This is my network

home net

I want to see my ip_camera ( from outside my house. It is on dd-wrt router ( without internet. The router has internet. However, i have a raspberry server with two interfaces connected to both routers: eth0 and eth1

So, this is what i did:

At router dd-wrt, web front end, Port Forwarding section, forwarded from any tcp/ip (from wan) at 10080 to lan

Then on Raspberry (with both ifaces eth0 and eth1, configured UFW like this:



net.ipv4.ip_forward=1 (/etc/ufw/sysctl.conf)

and in before.rules (at the beggining of the file), added following lines:

-A PREROUTING -i eth0 -p tcp -d --sport 10080 -j DNAT --to-destination

So, if i'm on a random client PC ( for example), i can reach perfectly my camera at browser on address:

meaning that it works ok. But i can't see my camera from outside the internet.

I tried adding to UFW:

ufw allow proto tcp from any to port 80

and restarted UFW, but not luck.

Can anyone give me a hand please?

I noticed these output tcpdumping my Raspberry Server, when i reach it from internet (

03:19:11.324244 IP > Flags [S], seq 2032441512, win 14600, options [mss 1452,sackOK,TS val 16154060 ecr 0,nop,wscale 8], length 0
03:19:27.131917 IP > Flags [S], seq 389083091, win 14600, options [mss 1452,sackOK,TS val 16155640 ecr 0,nop,wscale 8], length 0
03:19:27.359709 IP > Flags [S], seq 2032441512, win 14600, options [mss 1452,sackOK,TS val 16155664 ecr 0,nop,wscale 8], length 0

When i reach it from (my home network)

03:21:54.799050 IP > Flags [S], seq 2661860721, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
03:21:54.802330 IP > Flags [S.], seq 3834946478, ack 2661860722, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 1], length 0
03:21:54.803718 IP > Flags [.], ack 1, win 68, length 0

I observe different effects. On Lan (that is working properly), there is a bidirecctional communication on the way. However, my Raspberry server just can see incoming request from the internet but does not register any return to it. I think the key of my problem is there, but i don't know if i have to edit something in UFW (or somewhere else) to allow this bidirectional exchange.

May be related to "RELATED,ESTABLISHED" concept? i don't know...

many thanks. gtz, Sergio.

1 Answer 1


Conceptually you want to:

  • NAT from (r-Pi server IP?) to (camera) [DONE]
    • Check that this port forward works by accessing the camera via [CHECK]
  • NAT from to [Not done?]
    • Check that this port forward works by observing the traffic on
  • Open port on the outbound router [unknown];

You have correctly done the first step. Now all you need is another mapping between the Internet and your network. It is the same process so should be easy to implement. I don't use ufw or dd-wrt so you will need to research how it's done.

Your RELATED,ESTABLISHED rules should not be interfering. These are normally used in the INPUT chain to track known inbound connections and skip the remainder of the rule set.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .