How To Setup Port Forwarding

If you are considering hosting services (web service, FTP service, game server) on your home network computers accessible from the Internet, then port forwarding is a prerequisite. Port forwarding, also called port mapping, is a networking process, NAT/PAT, to allow a remote computer, from the internet, to be redirected to a port listening on a private network where a service is running.The NAT (Network Address Translation) / PAT (Port Address Translation) mechanism is enabled at the router level. Let’s look at the picture below as an example.

The “red” line represents the Internet traffic. A workstation makes a connection to my WAN IP address provided by my ISP, on the port 3389 (RDP). At the router level, the port value is checked against the existing port forwarding rules.

Once the rule is found, the router will “forward” the request to the local IP address (192.168.110.2) associated with the port, illustrated by “blue” line.

Prerequisites:

Have a Dynamic DNS setup.

Static IP on the servers or workstations hosting the services.

Workstations have their firewall is disabled or add an exception rule.

Steps Overview

1- Identify the host LAN IP address, from the command line or via the network interface properties

2- Identify the port listener associated with the service

3- Set up the port forwarding rule in the router

4- Connect to the service from a remote client

1- Get the LAN IP addresses

From the Command line

“Run” > “Start” > “cmd”

Type ipconfig at the prompt and hit the ENTER key.

From the output, the value that we are looking for is the “IPv4 Address”. Write down the value.

Here, I only care about the workstation IP address, thus, “ipconfig”. The switch /all returns a lot more information, such as “Default Gateway”, DNS servers, MAC address, DHCP server, leases.

From the Network Adapter Settings. Start > Control Panel > Network and Sharing Center > Change Adapter settings (#1)

Right Click on the active Network interface (#1) and “Status” (#2)

Click on “Details” (#1) and (#2) is the value for the local IP address

Identify the port.

Every server type application utilizes a port which is a unique value.

When a service is setup to accept connections from clients over a network, the architecture is called “client-server” model.

For a client to connect, and authenticates, to a service (hosted on a networked device), two pieces of information are required. The host IP address and the listening port.

For instance, terminal services or Remote Desktop Protocol listens on port 3389, Web Server (IIS or Apache) on port 80, FTP service on port 21.

The last information good to know is the protocol, TCP, UDP or both. When in doubt, select “Both” or “TCP/UDP”.

Setting up the port forwarding rule.

The set up occurs within the router. From the main menu, look for “Applications” and “Port Forwarding ” or “Port Range Forward”.

Based on my router, here are the detailed explanation for each value from top to bottom.

 

“Sequence Number”: This is just an incremental value

“Rule Name”: Mostly for record purposes. Come up with something explanatory in case the rule needs to be updated.

“Rule Enable”: In some cases, there may be a need to temporary disable the port forwarding rule.

“External Interface“: This field is specific to my router. It supports a Mobile WAN as a failover. In the event my internet service is unavailable, I could connect a USB mobile broadband and keep my network online.

“Protocol“: Choices are, TCP, UDP. TCP/UDP. In doubt, choose TCP/UDP.

“External Port Range“: Ordinary, the external port range matches the Internal port range. However for security purposes, we may want to change the external port value. I will discuss that point in the best practices section. What’s important for now is to understand the port forwarding concept.

“Internal IP“: Self explanatory, enter here the IP address of the application or service host.

“Internal Port Range“: Port value of the service running on the internal IP host. The services were going to make available and port number associated are, FTP 21, IIS 80 and RDP 3389.

RDP port forwarding rule

 

Web Server forwarding rule.

 

FTP port forwarding rule.

Connection from a remote client to the local service.

Remote Desktop Protocol:

From the remote computer, start the RDP client.

In Windows 7:

“Start” > “Run” > “mstsc”

[Alternative] “Start” > “All Programs” > “Accessories” > “Remote Desktop Connection”

Enter the computer hostname or public IP address (#1), click “Connect” (#2). On the next dialog box, (#3) is optional, check it if unsure then click “Connect” (#4)

 

If you are getting the authentication box, it means that the connection has been established and the port forwarding is functional. Enter your credentials (#1), it is NOT recommended to check “Remember my credentials” and this is valid for any form of authentication. If you happened to leave your computer unattended, a third party could gain access without the need to enter the username/password combo.

Click “OK” (#3) to authenticate and access the resource.

Success! I was able to establish a remote desktop control into my workstation from the internet.

Best practices:

Setting up port forwarding or port mapping will open up your network to the internet. Access to your computer resources from the internet requires two pieces of information, the WAN IP address or name server and the port number.

You do not want to advertize your IP address, in forums, social media networks.

You do not want to use the application or service default port as the incoming port on the WAN side. It is easy to guess the service based on the port. Once I know what service is behind that port, I know what client I would use and try to gain access to that resource.

In my example, if the port 3389 is opened, it is likely that the computer accepts RDP connections, therefore I would use a RDP client to connect. I still need to authenticate before I can access the workstation.

The idea is to pick a random port for the WAN incoming request. For this tutorial, I set the RDP port value to “4000”. Although the port is opened from the internet, it would take a lot of guessing to find out what is the real service I am running on the home network side.

 

Normally, to RDP into a computer there is no need to specify the port, but since it was changed from 3389, then it must be entered as shown in the screenshot below.

 

Conclusion:

Once you understand the port forwarding or port mapping concept, your data and computer resources can be accessed from anywhere as long as an internet connection is available.

Keep in mind that if your resources are accessible from the outside, you want to monitor your server(s) for unusual behavior, such as slowness, higher bandwidth usage, increase of disk space usage, connections logs (from the router), security logs (from Windows event viewer) and keep your antivirus up to date.

Reference from Article by Michael Nguyen (05/29/2014)

 

Natting - A little bit about Hair-Pin NAT ...

In the below network topology a web server behind a router is on private IP address space, and the router performs NAT to forward traffic to its public IP address to the web server behind it.



The NAT configuration would look like below:

/ip firewall nat
add chain=dstnat dst-address=1.1.1.1 protocol=tcp dst-port=80 \
  action=dst-nat to-address=192.168.1.2
add chain=srcnat out-interface=WAN action=masquerade

When a client out on the Internet with IP address 2.2.2.2 establishes a connection to the web server, the router performs NAT as configured.

1. the client sends a packet with a source IP address of 2.2.2.2 to a destination IP address of 1.1.1.1 on port tcp/80 to request some web resource.
2. the router destination NATs the packet to 192.168.1.2 and replaces the destination IP address in the packet accordingly. The source IP address stays the same: 2.2.2.2.
3. the server replies to the client's request and the reply packet has a source IP address of 192.168.1.2 and a destination IP address of 2.2.2.2.
4. the router determines that the packet is part of a previous connection and undoes the destination NAT, and puts the original destination IP address into the source IP address field. The destination IP address is 2.2.2.2, and the source IP address is 1.1.1.1.

The client receives the reply packet it expects, and the connection is established.
When a client on the same internal network as the web server requests a connection to the web server's public IP address, the connection breaks.

1. the client sends a packet with a source IP address of 192.168.1.10 to a destination IP address of 1.1.1.1 on port tcp/80 to request some web resource.
2. the router destination NATs the packet to 192.168.1.2 and replaces the destination IP address in the packet accordingly. The source IP address stays the same: 192.168.1.10.
3. the server replies to the client's request. However, the source IP address of the request is on the same subnet as the web server. The web server does not send the reply back to the router, but sends it back directly to 192.168.1.10 with a source IP address in the reply of 192.168.1.2.

The client receives the reply packet, but it discards it because it expects a packet back from 1.1.1.1, and not from 192.168.1.2. As far as the client is concerned the packet is invalid and not related to any connection the client previously attempted to establish.
To fix the issue, an additional NAT rule needs to be introduced on the router to enforce that all reply traffic flows through the router, despite the client and server being on the same subnet. The rule below is very specific to only apply to the traffic that the issue could occur with - if there are many servers the issue occurs with, the rule could be made broader to save having one such exception per forwarded service.

/ip firewall nat
add chain=srcnat src-address=192.168.1.0/24 \
  dst-address=192.168.1.2 protocol=tcp dst-port=80 \
  out-interface=LAN action=masquerade

With that additional rule, the flow now changes:

1. the client sends a packet with a source IP address of 192.168.1.10 to a destination IP address of 1.1.1.1 on port tcp/80 to request some web resource.
2. the router destination NATs the packet to 192.168.1.2 and replaces the destination IP address in the packet accordingly. It also source NATs the packet and replaces the source IP address in the packet with the IP address on its LAN interface. The destination IP address is 192.168.1.2, and the source IP address is 192.168.1.1.
3. the web server replies to the request and sends the reply with a source IP address of 192.168.1.2 back to the router's LAN interface IP address of 192.168.1.1.
4. the router determines that the packet is part of a previous connection and undoes both the source and destination NAT, and puts the original destination IP address of 1.1.1.1 into the source IP address field, and the original source IP address of 192.168.1.10 into the destination IP address field.

The client receives the reply packet it expects, and the connection is established.
However, the web server only ever sees a source IP address of 192.168.1.1 for all requests from internal clients regardless of the internal client's real IP address. There is no way to avoid this without either using a router that can do application level DNS inspection and can rewrite A records accordingly, or a split DNS server that serves the internal clients the internal server IP address and external clients the external server IP address.
This is called - among other terms - hair pin NAT because the traffic flow has clients enter the router through the same interface it leaves through, which when drawn looks like a hair pin.


Reference from MicroTik Docs web source.

How to install LAMP stack (Apache, MariaDB/MySQL and PHP) on CentOS

 

 LAMP stack is a popular server-side software stack which is used to build and run dynamic web sites and web applications on Linux platforms. The LAMP stack is composed of Apache (as an HTTP server), MariaDB or MySQL (as a database backend), and PHP, Perl or Python (as a server-side programming language), and hence the acronym "LAMP." Other variants of the LAMP stack exist, such as LEMP (nginx, MySQL, PHP), LAPP (Apache, PostgreSQL, PHP), LLPR (Lighttpd, PostgreSQL, Ruby on Rails), and so forth.

 

 

 

 

In this tutorial, I describe how to install and set up the LAMP stack with Apache, MariaDB/MySQL and PHP on CentOS server. This tutorial is applicable to CentOS 6 as well as CentOS 7 platforms.

Step One: Apache HTTP Server

As the first step, let's install Apache HTTP server on CentOS. We will also do basic configuration for Apache server afterwards, such as adding Apache service to auto-start list, and opening an HTTP port in the firewall.

Install Apache HTTP Server

$ sudo yum install httpd

Start Apache HTTP Server and Configure Firewall

On CentOS 6.0 and 7.0:

$ sudo systemctl start httpd
$ sudo systemctl enable httpd
$ sudo firewall-cmd --zone=public --add-port=80/tcp --permanent
$ sudo firewall-cmd --reload

On CentOS 6:

$ sudo service httpd start
$ sudo chkconfig httpd on
$ sudo iptables -I INPUT -p tcp -m tcp --dport 80 -j ACCEPT
$ sudo service iptables save

Test Apache HTTP Server

To test the installation, check if httpd daemon is up and running successfully.

On CentOS 7 or onward:

$ sudo systemctl status httpd

 

 

On CentOS 6:

$ sudo service httpd status

httpd (pid  2069) is running...

After confirming the status of httpd, open a web browser, and go to http://<web-server-ip-address> to see if you can load the default Apache web page. The screenshot below shows the default Apache web page on CentOS 6 (192.168.1.8) and CentOS 7 (192.168.1.11).

 

Note that the default document root directory of httpd is /var/www/html on both CentOS 6 and 7. Let's move on to the next step.

Step Two: MariaDB/MySQL

The next step is to set up a database backend for the LAMP stack, for which we have two choices: MySQL and MariaDB. While CentOS/RHEL 6 ships with MySQL server/client packages, CentOS/RHEL 7 moves away from MySQL, and instead offers MariaDB, a community-developed fork of MySQL, as a default database.

 

Below is how to install MariaDB/MySQL server, and set it up to start automatically upon boot.

On CentOS 7:

$ sudo yum install mariadb-server
$ sudo systemctl start mariadb
$ sudo systemctl enable mariadb

On CentOS 6:

 

Install MySQL server/client package, and start MySQL server as follows. 

$ sudo yum install mysql-server
$ sudo service mysqld start
$ sudo chkconfig mysqld on

 

As MariaDB and MySQL are compatible with each other in terms of APIs and command-line usage, the LAMP stack can be configured and operated pretty much the same way regardless of whether you choose MariaDB or MySQL.

 

As a security precaution, run the following add-on script which is included in the MariaDB/MySQL server package.

 

$ sudo mysql_secure_installation

 

 

This script will reconfigure the database server for server hardening purposes. For example, it will change (empty) root password, remove anonymous user, disallow remote root login, and remove a default test database.

Step Three: PHP

The last step in setting up the LAMP stack is to install PHP, a server-side scripting language which is responsible for creating dynamic web pages for users. At a minimum, the LAMP stack requires the following two packages installed.

 

$ sudo yum install php php-mysql

 

The php package adds PHP support to Apache HTTP server, and the php-mysql package allows PHP applications to access MariaDB/MySQL server. Besides those two required packages, there are many other useful PHP modules you can install depending on your requirements. For example:

• php-gd: needed for image processing in PHP applications.
• php-odbc: needed for ODBC database access in PHP applications.
• php-pecl-memcache: needed when setting up Memcached caching daemon.
• php-pgsql: needed for PostgreSQL database access in PHP applications.
• php-snmp: needed for querying SNMP-managed devices in PHP applications.
• php-xml: needed for parsing XML in PHP applications.
• php-soap: needed to support SOAP protocol in PHP applications.
• php-xmlrpc: needed to support XML-RPC protocol in PHP applications.

 

You can get a full list of available PHP modules by running:

$ yum search php-

 

Next, let's change the default timezone used by PHP applications. You will need to find out your timezone by using tzselect command.

 

$ tzselect

 

 

After you answer a series of questions, the tzselect will print out your timezone string (e.g., "America/New_York"). Open /etc/php.ini file with a text editor, and add the following line.

date.timezone = "America/New_York"

Don't forget to restart httpd after installing PHP.

 

On CentOS 7:

$ sudo systemctl restart httpd

 

On CentOS 6:

$ sudo service httpd restart

Finally, let's check whether PHP is working properly. For this, use the following command, and check if the output of phpinfo() shows up correctly.

 

$ php -r "phpinfo();" | more

 

Once you verify PHP command-line output, let's create a test PHP file as follows, and verify that the PHP file is loaded successfully by Apache HTTP server.

$ sudo vi /var/www/html/test.php

1	<?php phpinfo(); ?>

Go to http://<web-server-ip-address>/test.php in your web browser. You should see the following output.

 

Now you have successfully set up the LAMP stack!