Access server behind router with external ip (works well except from pc in same network)

Question

Almost the same website problem as this post found

server: Windows 2008 with IIS7

Router: Dlink DIR-615

Configured: Port 80 forwarded, ddns OK

Shield Up: Port 80 test ok

Online Browser: PC outside network can access the website

And my Problem:

• PC outside private network - Access using external ip or ddns hostname: OK
• PC inside private network - Access using internal ip (192.168.0.x): OK
• From the server - Access using "localhost": OK
• PC inside private network - Access using external ip or ddns hostname: failed

Just wonder why pc in the same network can not access to web server using external ip while those external pc can do so? Well I found some points from the post above:

• Such access confuse router: well I can not get the point. Some said some DNS settings in router can fix that but I can not find how to do that

• Change host table and map hostname to internal ip: this of course works (even without internet connection) , just no difference from accessing with "192.168.10.x". Such solution make no sense, I want to access the server via internet to make sure what external user will get in their browser

Thanks advance for your help !

Answer 1

The problem here is, that your router does not NAT your internal client's address. Thus, the TCP handshake fails.

Let's assume following IPs

• Client: 192.168.1.3
• Server: 192.168.1.2
• Router internal: 192.168.1
• Router external: 123.123.123.1

Here is what is happening:

1. Client (192.168.1.3) sends TCP-SYN to your external IP, Port 80 (123.123.123.1:80)
2. Router sees port forwarding rule and forwards the packet to the server (192.168.1.2:80) without changing the source IP (192.168.1.3)
3. Client waits for a SYN-ACK from the external IP
4. Server send his answer back to the client directly, because it's on the same subnet. It does not send the packet to the router, which would reverse the NAT.
5. Client recieves a SYN-ACK from 192.168.1.2 instead of 123.123.123.1. And discards it.
6. Client still waits for a SYN-ACK from 123.123.123.1 and times out.

Answer 2

You usually use network address translation (NAT) for this. The router maps the external IP to the correct internal one but he doesn't convert addresses for internal traffic. So you cannot access local devices by using the external IP of your router from inside the network.

Answer 3

The problem you described - internal machine connecting to external IP of router, bouncing back through port forwarding to another internal IP, is pretty complicated, and not in any way common for dinky little home router, so has probably not been tested, or maybe has been explicitly excluded to make the coding simpler.

Answer 4

Thanks all of you.

PEra and arno, I can see the problem now as you explains very clearly. This problem really spent me lots of time. And I can accept test with internal ip only as my home use router may not be capable for advance operation (just port forwarding, virtual server or DMZ)

Answer 5

Check if your router supports NAT redirection filtering. If it does then turn the filtering off. ;)

Answer 6

I've had the same problem with D-Link DIR-400. The solution is to use DD-WRT firmware.