Networking – DDNS with No-IP does not work

DD-WRT is likely not configured for hairpin routing. Connecting to the Public IP from the LAN is usually a bad idea, and you will not be able to identify the connection source. The best option is to connect directly to the desired server from inside the network.

The Shorewall FAQ 2 covers doing configuring the router so that it will work. Shorewall builds an iptables firewall from a set of specification file, so the steps are not the required iptables commands, but map fairly easily to iptables. I believe you should be able to run shorewall-lite on DD-WRT, in which case you will need to build all your firewall in Shorewall rather than the DD-WRT tool.

Using split DNS is far easier and I would recommend that approach. A tool like dnsmasq can provide the necessary internal DNS from a /etc/hosts file. It acts as a caching server for addresses on the Internet. It also provides DHCP, do if you don't run it on your DD-WRT router, you will want to decide which DHCP server to enable. If you have the memory you can install in on DD-WRT as a replacement for the default DHCP server.

EDIT: If you choose to use dnsmasq it is best to set it up as the active DHCP server. If you don't run it on your router, disable DCHP on the routers. Alternatively, use fixed addresses outside the DHCP address range for the servers your want to route to. Using fixed addresses is a good idea for servers anyway. Add the addresses of the servers to the /etc/hosts file on the host running dnsmasq, and restart dnsmasq. If you configure dnsmasq with a domain, you can also lookup DHCP clients by name.

Determine the address of the dnsmasq host. (This should be a private network address like 192.168.0.10.) Configure your DHCP server to list this address as the first DNS nameserver. For linux hosts and others with a /etc/resolve.conf file use this address for the first nameserver entry. For other servers with static nameserver entries make this address the first specified address.

DHCP clients will need to have their DNS data updated. Triggering a DHCP renewal should update the data. Many systems have internal DNS caches, so the changes may not be visible immediately. Rebooting clients after all the server configuration has been done should clear all caches and reload DHCP specified configuration.

I eventually found an existing question that matched the symptoms I was experiencing. The solution worked for me as well, but I wanted to expand on it a bit.

Here's the step-by-step to enable the Virtual LAN in DD-WRT so that devices hard-wired to the router can communicate with each other (I'd love to know why this is not enabled by default):

1. Go to DD-WRT administration webpage (usually 192.168.1.1 on a home network)
2. Click on Administration tab
3. Click on Commands sub-tab

4. In the "Commands" text area, type:

   swconfig list
   

5. Click the button, Run Commands

   • You should see one of the following results (most likely):
     • Found: switch0 - eth0
     • Found: switch0 - eth1

6. Enter the following in the "Commands" text area (*note: replace eth0 with eth1 if needed to match the results of the swconfig list command):

   swconfig dev eth0 set enable_vlan 1
   swconfig dev eth0 set apply
   

7. Click the button Save Startup

8. Click on the Administration tab at the top of the screen
9. Scroll all the way to the bottom and click the red button Reboot Router
10. Verify the problem has been fixed following a router reboot

What the above steps do is save a startup script that runs whenever the router is rebooted. Saving it as a startup script is not necessary, but the alternative is that you would have to remember to run the two commands to enable the virtual LAN anytime the router got rebooted.

You could also run the commands to enable and apply the VLAN setting using the [Run Commands] button if you wanted to get immediate feedback without rebooting the router. I left that out because I was trying to minimize the total number of steps needed to achieve the desired end state.