Port forwarding on DG8041W router

[David E James]

I am trying to set up a small web server, but when I try to forward port 80 to my device I get the message 'The configured port conflicts with the internal service port.'. I have given the device a static IP.

Looking at other threads, this seems to be a recurring problem. Please advise.

[Piethorne]

@David E James You're welcome.

[David E James]

Thank you everyone, I now have a working web server running on an old Raspberry pi. I have a domain name with a dynamic domain name service that also masks the port number on the address line of the browser.

[David E James]

Thank you for the link, they look very useful.

Thanks everyone else for your help.

[Piethorne]

Your WAN IP address is always unique. If you end up looking at your router login page, you have accessed the correct WAN IP, but have cocked up somewhere else.

You mentioned earlier you haven't yet got a domain name. I've written a help page, mainly as a reminder for myself, for setting up a Windows IIS Web Server, using the DG8041 hub and the DDNS provider Dynu.com where you can create a free, no nags, domain. It's at

http://piethorne.dynu.net/help/iiswebserver/index.html

Although it's written for Windows, the principles are the same for setting up, say, an Apache web server in Linux, or whatever the Pi uses (Debian?). As you can now access your site over the WAN, you may find "Step 3" and the 2nd part of "Step 4" useful.

Note that when you create or alter a domain name, it can take a few minutes to propagate through the internet nameservers, so be patient and go and make a brew before trying to access it - and don't forget to clear your browser cache when you make changes.

[David E James]

Thank you, I changed the port from 10080 to 9080 and, to my surprise, it worked. I was surprised because I had been experimenting with the external ip address and port number provided by https://myexternalip.com. When I entered  http://XX.XXX.XXX.XX/~41480/ into Safari it opened my router login page and I was able to log in. So I thought that TalkTalk were using the same ip address for many subscribers, each with a different port number. But since XX.XXX.XXX.XX:9080 works, this cannot be the case.

[Piethorne]

You may want to try a different port. Browsers are blocking port 10080 to prevent NAT slipstream attacks. See: https://secureteam.co.uk/news/tools/browsers-block-more-ports-to-prevent-nat-slipstream-attacks/ or just google something like "browsers blocking port 10080"

[KeithFrench]

There is nothing wrong with that rule at all. If you get a different page displayed from the web server when you come in like that, compared to if you access it locally on your network, I would think that this could either be a web server configuration error or some routing within the Pi. Does the Pi support any form of .pcap packet capture, such as Dumpcap?

[David E James]

 

[KeithFrench]

Please send me a screenshot of the PF rule so as I can check that for you.

[David E James]

Thank you. I don't yet have a domain name. I wanted to test my server first, so just wanted to use the external ip address. So I forwarded port 10080 to 80 in the router  and tried xx.xxx.xxx.xx:10080 in the browser on another device. But I just got an empty html page, which is not mine (just using the internal ip address works). However, I noticed that the external ip included a five-digit port number. This seems to imply that TalkTalk subscribers share an ip address. Do you have any suggestions as to how I can test my connection using the external ip address?

[KeithFrench]

Currently, with the DG8041W WiFi hub this is a firmware related bug. The only workaround is to use a different external port & translate it in the rule to port 80:-

External Port: 9080 (example, must be between 1024 and 65535)

Internal port: 80

Then people trying to access your webserver would need to use a URL specifying the external port like this:-

http://myddnsdomain.com:9080

Note the colon between the domain & port number.