Strange behaviour with port forwarding on Belkin router

I'm having some strange issues with port forwarding ("virtual hosts")
on my Belkin F5D7231-4 router. I'm hosting a webserver on a desktop
behind the router. My ISP blocks port 80, so I'm hosting it on port
8080. I've also got a domain name assigned to my external IP (of the
router). From another computer behind the router, I can use my
web-browser to go to the local IP of the webserver (192.168.2.2) and
access my server (with or without the :8080 port assignment in the URL,
because the web server software (apache) is also listening on default
port 80). Also, from the machine hosting the system, I can go to
localhost in my browser and access the server. However, if, from either
of the two machines *behind* the router, I try to go to my domain name
(or simply to my external IP address) with port 8080 specified, the
browser says it can't connect. However, using a proxy server
(hidemyass.com) I *am* able to access my site (with port 8080
specified).

Oddly, even though my ISP blocks port 80, if I try to go to either my
domain name or my external IP address from *behind* the server
*without* the port specified (i.e., default HTTP port 80, which should
be blocked before it can reach my router), it goes to the router
configuration page. So this seems to indicate that even when I use the
external IP address, the router figures out that it routes back to
itself, and so skips going out to the ISP. But in that case, the router
is apparently not doing port forwarding when the connection comes from
within.

If anyone has any insights on this, I'd appreciate input.

Setup:
=====
Router is Belkin F5D7231-4 wired/wireless router. Firmware is version
4.03.04, and router claims this is up to date.
My router is at 192.168.2.1, I've got a wired desktop on 192.168.2.2,
and a wireless laptop on 192.168.2.2
External IP is 209.6.169.252, domain is bmearns.net
Webserver is listening on ports 80 and 8080
ISP blocks port 80

In article <(E-Mail Removed). com>,
bmearns
(E-Mail Removed) says...
> I'm having some strange issues with port forwarding ("virtual hosts")
> on my Belkin F5D7231-4 router. I'm hosting a webserver on a desktop
> behind the router. My ISP blocks port 80, so I'm hosting it on port
> 8080. I've also got a domain name assigned to my external IP (of the
> router). From another computer behind the router, I can use my
> web-browser to go to the local IP of the webserver (192.168.2.2) and
> access my server (with or without the :8080 port assignment in the URL,
> because the web server software (apache) is also listening on default
> port 80). Also, from the machine hosting the system, I can go to
> localhost in my browser and access the server. However, if, from either
> of the two machines *behind* the router, I try to go to my domain name
> (or simply to my external IP address) with port 8080 specified, the
> browser says it can't connect. However, using a proxy server
> (hidemyass.com) I *am* able to access my site (with port 8080
> specified).
>
> Oddly, even though my ISP blocks port 80, if I try to go to either my
> domain name or my external IP address from *behind* the server
> *without* the port specified (i.e., default HTTP port 80, which should
> be blocked before it can reach my router), it goes to the router
> configuration page. So this seems to indicate that even when I use the
> external IP address, the router figures out that it routes back to
> itself, and so skips going out to the ISP. But in that case, the router
> is apparently not doing port forwarding when the connection comes from
> within.
>
> If anyone has any insights on this, I'd appreciate input.
>
You've figured out how it works, including using an external proxy to
see your server as the rest of the world does. What sort of insights
are you looking for?

On 9 Jan 2007, "bmearns" <(E-Mail Removed)> wrote:

>Router is Belkin F5D7231-4 wired/wireless router. Firmware is version
>4.03.04, and router claims this is up to date.
>My router is at 192.168.2.1,
>I've got a wired desktop on 192.168.2.2,
>and a wireless laptop on 192.168.2.2
>External IP is 209.6.169.252, domain is bmearns.net
>Webserver is listening on ports 80 and 8080
>ISP blocks port 80

>However, if, from either of the two machines *behind* the router, I
>try to go to my domain name (or simply to my external IP address)
>with port 8080 specified, the browser says it can't connect.

From your PCs, you will be trying to reach your router's port 8080,
and that's why it cannot connect.

>However, using a proxy server (hidemyass.com) I *am* able to access
>my site (with port 8080 specified).

Which is as "usual" - the forwarding is only working from the WAN side
to the LAN side... so an external request for 209.6.169.252:8080 gets
forwarded to your web server on 192.168.2.2

>So this seems to indicate that even when I use the external IP address,
>the router figures out that it routes back to itself, and so skips
>going out to the ISP.

Some routers will show their own routing table and give a list of the
interfaces alongside. It would be apparent that the IP is 'known' so
the packet would not be sent to the ISP (and if it was, there'd likely
be just a dropped packet as it would be unusual to have 'from' and 'to'
being the same IP address - probably deemed an error situation)

>But in that case, the router is apparently not doing port forwarding
>when the connection comes from within.

Which seems to be the norm, unless there's an option/rule to do some
loopback, else the only way to reach it from outside is via a proxy,
(which you already know will work), or from another ISP connection
(one reason I've found it useful to have two connections).

--
www.netdimes.org - mapping the internet.
Join team UK-24x7 (position 181) Let's beat "United States" :->

In MsgID<(E-Mail Removed)> on
Wed, 10 Jan 2007 15:45:01 +0000, in uk.comp.home-networking,
'NoNeedToKnow' wrote:

>>But in that case, the router is apparently not doing port forwarding
>>when the connection comes from within.
>
>Which seems to be the norm, unless there's an option/rule to do some
>loopback, else the only way to reach it from outside is via a proxy,
>(which you already know will work), or from another ISP connection
>(one reason I've found it useful to have two connections).

A telnet or SSH shell can be used for the same tests. These are often part
of paid-for web hosting services. Just telnet/SSH in, and then telnet back
out to your own IP.

Something like phpshell might be useful if your provider theoretically
doesn't allow a straightforward shell but does allow php.. Be *careful* if
you go that route, it's alarmingly easy to accidentally compromise your
poor unfortunate host - and it won't just be your account that's at risk.

Dave J.
--
Support a referendum on UK ID cards before they are
inflicted at stupendous cost for negligible reward.
http://petitions.pm.gov.uk/IDreferendum/

NoNeedToKnow wrote:
> From your PCs, you will be trying to reach your router's port 8080,
> and that's why it cannot connect.

Sorry, I don't follow. Why wouldn't my systems be able to go to my
router's port 8080?

> >But in that case, the router is apparently not doing port forwarding
> >when the connection comes from within.
>
> Which seems to be the norm, unless there's an option/rule to do some
> loopback.

Ok, well that makes sense at least. Well, it doesn't make sense to me
why they would do that, but if that's the case, then the situation
makes sense. On my old router (wired, from Network Everywhere) it did
the correct port forwarding from both sides of the router, so I never
realized this was an issue.

Thanks for the help, all.
-Brian

On 11 Jan 2007, "bmearns" <(E-Mail Removed)> wrote:

>NoNeedToKnow wrote:
>> From your PCs, you will be trying to reach your router's port 8080,
>> and that's why it cannot connect.

>Sorry, I don't follow. Why wouldn't my systems be able to go to my
>router's port 8080?

This will be from the LAN side, not the WAN side, so won't be forwarded.
The router (unless you've changed the port setting) will likely answer
only if you call up the config menu on port 80, so will give no response
on port 8080 (but remember it's not forwarding).

Ok, I see. Thanks for clearing that up.


NoNeedToKnow wrote:

> On 11 Jan 2007, "bmearns" <(E-Mail Removed)> wrote:
>
> >NoNeedToKnow wrote:
> >> From your PCs, you will be trying to reach your router's port 8080,
> >> and that's why it cannot connect.
>
> >Sorry, I don't follow. Why wouldn't my systems be able to go to my
> >router's port 8080?
>
> This will be from the LAN side, not the WAN side, so won't be forwarded.
> The router (unless you've changed the port setting) will likely answer
> only if you call up the config menu on port 80, so will give no response
> on port 8080 (but remember it's not forwarding).