1

I have a home router which uses NAT for the home network. I have a debian 10 machine on it on IP 192.168.0.60 that is listening to port 5000 via a small web application. I would like to be able to access this port from the public internet.

From debian, curl localhost:5000 yields the correct response.

From my mac, 192.168.0.55, curl 192.168.0.60:5000 yields the correct response.

To open it to the internet, I configured the router to port forward 5000 -> 192.168.0.60:5000.

However, when I use curl $PUBLIC_IP:5000 from an external device (i.e. not in the network), I do not get anything. https://www.yougetsignal.com/tools/open-ports/ also yields port closed.

My first guess is that this would be a trivial port forwarding issue on the router. To rule out this situation, I did the following:

  1. ran the same application on my mac, listening to 5000
  2. changed the port forward rule on the router to 5000 -> 192.168.0.55:5000 (my mac)
  3. used https://www.yougetsignal.com/tools/open-ports/ to validate that the port becomes open

I.e. this rules out the router, and puts the culprit on the debian machine. And at this point I am lost: how come that I can curl it from my local network and not from the internet?

The iptables reads:

root@debian# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
  • What are some possible differences between the Debian and the Mac computers? Are both addresses static, both DHCP, or is each address allocated differently? Also, is maybe one connected via Ethernet and the other wirelessly? Last, do you have an open OS like OpenWrt running on the router? If not, you should be ... then you can debug it on the router. – q.undertow May 7 at 6:38
  • Debian now uses nftables by default. What does nft list ruleset show? – garethTheRed May 7 at 7:56
  • Good debugging strategy by the way. Your testing does suggest the issue exists somewhere on your debian machine if you can get the setup working on your mac. Check your firewall with nft just in case you don't have the iptables transition tools. Check what's happening on the network with wireshark/tcpdump (whether the connection is coming in, etc). Check that your router is NATting traffic and that your connections are coming in from the Internet IP and that the router is your gateway. – Pedro May 7 at 15:22
0

The issue was that there was a non-trivial interaction between iptables-legacy and iptables. After clearing the iptables-legacy, it started working.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.