0

I'm unsure if this is where to post this (as opposed to onto the Network Exchange), but since it involves Linux and networking is universal, so I'll post it.

I have two Linux computers running Fedora-36, as follows:

  • 192.168.0.16 -- host01 (Open ports: 22, 443)
  • 192.168.0.31 -- host02

On my ISP ROUTER, I PORT-FORWARD requests to port 22 & 443 to host01.

Here is my issue issue:

From within host02, there are no access issues:

user@host02$ nc -vz MY-ISP-WAN-IP 443

Ncat: Version 7.92 ( https://nmap.org/ncat )
Ncat: Connected / succeeded to MY-ISP-WAN-IP:443.
Ncat: 0 bytes sent, 0 bytes received in 0.04 seconds.


user@host02$ nc -vz MY-ISP-WAN-IP 22

Ncat: Version 7.92 ( https://nmap.org/ncat )
Ncat: Connected / succeeded to MY-ISP-WAN-IP:22.
Ncat: 0 bytes sent, 0 bytes received in 0.04 seconds.

But from within host01, itself the destination of the PORT-FORWARDS, it gets stuck:

user@host01$ nc -vz MY-ISP-WAN-IP 443
Ncat: Version 7.92 ( https://nmap.org/ncat )
Ncat: TIMEOUT.

user@host01$ nc -vz MY-ISP-WAN-IP 22
Ncat: Version 7.92 ( https://nmap.org/ncat )
Ncat: TIMEOUT.

The same succeeds when specifying it's own name host01:

root@host01# nc -vz host01 443

Ncat: Version 7.92 ( https://nmap.org/ncat )
Ncat: Connected / succeeded to 192.168.0.16:443.
Ncat: 0 bytes sent, 0 bytes received in 0.03 seconds.


root@host01# nc -vz host01 22

Ncat: Version 7.92 ( https://nmap.org/ncat )
Ncat: Connected / succeeded to 192.168.0.16:22.
Ncat: 0 bytes sent, 0 bytes received in 0.03 seconds.

So PORT-FORWARD requests succeed in getting to the destination Host & Ports, except when the requests originate from that destination Host itself.

Any ideas? Thank you!

3
  • Do you have any nat or output rules in the firewall on host01? Or maybe your ISP Router messes up something
    – gabor.zed
    Commented Sep 7, 2022 at 14:17
  • The router is performing so-called NAT hairpinning. But it appears it fails when the client and the target are the same. You should for every case use tcpdump to see what traffic is sent and received when running nc on host01 (without any filter to not miss anything). The problem is most likely on the router. Of course this should be tested with firewall disabled first to not rule out any other problem.
    – A.B
    Commented Sep 11, 2022 at 11:00
  • Thanks guys. It's an ARRIS router. The Netgear before it (which ARRIS replaced) didn't exhibit this problem. So yeah, it's probably a rule in the modem. I'll read up on NAT hairpinning. Thank you.
    – NYCeyes
    Commented Sep 11, 2022 at 17:18

0

You must log in to answer this question.

Browse other questions tagged .