reaching a server behind a NAT

[Christopher Svanefalk]

Hey all,

sorry if this is not purely Fedora related, but I was hoping I might get
some feedback anyhow from someone who knows more than I do.

I have this:

A NAT-configured router between my house and the internet.
A NAS behind the router.
A dyndns account, set up and pointing to the global address of the router.

I want to be able to reach the NAS from the internet. However, trying to
do so (including attempts to bind to specific ports on the NAS) simply
do not work, and I cannot tell why.

I have set up the router to port-forward the correct portcalls to the
NAS, but that does not solve anything.

So I am stuck, any tips?

Best,

Chris

[Christopher Svanefalk]

On 09/05/2011 05:55 PM, Tom Horsley wrote:
>  On Mon, 05 Sep 2011 17:20:28 +0200
>  Christopher Svanefalk wrote:
>
> > I want to be able to reach the NAS from the internet. However, trying to
> > do so (including attempts to bind to specific ports on the NAS) simply
> > do not work, and I cannot tell why.
>  Sometimes it depends on where you are coming from as well. I know
>  at work the IT department got all paranoid and blocked just about
>  every outgoing port except http and https, so to ssh in to my
>  home box, I taught my router's firewall to forward incoming https
>  requests to ssh on my home system, and now as long as I tell
>  ssh to use the right port number, I have no problem getting
>  into my home system from work. Silly, but functional :-). 
Not sure how I could do this over my home router though. I am pretty
sure it runs Linux of some sort (got a GPL notice in the box), so it
might be worth seeing if I can haxx my way to a terminal somewhere.

[Jatin K]

On Thursday 08 September 2011 12:13 AM, Christopher Svanefalk wrote:
>  On 09/07/2011 06:33 AM, Jatin K wrote:
> > On Monday 05 September 2011 08:50 PM, Christopher Svanefalk wrote:
> >> Hey all,
> >>
> >> sorry if this is not purely Fedora related, but I was hoping I might get
> >> some feedback anyhow from someone who knows more than I do.
> >>
> >> I have this:
> >>
> >> A NAT-configured router between my house and the internet.
> >> A NAS behind the router.
> >> A dyndns account, set up and pointing to the global address of the router.
> >>
> >> I want to be able to reach the NAS from the internet. However, trying to
> >> do so (including attempts to bind to specific ports on the NAS) simply
> >> do not work, and I cannot tell why.
> > what protocol do you use ?? 
did you tried your NAS in DMZ mode ( add your NAS
IP in DMZ mode on 
router ) ??? is it working ??

-- 
   °v°
  /(_)\
   ^ ^  Jatin Khatri
RHCSA,RHCE,CCNA
Registerd Linux user No #501175
www.counter.li.org
No M$

[Genes MailLists]

On 09/08/2011 06:52 AM, Christopher Svanefalk wrote:

> > did you tried your NAS in DMZ mode ( add your NAS IP in DMZ mode
> on 
> > router ) ??? is it working ??
> >
>  
>  Will try that when I get home, sitting at a lecture right now 

 Security comment - I assume you don't actually care that your NAS is
exposed directly to the internet?

[Christopher Svanefalk]

On 09/08/2011 06:26 AM, Jatin K wrote:
>  On Thursday 08 September 2011 12:13 AM, Christopher Svanefalk wrote:
> > On 09/07/2011 06:33 AM, Jatin K wrote:
> >> On Monday 05 September 2011 08:50 PM, Christopher Svanefalk wrote:
> >>> Hey all,
> >>>
> >>> sorry if this is not purely Fedora related, but I was hoping I might get
> >>> some feedback anyhow from someone who knows more than I do.
> >>>
> >>> I have this:
> >>>
> >>> A NAT-configured router between my house and the internet.
> >>> A NAS behind the router.
> >>> A dyndns account, set up and pointing to the global address of the router.
> >>>
> >>> I want to be able to reach the NAS from the internet. However, trying to
> >>> do so (including attempts to bind to specific ports on the NAS) simply
> >>> do not work, and I cannot tell why.
> >> what protocol do you use ??
>  did you tried your NAS in DMZ mode ( add your NAS IP in DMZ mode on 
>  router ) ??? is it working ??
>  
Will try that when I get home, sitting at a lecture right now

[Reindl Harald]

Am 08.09.2011 16:25, schrieb Christopher Svanefalk:
>  On 09/08/2011 01:51 PM, Genes MailLists wrote:
> > On 09/08/2011 06:52 AM, Christopher Svanefalk wrote:
> >
> >>> did you tried your NAS in DMZ mode ( add your NAS IP in DMZ mode on 
> >>> router ) ??? is it working ??
> >>>
> >> Will try that when I get home, sitting at a lecture right now
> >
> >  Security comment - I assume you don't actually care that your NAS is
> > exposed directly to the internet?
>  
>  At the moment, not really.
>  
>  However, I believe that is a good point (and pardon my ignorance in
>  these matters). What would you suggest I do instead? Go over a VPN? 
yes!

[Reindl Harald]

Am 05.09.2011 17:20, schrieb Christopher Svanefalk:
>  Hey all,
>  
>  sorry if this is not purely Fedora related, but I was hoping I might get
>  some feedback anyhow from someone who knows more than I do.
>  
>  I have this:
>  
>  A NAT-configured router between my house and the internet.
>  A NAS behind the router.
>  A dyndns account, set up and pointing to the global address of the router.
>  
>  I want to be able to reach the NAS from the internet. However, trying to
>  do so (including attempts to bind to specific ports on the NAS) simply
>  do not work, and I cannot tell why.
>  
>  I have set up the router to port-forward the correct portcalls to the
>  NAS, but that does not solve anything. 
what protocol?

SMB is blocked by most ISP's and this is good so
use a vpn-solution or ssh -forwarding but never expose such appliance
never - really never! this appliances are most times not patched and
filesharing-protocols are unencrypted

[Jatin K]

On Thursday 08 September 2011 05:21 PM, Genes MailLists wrote:
>  On 09/08/2011 06:52 AM, Christopher Svanefalk wrote:
>
> >> did you tried your NAS in DMZ mode ( add your NAS IP in DMZ mode on
> >> router ) ??? is it working ??
> >>
> > Will try that when I get home, sitting at a lecture right now
>
>    Security comment - I assume you don't actually care that your NAS is
>  exposed directly to the internet? 
that suggestion is for testing only .... not permanent

-- 
   °v°
  /(_)\
   ^ ^  Jatin Khatri
RHCSA,RHCE,CCNA
Registerd Linux user No #501175
www.counter.li.org
No M$

[Christopher Svanefalk]

On 09/08/2011 01:51 PM, Genes MailLists wrote:
>  On 09/08/2011 06:52 AM, Christopher Svanefalk wrote:
>
> >> did you tried your NAS in DMZ mode ( add your NAS IP in DMZ mode on 
> >> router ) ??? is it working ??
> >>
> > Will try that when I get home, sitting at a lecture right now
>
>   Security comment - I assume you don't actually care that your NAS is
>  exposed directly to the internet? 
At the moment, not really.

However, I believe that is a good point (and pardon my ignorance in
these matters). What would you suggest I do instead? Go over a VPN?

[Christopher Svanefalk]

On 09/05/2011 06:19 PM, Genes MailLists wrote:
>  On 09/05/2011 11:20 AM, Christopher Svanefalk wrote:
> > Hey all,
> >
> > sorry if this is not purely Fedora related, but I was hoping I might get
> > some feedback anyhow from someone who knows more than I do.
> >
> > I have this:
> >
> > A NAT-configured router between my house and the internet.
> > A NAS behind the router.
> > A dyndns account, set up and pointing to the global address of the router.
> >
> > I want to be able to reach the NAS from the internet. However, trying to
> > do so (including attempts to bind to specific ports on the NAS) simply
> > do not work, and I cannot tell why.
>
>    One question - when you're testing this are you trying from an outside
>  internet account ? If you're trying to test this from within your
>  internal network (even via the outside public IP) it likely wont work. 
I have been trying from an external network, over the Internet. Still
nothing unfortunately :-/

[Christopher Svanefalk]

On 09/07/2011 06:33 AM, Jatin K wrote:
>  On Monday 05 September 2011 08:50 PM, Christopher Svanefalk wrote:
> > Hey all,
> >
> > sorry if this is not purely Fedora related, but I was hoping I might get
> > some feedback anyhow from someone who knows more than I do.
> >
> > I have this:
> >
> > A NAT-configured router between my house and the internet.
> > A NAS behind the router.
> > A dyndns account, set up and pointing to the global address of the router.
> >
> > I want to be able to reach the NAS from the internet. However, trying to
> > do so (including attempts to bind to specific ports on the NAS) simply
> > do not work, and I cannot tell why.
>  what protocol do you use ?? 
FTP for example, also HTTP for reaching various browser-based services.
I ran nmap and all services on the NAS are running over TCP, although I
doubt this is relevant.

> > I have set up the router to port-forward the correct portcalls to the
> > NAS, but that does not solve anything.
> >
>  which port you have forwarded ?? 
All the relevant ones (21 for FTP etc)

> > So I am stuck, any tips?
> >
> > Best,
> >
> > Chris
>

[Jatin K]

On Monday 05 September 2011 08:50 PM, Christopher Svanefalk wrote:
>  Hey all,
>
>  sorry if this is not purely Fedora related, but I was hoping I might get
>  some feedback anyhow from someone who knows more than I do.
>
>  I have this:
>
>  A NAT-configured router between my house and the internet.
>  A NAS behind the router.
>  A dyndns account, set up and pointing to the global address of the router.
>
>  I want to be able to reach the NAS from the internet. However, trying to
>  do so (including attempts to bind to specific ports on the NAS) simply
>  do not work, and I cannot tell why. 
what protocol do you use ??




>  I have set up the router to port-forward the correct portcalls to
> the
>  NAS, but that does not solve anything.
>  
which port you have forwarded ??
>  So I am stuck, any tips?
>
>  Best,
>
>  Chris 

-- 
   °v°
  /(_)\
   ^ ^  Jatin Khatri
RHCSA,RHCE,CCNA
Registerd Linux user No #501175
www.counter.li.org
No M$

[Tom Horsley]

On Mon, 05 Sep 2011 17:20:28 +0200
Christopher Svanefalk wrote:

>  I want to be able to reach the NAS from the internet. However, trying
> to
>  do so (including attempts to bind to specific ports on the NAS) simply
>  do not work, and I cannot tell why. 
Sometimes it depends on where you are coming from as well. I know
at work the IT department got all paranoid and blocked just about
every outgoing port except http and https, so to ssh in to my
home box, I taught my router's firewall to forward incoming https
requests to ssh on my home system, and now as long as I tell
ssh to use the right port number, I have no problem getting
into my home system from work. Silly, but functional :-).

[Genes MailLists]

On 09/05/2011 11:20 AM, Christopher Svanefalk wrote:
>  Hey all,
>  
>  sorry if this is not purely Fedora related, but I was hoping I might get
>  some feedback anyhow from someone who knows more than I do.
>  
>  I have this:
>  
>  A NAT-configured router between my house and the internet.
>  A NAS behind the router.
>  A dyndns account, set up and pointing to the global address of the router.
>  
>  I want to be able to reach the NAS from the internet. However, trying to
>  do so (including attempts to bind to specific ports on the NAS) simply
>  do not work, and I cannot tell why. 

  One question - when you're testing this are you trying from an outside
internet account ? If you're trying to test this from within your
internal network (even via the outside public IP) it likely wont work.

[Fernando Cassia]

On Mon, Sep 5, 2011 at 12:20, Christopher Svanefalk
<christopher.svanefalk(a)gmail.com&gt; wrote:
>  I want to be able to reach the NAS from the internet. However, trying
> to
>  do so 
You make it difficult to help you by not mentioning what PROTOCOL you
intend to use to access your NAS.

IF you intend to use FTP, for instance (some NAS servers feature a
built in ftp server) require that you use PASSIVE mode.

Others even offer a HTTP (web server) view of the files, in addition to NETBEUI

Depending on the protocols you intend to use, it's the different ports
you need to forward at your router/firewall.

FC

[Frank Murphy]

On 05/09/11 16:20, Christopher Svanefalk wrote:
>  Hey all,
>
>  sorry if this is not purely Fedora related, but I was hoping I might get
>  some feedback anyhow from someone who knows more than I do.
>
>  I have this:
>
>  A NAT-configured router between my house and the internet.
>  A NAS behind the router.
>  A dyndns account, set up and pointing to the global address of the router. 
Are you using their update script, on your server?
http://dyn.com/support/clients/


-- 
Regards,

Frank Murphy
UTF_8 Encoded
Friend of fedoraproject.org

[Genes MailLists]

On 09/05/2011 11:20 AM, Christopher Svanefalk wrote:
>  Hey all,
>  
>  sorry if this is not purely Fedora related, but I was hoping I might get
>  some feedback anyhow from someone who knows more than I do.
>  
>  I have this:
>  
>  A NAT-configured router between my house and the internet.
>  A NAS behind the router.
>  A dyndns account, set up and pointing to the global address of the router.
>  
>  I want to be able to reach the NAS from the internet. However, trying to
>  do so (including attempts to bind to specific ports on the NAS) simply
>  do not work, and I cannot tell why.
>  
>  I have set up the router to port-forward the correct portcalls to the
>  NAS, but that does not solve anything.
>  
>  
  I'm not sure I really understand your needs/goals - but if you're
looking to access your NAS server (NFS?) files over the internet you may
want something more like a vpn solution rather than opening up the box
to the internet (sounds insecure to me)

  If you you have a computer on the inside that sees the NAS files, you
could also forward a high port to the ssh port on that computer - then
use ssh to pull/push files ... some graphical file browsers know how to
use ssh to make the remote files 'appear' local in your GUI. I'd prefer
this be a computer behind the firewall rather than the firewall itself -
ditto for an VPN exercise.

  gene/

[Sam Varshavchik]

Christopher Svanefalk writes:

>  Hey all,
>
>  sorry if this is not purely Fedora related, but I was hoping I might get
>  some feedback anyhow from someone who knows more than I do.
>
>  I have this:
>
>  A NAT-configured router between my house and the internet.
>  A NAS behind the router.
>  A dyndns account, set up and pointing to the global address of the router.
>
>  I want to be able to reach the NAS from the internet. However, trying to
>  do so (including attempts to bind to specific ports on the NAS) simply
>  do not work, and I cannot tell why.
>
>  I have set up the router to port-forward the correct portcalls to the
>  NAS, but that does not solve anything.
>
>  So I am stuck, any tips? 
system-config-firewall provides a fairly simple way to set up port  
forwarding. But, it's a take-it or leave-it proposition. system-config- 
firewall will either take over all of your iptables configuration, or you  
have to roll your own on everything; however system-config-firewall does  
allow you to specify an external file with fixed iptables rules that gets  
incorporated into system-config-firewall-generated ones. So, you might be  
able to migrate to system-config-firewall, even if you have some custom  
rules installed.

Then, it's a matter of figuring out which ports need to be forwarded. Your  
problem may not necessarily be a firewall rule config issue, but knowing  
which ports you need to forward.