1

Let's say that I have a web server running on my PC and I would like to access it from outside my LAN, I have port forwarding set up to forward traffic to port 80 to the PC's IP, (192.168.1.10).

Should the web server listen on the PC's IP or the public IP?

Improve this question

3 Answers 3

Reset to default
3

It should listen on the IP address assigned to the PC on the LAN. When you're behind a router at home, the PC has no idea of outside world IP numbers.

Remember that you are port forwarding, not IP forwarding. Your router is using NAT (Network Address Translation) and assigning your PC its own IP, unrelated to the outside world.

Improve this answer
1
  • I am not sure if the OP is confused in using the terms port forwarding which is a port number change. Otherwise, it is IP forwarding. Even if he is right, then the private IP must be the servers IP address regardless. It just listens on the new port ID. I am not in favor of port forwarding unless required for something like Tomcat. Masking private IPs on the LAN side does make sense, just do not use predicable IP addresses such as 10.0.0.1. Instead make it 10.101.115.123. Otherwise the private IP can still be probed depending upon the router allowing a hacker to jump the gap.
    – closetnoc
    Commented Sep 26, 2016 at 22:06
1

When port forwarding, NAT works by editing the IP address in the IP header of the incoming packet and then passing the packet on toward its ultimate destination, while maintaining a state table so that response packets and later packets in the same data stream go to the correct place. There are a few other things going on, but that's the part that is important to understand.

Think of NAT as taking an envelope from the "in" pile, slapping a new address label on it, and putting it in the "out" pile.

Just as the mailbox must be at the address described by the now topmost address label, the server on the internal network must listen to the IP address the router edits the IP header to point to.

Hence, when setting up a web server behind NAT port forwarding, configure your web server to listen to the internal IP address that the packets are being forwarded to.

Improve this answer
0

A web server such as Apache, Nginx, Node, etc, listens on a port or ports, and a public IP. The internal IP of the PC is irrelevant except for setting routes from the public facing router/switch/modem/device. The public facing device has the public IP attached to it. Services that need to run under that IP can be forwarded to internal "local" IP(s) via ports. The server understands how to use the public IP when it needs to.

So that being said, 192.168.1.10 falls into what is known as the reserved IP address range. Most of these types of addresses are used within an intranet/LAN, and because of that will never be accessible from the outside world (internet). Unless your server is designed to run inside this LAN, or you have masked with a host file, use the public IP for all schemas.

Improve this answer
1
  • I am a bit confused reading your answer. On one hand you seem to be telling the OP to use the public IP and on the other, you seem to be telling the OP to use the private IP. WAN to LAN using a router, the server would always use a private IP address assuming NAT is enabled which is standard and safer. I always advise using a non-predictable IP address range so that hackers cannot jump the gap easily without a lot of probing which should be shutdown long before that happens. Of course this depends upon the router/firewall and how smart it is.
    – closetnoc
    Commented Sep 26, 2016 at 22:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.