How to set up port forwarding to an internal web server

[mossywell]

Version 1.0

There have been many users stating incorrectly that port forwarding doesn't work on the Sky router, so I decided to write a click-by-click guide on how to set up port forwarding to allow a web server that is running on the internal network to be accessible from the Internet. This guide does not explain how to set up the web server - it assumes that you already know how to do this. The whole lot takes about 30 seconds (well, testing adds a few minutes more). I'd like to thank isu for trying out these instructions to prove that, yes, it really does work after all.


Beware: when publishing an internal web server to the Internet, the bandwidth that users will experience will be limited to the upload, not download, speed. Also, you might want to ensure that you don't fall foul of the fair usage policy by running a high-usage web site!


A few assumptions to start with.

1. The only Internet connection you have is via the Sky router. If you have, for example, multiple Internet connections, or some clever internal routing between routers, then your port forwarding may not (probably won't) work.
2. The router is fresh out of the box or has been reset back to factory defaults. In addition, it is running the Sky firmware.
3. The internal IP address of the web server is 192.168.0.2 and your router is 192.168.0.1.
4. The web server is not using host headers (that is, it can be accessed via its IP address). If this assumption is meaningless to you, worry not: we'll test this in the first stage anyway!
5. The web server is using the default HTTP port: TCP port 80.
6. There are no local firewalls (including Windows firewall) running on the web server. If there is: stop it! It can be switched back on later, but for now, let's just get it working without the server's firewall.

Note: The instructions work with or without uPNP. Also, it is for web servers only. (OK, it can be adapted for any TCP or UDP port, but I'm strictly sticking to a web server in this guide lest it becomes over-complicated.)

Here goes...

1. Check that the web server is accessible internally by pointing a browser at it's internal (NOT external) address: http://192.168.0.2. If that doesn't work, fix the web server before continuing.
2. Log into the web interface of the firewall (the "admin", "sky" one).
3. On the main page, under the "ADSL Port" section, make a note of the "IP Address". You'll need this later for testing.
4. Click "Firewall Rules" on the left.
5. Under "Inbound Services" click the "Add" button.
6. Change the Service to "HTTP(TCP:80)".
7. Leave the action as "ALLOW always".
8. In "Send to LAN Server" enter the IP address of the web server: 192.168.0.2, using the tab key (not the full stop) to move between each part of the IP address.
9. Leave all the other fields as they are.
10. Click the "Apply" button.
11. On the next screen, click the "Apply" button (the one next to the "Cancel" button).

Testing that it works...

1. On a PC that is on the Internet (i.e. NOT one on the same network as the web server) such as at an Internet cafe, fire up a web browser and point it to the public IP address of your Internet connection. This is the IP address that you made a note of in stage 3 above. For example, if the address you made a note of is 199.1.2.3, from the Internet cafe, you'd enter http://199.1.2.3 into the web browser.
2. If you've followed the instruction to the letter, the web page should appear and you have port forwarding working.

All that remains is:

1. Switch the firewall on the server back on (assuming there was one in the first place and you still want to run it). Test again. If it breaks, fix the web server's firewall.
2. Get the router's WAN IP address into a dynamic DNS service such as Dynamic Network Services, Inc. -- DynDNS -- Welcome. The "how to" do this is outside the scope of this guide.

[topct4]

this guide is great i followed it excatly and it does work for me

ty

[Keiran2K8]

Nice guide mate, Explains the confusion over External & Internal IP use of WebServers perfectly!

[mossywell]

Non-web server post moved to new thread here: Port forwarding to counterstrike server

[Andromedan]

Hey dudes, i did this, & it will not work.... The Connection is just timing out every time, no matter what i do, it only works from internal network computers on an internal IP address.

FTP is blocked as well, even though i have defined the rules in the router's firewall.....

Can anyone help with this?

Cheers.

EDIT: I got it sorted, was a DNS problem!

[mossywell]

That's why it is best to get everything working on the IP address first, before trying the name. DNS can cloud the issues.

[mossywell]

Question about mailbox in Poland and OE moved here: Outlook Express Settings

[duncanwatts01]

dsafds

[david-stone]

hi - i'm really struggling to get this working!

i have followed the above instructions and configured my router firewall to allow inbound services on http(80) and to forward them on to my pc (webserver) (in this case 192.168.0.2)

i am running IIS on XP and have a test website set up. i have also disabled the windows firewall for the time being.

testing my website internally:

locally on my pc (webserver) i can type 'http://192.168.0.2/websetup1/test.htm' into a browser and sure enough i get my test page.

however if i type in 'http://90.202.102.171/websetup1/test/htm' (90.202.102.171 in this case is my router's current ip) then i get a 404 page not found. (this test was done from my webserver NOT in an external internet cafe as suggested - this only thing i haven't followed from the instruction is the external testing but i did not think this would matter??)

any help here would be greatly appreciated.

many thanks in advance.

dave.


(n.b i have the standard sky netgear dg834gt)


Just reading through the instructions again the line....

"Check that the web server is accessible internally by pointing a browser at it's internal (NOT external) address: http://192.168.0.2. If that doesn't work, fix the web server before continuing."

doing this i get the familiar logon box asking for a user name and password (the same as you would get for the router "admin"/"sky" password box. Does this suggest i may have iis configured correctly? Although, http://192.168.0.2/websetup1.test.htm DOES work. Not sure if this is relevant - just trying to give as much info as possible in the hope someone can help me out here - cheers!

[david-stone]

ahah!!

scratch the above - i've sussed it.

for anyone reading and who may fall into the same trap i hope the following helps......

read my line "......(this test was done from my webserver NOT in an external internet cafe as suggested - this only thing i haven't followed from the instruction is the external testing but i did not think this would matter??)

well it turns out that it does matter!! i cant think why - some dns wizardry which i would love to understand. The point is though, internallly and externally

'http://90.202.102.171/websetup1/test.htm'

will behave differently. i found this out when i used my dial-up and everything worked.

i hope this will save someone else some time.

cheers,

dave.