it as default gateway. In case it’s something more complex, where the server would be connected to another network with different default gateway (and you’d want to keep that), make it 192.168.0.x/24, where x is something not used in that network. Then add:
Sob, as you correctly pointed out, that configuration was a tax-up.
Many apologies.
My configuration was being messed up by some weird managed switch routing to our CCTV network that had a rogue switch configured to 192.168.0.100. (Should have been on 192.168.1.0 net)
Changed server to 192.168.2.100, and ether3 to 192.168.2.1 - all good.
Sob, as you correctly pointed out, that configuration was a tax-up.
Many apologies.
My configuration was being messed up by some weird managed switch routing to our CCTV network that had a rogue switch configured to 192.168.0.100. (Should have been on 192.168.1.0 net)
Changed server to 192.168.2.100, and ether3 to 192.168.2.1 - all good.