1

My tiny office has 1 router, which is connected to ADSL line on one end and my laptop on other end. In office, laptop's local IP is 192.168.1.2.

On office router, I have setup port (22) forwarding for SSH access. I also have DuckDNS script that allows me to ssh -v -t -L 5900:localhost:5900 myname.duckdns.org into my office laptop whenever I want.

I followed the same port-forwarding procedure to configure my router to forward Port 8082 to 192.168.1.2 (TCP, WAN interface is pppoe2). I ran a python/nodejs http server listening on 0.0.0.0:8082.

If I try to access my newly spun server from public IP I get timeout. This is the problem. I can SSH into my remote machine, but website hosted on it doesn't work

Steps tried:

I take remote desktop of office laptop (using port 5900 for x11 forwarding) and find that firefox can open localhost:8082, 127.0.0.1:8082 and 192.168.1.2:8082 properly.

I tried shutting down extra services like gogs and nginx (which was listening on port 80 even though I didn't tell it to) via systemctl, but still no luck.

Further, curl http://PUBLIC_IP:8082 gives different outputs:

  1. At home, in my Cmder I get curl: (7) Failed to connect to PUBLIC_IP port 8082: Timed out
  2. However, in SSH terminal (i.e. of remote machine), I get curl: (7) Failed to connect to PUBLIC_IP port 8082: Connection refused

Why is connection refused?

Thanks to @davidgo, I tried

$ sudo tcpdump -vv -i enp7s0 | grep 8082
tcpdump: listening on enp7s0, link-type EN10MB (Ethernet), capture size 262144 bytes

If I curl localhost:8082 or 192.168.1.2:8082 I see 200 on server logs but I don't see any output in the above command.
But if I curl PUBLIC_IP:8082 from

  1. inside SSH session I get
    duckDNSsubDomain.40626 > abts-north-dynamic-031.P3.P2.P1.airtelbroadband.in.8082: Flags [S], cksum 0x469a (incorrect -> 0x84f5), seq 18095393, win 64240, options [mss 1460,sackOK,TS val 2474578357 ecr 0,nop,wscale 7], length 0
    abts-north-dynamic-031.P3.P2.P1.airtelbroadband.in.8082 > duckDNSsubDomain.40626: Flags [R.], cksum 0x8cea (correct), seq 0, ack 18095394, win 0, length 0

and a quick connection refused complain by curl (BTW my public IPv4 looks like P1.P2.P3.31.

  1. And if I do the same curl from my home computer I see
    157.32.251.70.50664 > duckDNSsubDomain.8082: Flags [S], cksum 0x299d (correct), seq 132055921, win 64240, options [mss 1370,nop,wscale 8,nop,nop,sackOK], length 0
    157.32.251.70.50664 > duckDNSsubDomain.8082: Flags [S], cksum 0x299d (correct), seq 132055921, win 64240, options [mss 1370,nop,wscale 8,nop,nop,sackOK], length 0
    157.32.251.70.50664 > duckDNSsubDomain.8082: Flags [S], cksum 0x299d (correct), seq 132055921, win 64240, options [mss 1370,nop,wscale 8,nop,nop,sackOK], length 0
    157.32.251.70.50664 > duckDNSsubDomain.8082: Flags [S], cksum 0x299d (correct), seq 132055921, win 64240, options [mss 1370,nop,wscale 8,nop,nop,sackOK], length 0
    157.32.251.70.50664 > duckDNSsubDomain.8082: Flags [S], cksum 0x299d (correct), seq 132055921, win 64240, options [mss 1370,nop,wscale 8,nop,nop,sackOK], length 0

and curl fails with timeout.

Now I am guessing my ISP doesn't like random ports. So I tried hosting my webserver on port 80. Again, localhost and 192.186.1.2 work as expected but http://PUBLIC_IP:80/ opens up router control panel :(

So I try hosting it on a well-known port that's not 80 or 443. I choose 21 (FTP), use sudo to run webserver listening on 0.0.0.0:21 but firefox/chrome don't let me open it and curl hangs for a while before failing with a timeout.

9
  • If you run tcpdump on your web server and then try and make an external request do you see any traffic to your webserver on port 8082? If you browse to 192.168.1.2:8082 does the web page come up? – davidgo Jan 10 at 6:58
  • @davidgo Yes I see the web page when I browse/curl to 192.168.1.2:8082, checking tcpdump now – chocolate Jan 10 at 8:02
  • @davidgo tcpdump -i eth0 is giving too much output (perhaps because I am in SSH), any suggestions on how to filter out the needed output? – chocolate Jan 10 at 8:05
  • try "tcpdump -i eth0 -p 8082" – davidgo Jan 10 at 8:50
  • What router do you have? Your experience setting up for forwarding is nothing like mine. The routers I've used generally have a web interface that allow you to do it and you don't have to specify SSH commands at all. This has been my experience on routers from Netgear, actiontec, and Linksys, both running factory firmware and with open source tomato firmware. – Stephen Ostermiller Jan 10 at 17:01
1

The evidence strongly suggest the problem is not with your router, rather it is with the setup of your web server. I strongly suspect that you have firewall rules on your webserver which are dropping traffic to port 8082. To check if this is the issue, issue the command -

 /sbin/iptables -I INPUT -p tcp --dport 8082 -j ACCEPT

If things start working as a result you know its a firewall issue, and you would then need to work out how the firewall is invoked and modify this behaviour (which is distro dependent)

The reason you are getting 200's when executed from that machine without it appearing in the tcpdump command is that the command I provided only looks for traffic on the ethernet interface - and traffic from that machine does not traverse that interface.

2
  • That command didn't give any output – chocolate Jan 11 at 9:48
  • Still getting connection refused from curl and firefox (inside x11 remote desktop) saying server too busy – chocolate Jan 11 at 9:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.