Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I do not have access the the gateway router so I cannot look up the forwarding rules. In a Windows network environment, how else can I find out which host the WAN IP is forwarded to?

share|improve this question
Why? Also, I have to have 15 characters. – Kyle Smith Dec 13 '11 at 15:05
Lols... because I am trying static route packets through the internal VPN rather go by the WAN link. But I need to know the LAN IP on the other side first. – Jake Dec 14 '11 at 6:13

5 Answers

up vote 14 down vote

You don't. Otherwise the machines would all have WAN-ip's and firewall/NAT would be useless.

share|improve this answer
Not sure if it matters, but I am trying to find out the LAN IP from inside the LAN, same subnet, not outside. Is it still not possible? – Jake Dec 14 '11 at 6:15
up vote 3 down vote

I'm not sure why this question was downvoted. Its a legitimate question.

The short answer is that you can't. Finding the local address is a difficult problem. Typically this is solved by running an application on both ends and just having it query the WMI. Obviously, you're not doing this without special software.

The other way is to use common sense. Do a port scan. What ports are being listened to. Is it 80 running Apache? If so, how many apache servers do you have. Does apache reveal any extra information like host name? Is RDP forwarded? That'll reveal hostname. Or FTP, SSH, etc.

share|improve this answer
Actually the WAN is for untangle server, so I know what server it is, I just do not know where it is. So I could do a port scan on in the LAN and find all untangle ports. But the gateway mask is 192.168.224.0/20 and there could be more than one untangle server. – Jake Dec 14 '11 at 6:23
up vote 0 down vote

You can't find the LAN IP or it's range just from the WAN IP. That is the whole point of having private and public addresses.

You can find the forwarding rules only through the gateway router.

share|improve this answer
up vote 0 down vote

The only situation when I see that this could be possible is to send a TCP packet with SYN flag set and record route option set towards a service that is forwarded (DNAT) on a private IP.

share|improve this answer
up vote -2 down vote

You can try to use tcptraceroute. The way this works is it sends multiple TCP SYN packets, increasing the lifetime at each step.

The first packet will time out at your local router (1 hop). If the router is configured correctly, it will send an ICMP error message informing you about the timeout.

The second packet will time out at a gateway of your ISP. Again, you will receive an ICMP message.

Let us skip to when you send a packet with a lifetime big enough it arrives at the destination NAT. The NAT will not forward the packet and send an ICMP error packet back.

You increase the packet lifetime again. Now, the NAT will forward the packet but the host will not accept it. It sends an ICMP packet back to the original sender of the TCP packet. This ICMP packet will include the host IP.

If the NAT does not do ICMP inspection, the ICMP packet will arrive at your host with the IP address of the destination. Beware, because most NAT routers do not honor these rules and block or modify ICMP error packets.

share|improve this answer
This won't work. He hits the router. The router forwards the traffic he gets on port x. ICMP is not hitting on port X so the router will just respond as being the final endpoint. – Bart De Vos Dec 13 '11 at 14:38
@BartDeVos tcptraceroute is not the same as traceroute. It can target a specific port. – Miles Erickson Dec 13 '11 at 16:48
Can somebody explain to me why my answer is wrong / won't work? – parasietje Dec 16 '11 at 11:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.