1

I do not have access the the gateway router so I cannot look up the forwarding rules. In a Windows network environment, how else can I find out which host the WAN IP is forwarded to?

Improve this question
2
  • Why? Also, I have to have 15 characters.
    – Kyle Smith
    Dec 13, 2011 at 15:05
  • Lols... because I am trying static route packets through the internal VPN rather go by the WAN link. But I need to know the LAN IP on the other side first.
    – Jake
    Dec 14, 2011 at 6:13

5 Answers 5

Reset to default
14

You don't. Otherwise the machines would all have WAN-ip's and firewall/NAT would be useless.

Improve this answer
1
  • Not sure if it matters, but I am trying to find out the LAN IP from inside the LAN, same subnet, not outside. Is it still not possible?
    – Jake
    Dec 14, 2011 at 6:15
3

I'm not sure why this question was downvoted. Its a legitimate question.

The short answer is that you can't. Finding the local address is a difficult problem. Typically this is solved by running an application on both ends and just having it query the WMI. Obviously, you're not doing this without special software.

The other way is to use common sense. Do a port scan. What ports are being listened to. Is it 80 running Apache? If so, how many apache servers do you have. Does apache reveal any extra information like host name? Is RDP forwarded? That'll reveal hostname. Or FTP, SSH, etc.

Improve this answer
1
  • Actually the WAN is for untangle server, so I know what server it is, I just do not know where it is. So I could do a port scan on in the LAN and find all untangle ports. But the gateway mask is 192.168.224.0/20 and there could be more than one untangle server.
    – Jake
    Dec 14, 2011 at 6:23
0

You can't find the LAN IP or it's range just from the WAN IP. That is the whole point of having private and public addresses.

You can find the forwarding rules only through the gateway router.

Improve this answer
0

The only situation when I see that this could be possible is to send a TCP packet with SYN flag set and record route option set towards a service that is forwarded (DNAT) on a private IP.

Improve this answer
-1

You can try to use tcptraceroute. The way this works is it sends multiple TCP SYN packets, increasing the lifetime at each step.

The first packet will time out at your local router (1 hop). If the router is configured correctly, it will send an ICMP error message informing you about the timeout.

The second packet will time out at a gateway of your ISP. Again, you will receive an ICMP message.

Let us skip to when you send a packet with a lifetime big enough it arrives at the destination NAT. The NAT will not forward the packet and send an ICMP error packet back.

You increase the packet lifetime again. Now, the NAT will forward the packet but the host will not accept it. It sends an ICMP packet back to the original sender of the TCP packet. This ICMP packet will include the host IP.

If the NAT does not do ICMP inspection, the ICMP packet will arrive at your host with the IP address of the destination. Beware, because most NAT routers do not honor these rules and block or modify ICMP error packets.

Improve this answer
3
  • This won't work. He hits the router. The router forwards the traffic he gets on port x. ICMP is not hitting on port X so the router will just respond as being the final endpoint.
    – Bart De Vos
    Dec 13, 2011 at 14:38
  • @BartDeVos tcptraceroute is not the same as traceroute. It can target a specific port.
    – Skyhawk
    Dec 13, 2011 at 16:48
  • Can somebody explain to me why my answer is wrong / won't work?
    – parasietje
    Dec 16, 2011 at 11:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .