Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Okay, so here's the story:

I administrate a server running a web application on my internal LAN, say foo:1234. My team uses this actively.

We have now decided to make this application accessible from outside our network - but we don't want to install it on our webserver. I have forwarded an external port (say 5678) on our (DDWRT) router to foo:1234, and this works fine.

The problem though, is that due to certain configuration issues anyone can view the page without being logged in, if they know the URL. I want to prevent that in some way.

I created a page (with login) on our web server, that redirects to router:5678 after authentication, but that's not really a solution; router:5678 is still publicly accessible.

My question: How can I set it up so that the port gets forwarded only after authentication?

share|improve this question
What model of router/firewall are you using? – petrus Sep 13 '12 at 22:12
ddwrt - just added that to the question. – Vish Sep 13 '12 at 22:15
up vote 2 down vote accepted

A common way to handle this situation is to place an authenticating reverse proxy (e.g., apache) in front of the web server.

See e.g.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.