I'm running DD-WRT firmware on my router, version DD-WRT v24-sp2 (12/12/11) std.

I'm trying to port forward http traffic on port 80 to my PC's local IP,, and although I can browse my hosted site on my LAN, when I try from a remote IP offsite I get "The Connection has timed out".

Could someone please have a look at the iptables dump linked here and help me find the proper iptables syntax to use to enable port forwarding to work properly? I'm very new to iptables and am lost on how to craft the necessary syntax.

EDIT output of netstat -ano | find "80" from the web server (Windows 7 running IIS):

  TCP                 LISTENING       4
  TCP       ESTABLISHED     3860
  TCP       TIME_WAIT       0
  TCP    [::]:80                [::]:0                 LISTENING       4
  UDP        *:*                                    3132
  UDP        *:*                                    2420

EDIT output of iptables -t nat -L from the DD-WRT command prompt:

target     prot opt source               destination         
DNAT       icmp --  anywhere             my.wan.ip to: 
DNAT       tcp  --  anywhere             my.wan.ip tcp dpt:www to: 
DNAT       tcp  --  anywhere             my.wan.ip tcp dpt:www to: 
TRIGGER    0    --  anywhere             my.wan.ip TRIGGER type:dnat match:0 relate:0 
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
target     prot opt source               destination         
SNAT       0    --       anywhere            to:my.wan.ip 
RETURN     0    --  anywhere             anywhere            PKTTYPE = broadcast 

EDIT output of iptables -t nat -vnL from DD-WRT interface:

Chain PREROUTING (policy ACCEPT 165K packets, 18M bytes)
 pkts bytes target     prot opt in     out     source               destination         
   38 47952 DNAT       icmp --  *      *            my.wan.ip       to: 
    0     0 DNAT       tcp  --  *      *            my.wan.ip       tcp dpt:80 to: 
    0     0 DNAT       tcp  --  *      *            my.wan.ip       tcp dpt:80 to: 
47056 6024K TRIGGER    0    --  *      *            my.wan.ip       TRIGGER type:dnat match:0 relate:0 
Chain OUTPUT (policy ACCEPT 4753 packets, 418K bytes)
 pkts bytes target     prot opt in     out     source               destination         
Chain POSTROUTING (policy ACCEPT 4753 packets, 418K bytes)
 pkts bytes target     prot opt in     out     source               destination         
87913   10M SNAT       0    --  *      vlan2           to:my.wan.ip 
    0     0 RETURN     0    --  *      br0             PKTTYPE = broadcast 

EDIT output of route from DD-WRT Command prompt:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface     *      UH    0      0        0 vlan2     *        U     0      0        0 br0     *        U     0      0        0 vlan2     *          U     0      0        0 br0       *            U     0      0        0 br0       *            U     0      0        0 lo
default         adsl-74-178-55-         UG    0      0        0 vlan2

CONCLUSION: I've had it with DD-WRT.

I've bricked and unbricked my Buffalo WZR-HP-G300NH2 dozens of times now. Tried numerous suggestions below. Posted on the DD-WRT forum and got met with mostly dead air. Looked at other alternative firmwares like OpenWRT, Gargoyle, HyperWRT, Tomato. Of these, OpenWRT with Gargoyle looked promising, but Gargoyle specifically does not support my router (the WZR-HP-G300NH is supported, but not the WZR-HP-G300NH2).

The furthest I've come so far is with getting OpenWRT and Luci (a web management add-on) installed, after wading through hundreds of forum posts trying to find solutions or workarounds to numerous build and config and other errors only to be met with terse, unhelpful posts in response to questions similar to mine along the way like "just recompile with {some library or option or config which seems perfectly conventional to the developer but not a newbie}" or "just try {doing the obvious which you've probably already tried, which I can do in my sleep but don't particularly care to elaborate on}".

Apparently I did something wrong, because following this and trying to apply some configuration changes through Luci, the router has bricked again after a reboot. If I feel like it, I'll try yet again to reflash it, and see what I need to do to avoid the situation again, and hopefully end up with a functional router or at least a switch I can use.

In the meantime I've gone ahead and bought another router, and I'm hoping that the factory firmware will do the seemingly simple task of port forwarding. Thanks to kce and all those who took a stab at this.

  • Did you configure the port forwarding from the NAT/QoS -> Port Forwarding screen?
    – Starfish
    Jan 10, 2012 at 3:18
  • 1
    Your ISP may be blocking port 80 if you're not using the business package. Jan 10, 2012 at 7:51
  • @Starfish: Yes, port 80 is set from there to forward TCP to my local IP. Jan 10, 2012 at 14:05
  • @HubertKario: I tried using a spare Linksys router I have lying around with its factory firmware, it forwarded external http traffic just fine, so I'm pretty certain my ISP isn't filtering. Jan 10, 2012 at 14:06
  • NAT through a Linux machine/dd-wrt must be placed in the nat tables PREROUTING section, I don't see that one in your iptables dump. Can you please give us that one too? Jan 14, 2012 at 21:40

7 Answers 7


...version DD-WRT v24-sp2 (12/12/11) std.

You didn't provide the revision number which is an important piece of information. The only current recommended revisions are 13064 or 14869. Most revisions of the dd-wrt firmware are considered unstable and broken.

Here's the relevant information from the forum thread.

Upgrade (or downgrade)to one of the forum recommended builds listed in this section, especially if you are running SP1 or v24 final (05/21/08 )13064 or 14896. Stick with what is recommended in the this thread or redhawk0's announcement if you want stability. At the time of writing, the latest official build is v.24 SP1. SP1 has a LOT of issues. It will spontaneously brick the Asus WL500W router.

All of these forum recommended builds are BETA and not "finished" yet. Although you use them at your own risk the forum recommended builds have been pretty thoroughly tested and work well, certainly better than SP1. Browse the forums and see what others are saying.

The newest builds, such as the 16xxx or 17xxx builds, that are newer than the recommended builds have been released for TESTING only. They are not new and "improved" and have not been released because they are obviously better. OFTEN they have massive problems. If they did not, they would be recommended in the forum. So realize that if you are installing a different build that the ones that are recommended here, you are testing a build and you might find that it DOES NOT WORK. Each build has a "build thread" in the forum that is created when the build is released. Report problems in that thread, but do not ask for help with your router in the build thread. IF YOU WANT A GENERALLY STABLE BUILD, USE ONE OF THE BUILDS RECOMMENDED IN THIS NOTE OR REDHAWK0'S RECOMMENDED BUILD THREAD! The only exception to this rule is if you are using a VERY new router and that router requires initial flashing of a build that is newer than 15962, and in that case most should use 17990 or 18000 (which are basically the same).

TL;DR: The newest builds, such as the 16xxx or 17xxx builds, that are newer than the recommended builds have been released for TESTING only... OFTEN they have massive problems.

Edit: You said you tested the forwarding by connecting from a remote IP address. Just to be sure, you are not trying to connect to your WAN interface's IP address from your LAN, correct? NAT Loopback is broken for that revision and anything past 15760.

I highly recommend you downgrade your firmware to one of the recommend revisions per the thread I linked unless you have a very compelling reason to not do so.

Edit 2: Hmm. I see your downgrade did not work. Sorry to hear that. Unfortunately this is likely a problem with the DD-WRT firmware of which questions about are considered off topic. My reasoning for this conclusion is that your iptables look fine and port forwarding works correctly with your Linksys router).

My advice at this point is to either 1) post to the DD-WRT forum (read all their FAQs first), 2) file a bug report or 3) buy a real router. I have had nothing but problems with DD-WRT and would never recommend it anyone. Additionally I have found COTS "routers" to also be similarly unreliable.

  • Here's the build info: DD-WRT v24-sp2 (12/12/11) std - build 18000 Jan 15, 2012 at 23:16
  • Please see my edit. If this is an issue with NAT Loopback there is a fix (downgrade) otherwise you should downgrade anyway.
    – user62491
    Jan 16, 2012 at 1:38
  • I'd already applied a workaround recommended by one of the DD-WRT users to get around the NAT loopback issue, this solved the problem of not being able to browse to the web server from within my LAN, but the inability to browse from an external address still remains. I guess at this point I may go ahead and try downgrading to an earlier build as you recommend. Jan 16, 2012 at 3:45
  • I tried downgrading the firmware to build 14896, which according to the DD-WRT database is compatible with the Buffalo WZR-HP-G300NH, however, my router is actually the Buffalo WZR-HR-G300NH 2. Nevertheless, the GUI allowed me to downgrade to the G300NH build 14896 firmware, whereupon my router bricked. I then updated to the previous firmware specifically for the WZR-HR-G300NH2 via TFTP and my router came back to life, with the same server timeout problem when trying to access my web server externally, unfortunately. Jan 16, 2012 at 21:17
  • I tried to find the earliest build possible for the NH2 by someone named BrainSlayer (a senior user on the DD-WRT support forum), posted here: dd-wrt.com/others/eko/BrainSlayer-V24-preSP2 I tried downgrading to the earliest build of his firmware I could find that supports the NH2 (16994, located here: dd-wrt.com/others/eko/BrainSlayer-V24-preSP2/2011/…), but once again the server timeout occurs. Jan 16, 2012 at 21:20

Add the four commands below (2 insmod's and 2 iptables's) to your router's startup command window (router's menu path: Administration --> Diagnostics). Paste them into the router's shell command window and then click on the SAVE STARTUP button to transfer them into your router's startup command window:

insmod ipt_mark

insmod xt_mark

iptables -t mangle -A PREROUTING -i ! `get_wanface` -d `nvram get wan_ipaddr` -j MARK --set-mark 0xd001

iptables -t nat -A POSTROUTING -m mark --mark 0xd001 -j MASQUERADE

Best way is to copy & paste these four commands above EXACTLY as they are, directly into your router, ONE COMMAND PER LINE. Doing so guarantees you don't make mistakes, as I bet you are fed up dealing with this already!

After saving them into your router's startup list of commands, reboot your router and test your port forwardings from the WAN side.

This should do the trick.

Please reply here if this has worked for you the way it has worked for me!

Regards, Lino


Your rules as they stand appear fine; so the other possibility is your ISP or someone in the middle is blocking dport 80... simple way to test that:

Add a DNAT rule that forwards request for some other port to your internal server - i.e:

iptables -t nat -I PREROUTING -p tcp --dport 32100 -d <wanIP> -j DNAT --to

then pop open a browser and visit http://<wanIP>:32100

if it still fails, then it's more than likely something related to pMTUd issues.

  • I tried to add that rule, but DD-WRT came back with "Bad argument `DNAT'". Btw, I'd mentioned a Linksys router I tried with just its factory firmware forwarded port 80 fine to my web server, so it seems like there's no filtering going on. Jan 14, 2012 at 23:37
  • sorry, the stupid editor treated my command as if it were markup, fixed now
    – Olipro
    Jan 15, 2012 at 20:50
  • No luck, I still get the connection timeout. Jan 17, 2012 at 23:18
  • oops, yes, that would fail, fixed command again.
    – Olipro
    Jan 18, 2012 at 16:54

You need to allow connection in 2 locations, NAT and Firewall.

  • Do you mean Windows firewall? I've already disabled it at the domain, public and private levels. Or do you mean the SPI firewall in DD-WRT? Jan 10, 2012 at 14:07
  • No, I mean settings on the router, there're 2 settings that you need to complete. NAT and FIREWALL ... isn't that the case?
    – Vick Vega
    Jan 12, 2012 at 2:42
  • Well, for NAT I've set up port forwarding as described in the DD-WRT wiki to forward port 80 to my server's LAN IP address; for the firewall, as far as I'm aware I haven't set up anything in the DD-WRT firewall GUI settings to block port 80 traffic, though the iptables dump I posted I need help deciphering as I'm not sure whether that indicates port 80 is being blocked. Jan 12, 2012 at 20:26
  • As much as I'm aware - You need to allow access from outside to some host on internal network. By default, on a lot small-medium firewalls all the incoming access is blocked, unless authorized. So, add the rule to allow access on port 80 trough the router's GUI.
    – Vick Vega
    Jan 13, 2012 at 4:18
  • No joy, I completed disabled the stateful firewall in DD-WRT and still no port forwarding, the timeout error recurs. Jan 13, 2012 at 4:27

Your listing of iptables is only for the default filter table (same as iptables -t filter -L), which is for traditional straightforward routing and is not sufficient in your case - you use network address translation (NAT).

In this case the relevant setting is in the nat table (connect to your router through ssh and issue iptables -t nat -L); it should contain something like that:

Chain PREROUTING (policy ...)
target     prot opt source               destination
DNAT       tcp  --  anywhere             your_internet_ip_address       tcp dpt:80 to:

Of course, from outside you need to connect to http://your_internet_ip_address, not to, forgive me for stating the obvious.

No idea how to implement it through DD-WRT v24 GUI. On v23 I did it via Applications&Gaming -> Port Forwarding and DNAT worked nicely.

UPDATE 1: So, you do have a proper DNAT rule.

One more thing I've noticed. You have a TRIGGER rule for port 80. Manual says

By setting Port Triggering rules, you can allow inbound traffic to arrive at a specific LAN host [...] If a PC sends outbound traffic from those ports, incoming traffic on the Forwarded Range will be forwarded to that PC.

This is something quite different than normal Port Forwarding (DNAT) and may very likely conflict with it. Triggering is normally used for applications which connect back (usually multiplayer games), I don't see why anybody would want it for port 80.

  • Thanks, I edited my original post to include the output of iptables -t nat -L, and yes in testing I'm trying to connect to my server via a remote session to a laptop at my office across town. For v24 I set up the forwarding rule via NAT / QoS => Port Forwarding. Jan 14, 2012 at 23:00
  • Seems ok. I've updated my answer with one more advice: triggering.
    – kubanczyk
    Jan 15, 2012 at 12:15
  • I removed the entry I had under Port Triggering, no change; from my external setup the connection still times out. Jan 15, 2012 at 14:57

Your rules are fine. You have port 80 configured as the default for remote access. Change that and you should be fine.


Port 80 is going to your dd-wrt config page. All you need to do is change that dd-wrt config page to another port. Then forward port 80 to the desired IP.

  • 1
    txt spk dsnt go down well here like you bro lol wtfbbq ellipsis May 22, 2013 at 4:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.