Portforwarding issue – cannot access from outside router

port-forwarding

I'm running a server on my local PC on port 8080. I can go to a browser and do http://localhost:8080 and it works.

I'll refer to my public IP as PUBLIC_IP and private/internal as PRIVATE_IP.

In the browser (running on server PC), I can also do http://PUBLIC_IP:8080 and http://PRIVATE_IP:8080 and both work.

I set up port forwarding in the router software as:

TCP external port 8080 >> internal port 8080 to my PRIVATE_IP device.

When I go to canyouseeme.org and enter my PUBLIC_IP and 8080 – I get:

"Error: I could not see your service on PUBLIC_IP on port (8080)"

I looked at the router logs and see:

[LAN access from remote] from 52.202.215.126:55574 to INTERNAL_IP:8080

I assume 52.202.215.126 is the ip address of canyouseeme.org server.

But it seems to be using port 55574 – instead of 8080. And it also changes on each request.

That's the external port that the router sees right?

But looks like the request is getting to the router – just not to my server – getting blocked?

I've turned firewalls off.

Any help appreciated.

Here's the tcldump logs – running on the server PC – so traffic is getting to the server PC.

Fulls-Mac-mini:conf mini$ sudo tcpdump 'tcp port 8080'
tcpdump: data link type PKTAP
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on pktap, link-type PKTAP (Apple DLT_PKTAP), capture size 262144 bytes
16:08:26.451497 IP ec2-52-202-215-126.compute-1.amazonaws.com.48092 > 192.168.1.12.http-alt: Flags [S], seq 3119124296, win 26883, options [mss 1460,sackOK,TS val 298290090 ecr 0,nop,wscale 7], length 0
16:08:26.451570 IP 192.168.1.12.http-alt > ec2-52-202-215-126.compute-1.amazonaws.com.48092: Flags [S.], seq 449444859, ack 3119124297, win 65535, options [mss 1460,nop,wscale 6,nop,nop,TS val 683632630 ecr 298290090,sackOK,eol], length 0
16:08:27.449719 IP ec2-52-202-215-126.compute-1.amazonaws.com.48092 > 192.168.1.12.http-alt: Flags [S], seq 3119124296, win 26883, options [mss 1460,sackOK,TS val 298290340 ecr 0,nop,wscale 7], length 0
16:08:27.449751 IP 192.168.1.12.http-alt > ec2-52-202-215-126.compute-1.amazonaws.com.48092: Flags [S.], seq 449444859, ack 3119124297, win 65535, options [mss 1460,nop,wscale 6,nop,nop,TS val 683633624 ecr 298290340,sackOK,eol], length 0
16:08:28.453107 IP 192.168.1.12.http-alt > ec2-52-202-215-126.compute-1.amazonaws.com.48092: Flags [S.], seq 449444859, ack 3119124297, win 65535, options [mss 1460,nop,wscale 6,nop,nop,TS val 683634624 ecr 298290340,sackOK,eol], length 0
16:08:29.453652 IP ec2-52-202-215-126.compute-1.amazonaws.com.48092 > 192.168.1.12.http-alt: Flags [S], seq 3119124296, win 26883, options [mss 1460,sackOK,TS val 298290841 ecr 0,nop,wscale 7], length 0
16:08:29.453700 IP 192.168.1.12.http-alt > ec2-52-202-215-126.compute-1.amazonaws.com.48092: Flags [S.], seq 449444859, ack 3119124297, win 65535, options [mss 1460,nop,wscale 6,nop,nop,TS val 683635624 ecr 298290841,sackOK,eol], length 0

My internal IP address is 192.168.1.12

The log is a result of https://www.canyouseeme.org/ using my public ip address + 8080.

When I look at Tomcat logs access file – there's no entry. So either it's refusing connection (and not listing it in the logfile) or it's not getting to Tomcat.

Best Answer

No, the connection attempt is correct.

Each TCP packet has two ports: source and destination, which can also be called local and remote. (So the connections don't go "through" a port; instead they go from one port at the sender, to a possibly different port at the recipient.)

The 'source' port is almost always chosen at random (to ensure that each connection has a unique port pair).

The port you see specified in URLs, port-forwarding rules, etc. is almost always the 'destination' port. (This applies to both the "external" and "internal" ports when doing NAT..) You've forwarded port 8080, and CanYouSeeMe is also making a connection to port 8080 on your side – so that's perfectly fine.

Related Question