Port Forwarding How to

Port forwarding is a technique that you can use on router to allow the computers from Internet to access your home network’s servers that only have private IP. Sometimes it’s also call virtual server by some router As most of us only have 1 public IP that binds to cable/DSL connection at home, it’s not possible to allow remote connection from Internet to internal servers without using this technique. However if you have set up a home network with all the computers NATed behind a router, you can enable port forwarding on router to allow remote connection.
Here is how it works, when the Internet packets hit cable/DSL router with particular destination port number, the router will forward the traffic to particular internal servers based on that destination port number.
When you do this configuration on router, you need to know the ports that used by the software/server that you plan to have port forwarding, and then configure the port information and also the computer IP that will run that application/server. That’s all… Also check on the router manual for more information on how to do it.

Here are some examples of the port forwarding usage by implementing on Linksys WRT54G router.
Example 1:
I’ve set up a temporary web server at home. I would like my friends to access the web server. After implementation, my friends can just open IE or other web browsers and key in my Internet connection’s public IP to access it.
Web Server
LAN IP: 192.168.1.150
Port: TCP 80

Example 2:
I would like to set up a Dune 2000 game server, so that can play the game with my friends that stay nearby. After implementation, I requested my friends to connect to my Internet connection’s public IP from his Dune 2000 game console to join the network game over Internet.
Dune 2000 Game Server
LAN IP: 192.168.1.160
Port: TCP 4000, TCP 1140-1234

Example 3:
I need my friend’s help to make Remote Desktop connection to my computer to do some printer troubleshooting. After implementation, he can make Remote Desktop connection by pointing to my Internet connection’s public IP.
Remote Desktop Enabled Computer
LAN IP: 192.168.1.10
Port: TCP 3389

D-Link calls Port Fowarding as "Virtual Server"

Advanced, optional
Port Forwarding (D-Link calls Port Fowarding as "Virtual Server")
Infrastructure Requirement:
If you have static or quasi-static IP and the "User Policy" of your ISP allows it, you can run an in-house web or mail servers.
Infrastructure obstacles:
Some paranoia ISPs don't allow you to run any servers, they change the IP address frequently or block the TCP/IP ports on their network routers , it is impossible for the outside world to reach you. The solution is to change to a more user friendly ISP or wait 10 years for these paranoia ISP kids to mature.  Some ISPs give you an IP address within the RFC1918 "private block", in that case, you will never be able to run in-house servers.
Disclaimer

Set the IP address of above "server" to a "static IP", e.g. 192.168.10.4
(subnet mask = 255.255.255.0,  gateway=192.168.10.1,  DNS see this page)
Optional Advanced:
According to Seawall's documentation, you can run a Microsoft PPTP-VPN server in-house behind this LRP-Seawall firewall. However, you need to add a module called ipfwd, see this page on how to add ipfwd module. I have not tested a Microsoft PPTP-VPN server behind this LRP to see if it really does work or not. Several people reported it does work by setting the VPN server to have all IP addresees merged into the same NIC card. Here are some tips from Microsoft on how to set up a PPTP server behind a NAT firewall. The LRP on this site is a NAT firewall.
Use of ftp or telnet is unsafe because of the unencrypted password of the ftp and telnet protocols. Also, due to the nature of the ftp protocol, ftp clients behind some brands of corporate firewalls will have trouble accessing your ftp server behind LRP firewall.
Some ISP use proxy server to intercept all your network traffic, in that case, despite the appearance that you have an "externally accessible" IP address, you cannot run servers in-house. Check with your local friends who use the same ISP as yours, to find out if that applies in your area. Or go to www.analogx.com to download a free, instant web server (look under software, network, Simple-Server) and install it at your friends computer and see if you can surf to his/her web site. You need to use the IP notation such as http://24.2.54.23/    See this page on how to find out his/her IP address. After that test, un-install the analogx web server on your friends computer.
Disadvantage: Alice, Bob and Charlie will have to use http://192.168.10.4/ to access your
own www server, instead of the usual http://www.mydomain.com/  this can be very annoying.

---

Opening of any port must be done with care and deliberations. Every port you open (port forward) reduces the overall safety of the firewall.

If you want to run a web server in-house behind firewall, instruct Seawall to "port forward" as follows: login as root, 3-package settings, 5-Seawall, 3-servers, add one line tcp   80   0.0.0.0/0   192.168.10.4 make sure there is a blank line before the << EOF >> marker Ctrl-S and Enter to save. Ctrl-C and (q) twice, (B) for backup, choose Seawall. Go back to the # prompt and type (there is no need to reboot the LRP) # seawall restart   For convenience, use a DNS service such as express.powerdns.net or equivalent. First, find out what your outside-world IP address is. Type ifconfig eth0 on the LRP, for example, IP address shows 24.113.118.30 To confirm that, use a web-based service that shows what your IP address is, for example, http://www.privacy.nb.ca/  or  http://network-tools.com/  or http://www.net.princeton.edu/cgi-bin/show_my_ip.pl above web method does not work if your web browser is set to use "proxy", to find out: Microsoft IE web browser: Tools...Options....Connections....LAN settings Netscape web browser: Edit...Preferences...Advanced...Proxies Go to express.powerdns.net and create an A-record, e.g., zebragreenhouse.powerdns.net and set the IP address of zebragreenhouse.powerdns.net to 24.113.118.30 The world can http://zebragreenhouse.powerdns.net/ and see your web site !    You internal users will have to use http://192.168.10.4/  Have your own domain name If you purchase a domain name (by paying a "Domain Registrar",), you have several choices: (1) If you register your domain with the expensive and overpriced registrars, they generally include DNS service, login to their DNS "control panel" to make www.yourdomain.com pointing to IP address 24.113.118.30 (geeky phrase is "create a A-record"). One registrar that is not too expensive but includes DNS service is www.domainfactory.com (2) Use an ultra-economical registrar (e.g. www.godaddy.com ) AND a free DNS service such as express.powerdns.com or www.zoneedit.com or dns.widge.net On the DNS server, create an "A" record and a "MX" record to point to 24.113.118.30 (3) You can find some place, perhaps your own home or your office (if your ISP allows it) with a static or quasi static IP address, run your own DNS server. You may want to use express.powerdns.com as a backup server. Some big-name, expensive, overpriced, registrars have broken software that do not allow you to add or change or delete the IP address of your primary and secondary DNS servers. This is a very big problem if your IP address is occasionally changed by your cable modem or ADSL company! Fortunately, www.godaddy.com  allows you the freedom to change the IP address of your primary and secondary DNS server and their software correctly "updates" your changes to the appropriate "top level name servers" in a timely manner, see this page. Now you can run a web server (and an email server) on 192.168.10.4 and the outside world can http://www.yourdomain.com  and send email to  boss@yourdomain.com This is what a small business needed: A domain name for recognition, a simple in-house, light duty web server and an in-house email server. The in-house web server can be a modest hardware running any version of Linux (most Linux includes Apache web server and some form of email server), or a Windows 2000/XP platform with apache-win32 as the web server. Recent policy changes at AOL and many ISP make their email servers reject email sent from "dynamic IP" and "residential IP" addresses, despite your servers are non-spamming. This has very serious implications to SOHO who want to free themselves from the restrictions of their ISP's mail hosting services. The work around is use the ISP's email server for sending mails (SMTP server), and use an in-house email server (such as exim) for receiving in-coming mails. Below is how to edit the file c:\cygwin\etc\exim.conf so that exim will not send mail directly to the outside world, instead, it sends to your ISP's SMTP server and then your ISP's SMTP server will send the mail again, so the outside world thinks it is coming from your ISP's. (For exim3 only) Open c:\cygwin\etc\exim.conf with EditpadLite, find the section that says "ROUTERS CONFIGURATION" below that line, add 4 lines: your_friendly_isp: driver = domainlist transport = remote_smtp route_list = * smtp.your_isp.net bydns_a substitute smtp.your_isp.net with the SMTP host name of your ISP.

If you want to run web server, e-mail server and dns server in-house behind LRP firewall, instruct Seawall to "port forward" as follows: login as root, 3-package settings, 5-Seawall, 3-servers, add several lines tcp  80  0.0.0.0/0   192.168.10.4 tcp  25  0.0.0.0/0   192.168.10.4 tcp  110  0.0.0.0/0  192.168.10.4 tcp  143  0.0.0.0/0  192.168.10.4   (you only need this line if you run an IMAP server) tcp  53  0.0.0.0/0  192.168.10.4 udp 53  0.0.0.0/0  192.168.10.4 make sure there is a blank line before the << EOF >> marker Ctrl-S and Enter to save. Ctrl-C and (q) twice, (B) for backup, choose Seawall. Go back to the # prompt and type (there is no need to reboot the LRP) # seawall restart If you want to run a secure web server (e.g. apache-ssl) in-house behind firewall, instruct Seawall to "port forward" as follows: login as root, 3-package settings, 5-Seawall, 3-servers, add several lines tcp  443  0.0.0.0/0   192.168.10.4 make sure there is a blank line before the << EOF >> marker Ctrl-S and Enter to save. Ctrl-C and (q) twice, (B) for backup, choose Seawall. Go back to the # prompt and type (there is no need to reboot the LRP) # seawall restart

If you want to run NetMeeting behind firewall to receive calls, instruct Seawall to "port forward" as follows:  (there is no need to do below if you only initiate calls). See Microsoft knowledge base Q158623 login as root, 3-package settings, 5-Seawall, 3-servers, add several lines tcp  389  0.0.0.0/0   192.168.10.4 tcp  522  0.0.0.0/0  192.168.10.4 tcp  1503  0.0.0.0/0  192.168.10.4 tcp  1720  0.0.0.0/0  192.168.10.4 tcp  1731  0.0.0.0/0  192.168.10.4 make sure there is a blank line before the << EOF >> marker Ctrl-S and Enter to save. Ctrl-C and (q) twice, (B) for backup, choose Seawall. Go back to the # prompt and type (there is no need to reboot the LRP) # seawall restart

If you want to run pcAnywhere behind firewall to receive calls, instruct Seawall to "port forward" as follows:  (there is no need to do below if you only initiate calls) login as root, 3-package settings, 5-Seawall, 3-servers, add two lines tcp  5631  0.0.0.0/0  192.168.10.4 udp 5632  0.0.0.0/0  192.168.10.4 make sure there is a blank line before the << EOF >> marker Ctrl-S and Enter to save. Ctrl-C and (q) twice, (B) for backup, choose Seawall. Go back to the # prompt and type (there is no need to reboot the LRP) # seawall restart

If you want to run MSN Game Zone behind firewall, instruct Seawall to "port forward" as follows: (the settings are sub-optimal because I don't know whether the proper ports are tcp or upd, I open both for now) (thanks to Dean Ireland of Calgary) login as root, 3-package settings, 5-Seawall, 3-servers, add lines tcp   6677  0.0.0.0/0  192.168.10.4 tcp  28800:29000  0.0.0.0/0  192.168.10.4 make sure there is a blank line before the << EOF >> marker Ctrl-S and Enter to save. Ctrl-C and (q) twice, (B) for backup, choose Seawall. Go back to the # prompt and type (there is no need to reboot the LRP) # seawall restart A large block of ports are open, this reduces the effectiveness of your firewall. If you want to run MSN Game Zone DX behind firewall, tell Seawall to "port forward" as follows: (the settings are sub-optimal because I don't know whether the proper ports are tcp or upd, I open both for now) (thanks to Dean Ireland of Calgary) login as root, 3-package settings, 5-Seawall, 3-servers, add lines tcp   47624  0.0.0.0/0  192.168.10.4 tcp   2300:2400  0.0.0.0/0  192.168.10.4 make sure there is a blank line before the << EOF >> marker Ctrl-S and Enter to save. Ctrl-C and (q) twice, (B) for backup, choose Seawall. Go back to the # prompt and type (there is no need to reboot the LRP) # seawall restart Also see Microsoft Knowledge Base Q159031 A large block of ports are open, this reduces the effectiveness of your firewall.

---

If you have 2 static IP addresses, you can use one IP address for the firewall and one IP address for the server (outside the firewall). Note that the server is "exposed" to the outside world without the LRP firewall protection.
There is no need to configure any "port forwarding" on the LRP in this configuration.

---

If you set up a email server in-house, make absolutely sure you add anti-spam measures (aka block relays) or else spammers will quickly find you and use your email server to send millions and billions of junk mails through your email server (they send continuously, non-stop, until your cable modem company or ADSL company finds out, or spam victims complain to your ISP, then your ISP will cut your wire!)
 

What is Port Forwarding?

There are a couple of concepts you need to know before you can understand port forwarding. I'm going to make a couple broad statements that are almost always true. For simplicity lets assume they are true for now.

1.) Every device on the internet has at least one ip address. The IP address is a number that is used to identify a device. For more information on ip addresses refer to our What is an IP Address page.

2.) Every IP address is divided up into many ports. When one computer sends data to another computer, it sends it from a port on an ip address to a port on an ip address. For more information on ports refer to our What is a Port page.

3.) A port can only be used by one program at a time.

Now that we've got those general concepts out of the way let's talk about NAT. NAT is an acronym for Network Address Translation. NAT takes one ip address and basically breaks it into many ip addresses.

Here the external ip address is broken into two internal ip addresses. The first ip address "IP Address1" is the gateway. While "IP Address2" is the ip address of the first computer. Take note that the router has two ip addresses. It has the external ip address, and an internal ip address which acts as the gateway for every computer on the network.

Excuse my rough drawing. Computers on the internal network can only "see" internal ip addresses. So computers on the internal network can not send data directly to a computer outside of the network. When a computer on the network wants to send data to a computer outside of the network, it sends the data to the gateway. Remember the gateway is the internal ip address of the router. The router then takes this data and sends it out to the computer on the internet. The router sends the data out of the external ip address. The same thing is true of computers on the internet. A computer outside of the network can not "see" a computer inside of the network. They can only "see" and send data to the external ip address of the router. The router must then decide what to do with this data. Lucky for us NAT takes care of most of the work for us. There are some programs that NAT was not designed to work with, those are the programs we need to set up port forwarding for. Okay take a deep breath! We are on to port forwarding.

Now that you understand the general concepts of a network, explaining port forwarding is easy. When a computer on the internet sends data to the external ip address of the router, the router needs to know what to do with the data. Port Forwarding simply tells the router which computer on the local area network to send the data to. When you have port forwarding rules set up, your router takes the data off of the external ip address:port number and sends that data to an internal ip address:port number. Port Forwarding rules are created per port. So a rule set up for port 53 will only work for port 53.

A port can only be used by one program at a time! Think of how this rule interacts with NAT. Well you've only got one external ip address on your router. When computer 1 is using port 500, it is using port 500 on it's internal ip address. If you have set up a port forwarding rule for computer 1 and port 500, the external ip address's port 500 is also in use. This means that you can only use port 500 on one computer on the network at a time. Using port 500 on two computers at the same time would violate the one program rule, and your data would get messed up. Most routers require you to specify an internal ip address to forward ports to, just for this reason. Some do not, so be aware of this. Port Forwarding rules will only work for one computer at a time!

नामंजूर!

जपत किनारा शीड सोडणे — नामंजूर!
 अन वार्याची वाट पहाणे — नामंजूर!
 मी ठरवावी दिशा वाहत्या पाण्याची
 येईल त्या लाटेवर डुलणे — नामंजूर!

मला ऋतुंची साथ नको अन् कौल नको
 मला कोठल्या शुभशकुनांची झूल नको
 मुहुर्त माझा तोच ज्याक्षणी हो इच्छा
 वेळ पाहुनि खेळ मांडणे — नामंजूर!

माझ्याहाती विनाश माझा! कारण मी!
 मोहासाठी देह ठेवतो तारण मी!
 सुंदरतेवर होवो जगणे चक्काचूर
 मज अब्रूचे थिटे बहाणे — नामंजूर!

रुसवे — फ़ुगवे … भांडणतंटे … लाख कळा
 आपला — तुपला हिशेब आहे हा सगळा
 रोख पावती इथेच द्यावी अन् घ्यावी
 गगनाशी नेणे गार्हाणे — नामंजूर!

नीती, तत्वे … फ़सवी गणिते! दूर बरी!
 रक्तातील आदिम जिण्याची ओढ खरी!
 जगण्यासाठी रक्त वहाणे मज समजे,
 पण रक्ताचा गर्व वाहणे — नामंजूर!

संदीप खरे व सलील कुलकर्णी