DD-WRT, forwarding TCP port 80 for http doesn't work from WAN? [closed]

Question

I'm running DD-WRT firmware on my router, version DD-WRT v24-sp2 (12/12/11) std.

I'm trying to port forward http traffic on port 80 to my PC's local IP, 192.168.2.97, and although I can browse my hosted site on my LAN, when I try from a remote IP offsite I get "The Connection has timed out".

Could someone please have a look at the iptables dump linked here and help me find the proper iptables syntax to use to enable port forwarding to work properly? I'm very new to iptables and am lost on how to craft the necessary syntax.

EDIT output of netstat -ano | find "80" from the web server (Windows 7 running IIS):

  TCP    0.0.0.0:80             0.0.0.0:0              LISTENING       4
  TCP    192.168.2.97:1869      207.46.124.39:80       ESTABLISHED     3860
  TCP    192.168.2.97:43794     74.125.229.36:80       TIME_WAIT       0
  TCP    [::]:80                [::]:0                 LISTENING       4
  UDP    127.0.0.1:48000        *:*                                    3132
  UDP    127.0.0.1:48001        *:*                                    2420

EDIT output of iptables -t nat -L from the DD-WRT command prompt:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
DNAT       icmp --  anywhere             my.wan.ip to:192.168.2.1 
DNAT       tcp  --  anywhere             my.wan.ip tcp dpt:www to:192.168.2.97:80 
DNAT       tcp  --  anywhere             my.wan.ip tcp dpt:www to:192.168.2.97 
TRIGGER    0    --  anywhere             my.wan.ip TRIGGER type:dnat match:0 relate:0 
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
SNAT       0    --  192.168.2.0/24       anywhere            to:my.wan.ip 
RETURN     0    --  anywhere             anywhere            PKTTYPE = broadcast 

EDIT output of iptables -t nat -vnL from DD-WRT interface:

Chain PREROUTING (policy ACCEPT 165K packets, 18M bytes)
 pkts bytes target     prot opt in     out     source               destination         
   38 47952 DNAT       icmp --  *      *       0.0.0.0/0            my.wan.ip       to:192.168.2.1 
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            my.wan.ip       tcp dpt:80 to:192.168.2.97:80 
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            my.wan.ip       tcp dpt:80 to:192.168.2.97 
47056 6024K TRIGGER    0    --  *      *       0.0.0.0/0            my.wan.ip       TRIGGER type:dnat match:0 relate:0 
Chain OUTPUT (policy ACCEPT 4753 packets, 418K bytes)
 pkts bytes target     prot opt in     out     source               destination         
Chain POSTROUTING (policy ACCEPT 4753 packets, 418K bytes)
 pkts bytes target     prot opt in     out     source               destination         
87913   10M SNAT       0    --  *      vlan2   192.168.2.0/24       0.0.0.0/0           to:my.wan.ip 
    0     0 RETURN     0    --  *      br0     0.0.0.0/0            0.0.0.0/0           PKTTYPE = broadcast 

EDIT output of route from DD-WRT Command prompt:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
74.178.55.1     *               255.255.255.255 UH    0      0        0 vlan2
192.168.2.0     *               255.255.255.0   U     0      0        0 br0
74.178.55.0     *               255.255.255.0   U     0      0        0 vlan2
169.254.0.0     *               255.255.0.0     U     0      0        0 br0
239.0.0.0       *               255.0.0.0       U     0      0        0 br0
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
default         adsl-74-178-55- 0.0.0.0         UG    0      0        0 vlan2

CONCLUSION: I've had it with DD-WRT.

I've bricked and unbricked my Buffalo WZR-HP-G300NH2 dozens of times now. Tried numerous suggestions below. Posted on the DD-WRT forum and got met with mostly dead air. Looked at other alternative firmwares like OpenWRT, Gargoyle, HyperWRT, Tomato. Of these, OpenWRT with Gargoyle looked promising, but Gargoyle specifically does not support my router (the WZR-HP-G300NH is supported, but not the WZR-HP-G300NH2).

The furthest I've come so far is with getting OpenWRT and Luci (a web management add-on) installed, after wading through hundreds of forum posts trying to find solutions or workarounds to numerous build and config and other errors only to be met with terse, unhelpful posts in response to questions similar to mine along the way like "just recompile with {some library or option or config which seems perfectly conventional to the developer but not a newbie}" or "just try {doing the obvious which you've probably already tried, which I can do in my sleep but don't particularly care to elaborate on}".

Apparently I did something wrong, because following this and trying to apply some configuration changes through Luci, the router has bricked again after a reboot. If I feel like it, I'll try yet again to reflash it, and see what I need to do to avoid the situation again, and hopefully end up with a functional router or at least a switch I can use.

In the meantime I've gone ahead and bought another router, and I'm hoping that the factory firmware will do the seemingly simple task of port forwarding. Thanks to kce and all those who took a stab at this.

Answer 1

...version DD-WRT v24-sp2 (12/12/11) std.

You didn't provide the revision number which is an important piece of information. The only current recommended revisions are 13064 or 14869. Most revisions of the dd-wrt firmware are considered unstable and broken.

Here's the relevant information from the forum thread.

Upgrade (or downgrade)to one of the forum recommended builds listed in this section, especially if you are running SP1 or v24 final (05/21/08 )13064 or 14896. Stick with what is recommended in the this thread or redhawk0's announcement if you want stability. At the time of writing, the latest official build is v.24 SP1. SP1 has a LOT of issues. It will spontaneously brick the Asus WL500W router.

All of these forum recommended builds are BETA and not "finished" yet. Although you use them at your own risk the forum recommended builds have been pretty thoroughly tested and work well, certainly better than SP1. Browse the forums and see what others are saying.

The newest builds, such as the 16xxx or 17xxx builds, that are newer than the recommended builds have been released for TESTING only. They are not new and "improved" and have not been released because they are obviously better. OFTEN they have massive problems. If they did not, they would be recommended in the forum. So realize that if you are installing a different build that the ones that are recommended here, you are testing a build and you might find that it DOES NOT WORK. Each build has a "build thread" in the forum that is created when the build is released. Report problems in that thread, but do not ask for help with your router in the build thread. IF YOU WANT A GENERALLY STABLE BUILD, USE ONE OF THE BUILDS RECOMMENDED IN THIS NOTE OR REDHAWK0'S RECOMMENDED BUILD THREAD! The only exception to this rule is if you are using a VERY new router and that router requires initial flashing of a build that is newer than 15962, and in that case most should use 17990 or 18000 (which are basically the same).

TL;DR: The newest builds, such as the 16xxx or 17xxx builds, that are newer than the recommended builds have been released for TESTING only... OFTEN they have massive problems.

Edit: You said you tested the forwarding by connecting from a remote IP address. Just to be sure, you are not trying to connect to your WAN interface's IP address from your LAN, correct? NAT Loopback is broken for that revision and anything past 15760.

I highly recommend you downgrade your firmware to one of the recommend revisions per the thread I linked unless you have a very compelling reason to not do so.

Edit 2: Hmm. I see your downgrade did not work. Sorry to hear that. Unfortunately this is likely a problem with the DD-WRT firmware of which questions about are considered off topic. My reasoning for this conclusion is that your iptables look fine and port forwarding works correctly with your Linksys router).

My advice at this point is to either 1) post to the DD-WRT forum (read all their FAQs first), 2) file a bug report or 3) buy a real router. I have had nothing but problems with DD-WRT and would never recommend it anyone. Additionally I have found COTS "routers" to also be similarly unreliable.

Answer 2

Add the four commands below (2 insmod's and 2 iptables's) to your router's startup command window (router's menu path: Administration --> Diagnostics). Paste them into the router's shell command window and then click on the SAVE STARTUP button to transfer them into your router's startup command window:

insmod ipt_mark

insmod xt_mark

iptables -t mangle -A PREROUTING -i ! `get_wanface` -d `nvram get wan_ipaddr` -j MARK --set-mark 0xd001

iptables -t nat -A POSTROUTING -m mark --mark 0xd001 -j MASQUERADE

Best way is to copy & paste these four commands above EXACTLY as they are, directly into your router, ONE COMMAND PER LINE. Doing so guarantees you don't make mistakes, as I bet you are fed up dealing with this already!

After saving them into your router's startup list of commands, reboot your router and test your port forwardings from the WAN side.

This should do the trick.

Please reply here if this has worked for you the way it has worked for me!

Regards, Lino

Answer 3

Your rules as they stand appear fine; so the other possibility is your ISP or someone in the middle is blocking dport 80... simple way to test that:

Add a DNAT rule that forwards request for some other port to your internal server - i.e:

iptables -t nat -I PREROUTING -p tcp --dport 32100 -d <wanIP> -j DNAT --to 192.168.2.97:80

then pop open a browser and visit http://<wanIP>:32100

if it still fails, then it's more than likely something related to pMTUd issues.

Answer 4

You need to allow connection in 2 locations, NAT and Firewall.

Answer 5

Your listing of iptables is only for the default filter table (same as iptables -t filter -L), which is for traditional straightforward routing and is not sufficient in your case - you use network address translation (NAT).

In this case the relevant setting is in the nat table (connect to your router through ssh and issue iptables -t nat -L); it should contain something like that:

Chain PREROUTING (policy ...)
target     prot opt source               destination
DNAT       tcp  --  anywhere             your_internet_ip_address       tcp dpt:80 to:192.168.2.97:80

Of course, from outside you need to connect to http://your_internet_ip_address, not to http://192.168.2.97, forgive me for stating the obvious.

No idea how to implement it through DD-WRT v24 GUI. On v23 I did it via Applications&Gaming -> Port Forwarding and DNAT worked nicely.

UPDATE 1: So, you do have a proper DNAT rule.

One more thing I've noticed. You have a TRIGGER rule for port 80. Manual says

By setting Port Triggering rules, you can allow inbound traffic to arrive at a specific LAN host [...] If a PC sends outbound traffic from those ports, incoming traffic on the Forwarded Range will be forwarded to that PC.

This is something quite different than normal Port Forwarding (DNAT) and may very likely conflict with it. Triggering is normally used for applications which connect back (usually multiplayer games), I don't see why anybody would want it for port 80.

Answer 6

Your rules are fine. You have port 80 configured as the default for remote access. Change that and you should be fine.

Answer 7

Port 80 is going to your dd-wrt config page. All you need to do is change that dd-wrt config page to another port. Then forward port 80 to the desired IP.