This is my network
I want to see my ip_camera (192.168.3.4:80) from outside my house. It is on dd-wrt router (192.168.3.1) without internet. The router 192.168.1.1 has internet. However, i have a raspberry server with two interfaces connected to both routers: eth0 192.168.1.0/24 and eth1 192.168.3.0/24.
So, this is what i did:
At router dd-wrt 192.168.1.1, web front end, Port Forwarding section, forwarded from any tcp/ip (from wan) at 10080 to lan 192.168.1.2:10080
Then on Raspberry (with both ifaces eth0 192.168.1.2 and eth1 192.168.3.2), configured UFW like this:
DEFAULT_FORWARD_POLICY="ACCEPT" (/etc/default/ufw)
and
net.ipv4.ip_forward=1 (/etc/ufw/sysctl.conf)
and in before.rules (at the beggining of the file), added following lines:
*nat
:PREROUTING ACCEPT [0:0]
-A PREROUTING -i eth0 -p tcp -d 192.168.1.2 --sport 10080 -j DNAT --to-destination 192.168.3.4:80
COMMIT
So, if i'm on a random client PC (192.168.1.15 for example), i can reach perfectly my camera at browser on address:
http://192.168.1.2:10080
meaning that it works ok. But i can't see my camera from outside the internet.
I tried adding to UFW:
ufw allow proto tcp from any to 192.168.3.4 port 80
and restarted UFW, but not luck.
Can anyone give me a hand please?
I noticed these output tcpdumping my Raspberry Server, when i reach it from internet (179.39.4.14):
03:19:11.324244 IP 179.39.4.14.41346 > 192.168.1.2.10080: Flags [S], seq 2032441512, win 14600, options [mss 1452,sackOK,TS val 16154060 ecr 0,nop,wscale 8], length 0
03:19:27.131917 IP 179.39.4.14.41345 > 192.168.1.2.10080: Flags [S], seq 389083091, win 14600, options [mss 1452,sackOK,TS val 16155640 ecr 0,nop,wscale 8], length 0
03:19:27.359709 IP 179.39.4.14.41346 > 192.168.1.2.10080: Flags [S], seq 2032441512, win 14600, options [mss 1452,sackOK,TS val 16155664 ecr 0,nop,wscale 8], length 0
When i reach it from 192.168.1.15 (my home network)
03:21:54.799050 IP 192.168.1.15.13094 > 192.168.1.2.10080: Flags [S], seq 2661860721, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
03:21:54.802330 IP 192.168.1.2.10080 > 192.168.1.15.13094: Flags [S.], seq 3834946478, ack 2661860722, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 1], length 0
03:21:54.803718 IP 192.168.1.15.13094 > 192.168.1.2.10080: Flags [.], ack 1, win 68, length 0
I observe different effects. On Lan (that is working properly), there is a bidirecctional communication on the way. However, my Raspberry server just can see incoming request from the internet but does not register any return to it. I think the key of my problem is there, but i don't know if i have to edit something in UFW (or somewhere else) to allow this bidirectional exchange.
May be related to "RELATED,ESTABLISHED" concept? i don't know...
many thanks. gtz, Sergio.