i can't quite word it in the tutorial, but this is what I'm talking about Public IP: 10.0.0.1 Private IPs 192.168.0.1, 192.168.0.2 and 192.168.0.3 connect to argos.com google.com and ebay.com through the same port, the router recieves these packets and converts their addresses to the routers public address, The server processes this information and sends packets back to 10.0.0.1, But now we have three different destinations with then address and port of 10.0.0.1:80, How does the NAT work from there? Would the same packet be sent to all three computers?
92875
I'm learning about private/public IPs, port forwarding and NAT, and still fail to see the answer to a simple question:  Suppose two users on the same network are communicating with a single server outside their network (say, me &amp; my wife send http requests to yahoo.com).  The server sees both users as a single public ip, and often - as in this case - communicating on the same port.  How does the router route the packets according to the two different connections? Is there any routing info inside the packet beyond ip/port?  Is there some 'session table' maintained somewhere? By whom and what exactly does it include?
84810
I understand the reason public IP addresses are necessary to be that if we only had MAC to move data between one host and another, the entire Internet would be one massively flat network. But what is the need for private IP addresses? Why can't routers just connect to local clients using their MAC address?
46636
There's two servers with the same network IP, and the only difference between them is the last two numbers like: 37.211.15.247 and 37.211.166.178. The Hosting Provider claims that the subnet mask for both networks is 255.254.0.0  When I try the command Tracert (Traceroute) to test the ping and to see what hops does it take to reach the destination server, I get different ping times and different forward path results which is strange because they are all located in the same company host.  Is there something wrong? Shouldn’t it take the same path too?  I have added the the full IP addresses to both servers as requested by some commenters. Well the two servers aren’t “International” anyways, so as far as I know, the only thing that comes to mind is the possibility that the two are configured on different subnetworks just like what . Though it’s suspicious.  UPDATE: After doing so much research, I found out the Subnet of these two hosts. They are on a /15 (255.254.0.0) subnet mask. Unfortunately, this is what that hosting provider claimed to me which is not true, and the true Subnet they apparently use is a /17 (255.255.128.0) Subnet mask. It turns out that they were definitely on different Subnets. That's why I got different traceroutes when I tested these two IPs 37.211.15.247 and 37.211.166.178  because they are clearly on different Subnets. Thank you everyone for these good answers, especially  his answer helped me a lot.
42125
Even though I have seen and read quite a few similar Q's I was still unable to understand what is required for me to be able to do this.  I have an internal network. One of the machines is a web server. The router is configured for NAT redirecting a specific port to to that machine.  A public domain name is configured using dynamic DNS to point to my external address.  So incoming communication hits the router from its WAN interface and gets pointed to the internal server on the right port.  But if I try to use my public domain name from another machine within my network if fails to be redirected to the server.    In a way I would like that the same NAT rules would apply not only to incoming traffic but to outgoing (sort-of) traffic and have it sent back to the right server.  Assuming this helps, my router (D-Link DSL-2760U) does support static routing, but I am not sure how to configure it. It has the following parameters:   IP Version DstIP/PrefixLength Gateway Interface Metric
119051
Why is IP Address listed with this notation 172.18.0.150/24? I mean the ip is 172.18.0.150 only why it haves /24?, and then whatever what subnet that is on should be someone else's worries, no?  3: eth0: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether f8:b1:56:ba:ae:ee brd ff:ff:ff:ff:ff:ff inet 172.18.0.150/24 brd 172.18.0.255 scope global eth0   If I want to reach 172.18.0.150 on some interface (ethX) on another computer I could add in the routing table of that computer:  ip route add 172.18.0.150/25 dev ethX or ip route add 172.18.0.150/24 dev ethX or ip route add 172.18.0.150/23 dev ethX or ip route add 172.18.0.150/8 dev ethX    right? So what does /24 really have to do with my address on my NIC? It seems it only has to do with routing, no? So why list it in ip addr?  Is 172.18.0.150/24 on the same "net" as 172.18.0.150/8 or are these two completely different IP addresses?
120321
Background: I have a very simple server program written in PHP. It's mostly working, but only as long as there is not more than one client per site.   Questions:   How does a NAT Router (typical SOHO router) know which internal client to send returning traffic? What methods might I use to differentiate between multiple clients behind NAT routers?
110812
I've got a Debian server, which I would like to wake up remotely using a tool like wakeonlan.  I have assigned the server a static internal IP 192.168.0.14 and set up the appropriate port forwarding in the router (which otherwise has a very limited admin interface).  When I am logged in to the same network, I can wake the server using the subnet IP, but I cannot wake the server using the public IP of the router.  What I do not understand: When the server is running and I listen on the server with netcat nc -ulv -p 9, I can see the packet coming in in both cases (both when sending to the subnet IP and when sending to the public IP of the router).  If the packet arrives in both cases, why does the machine wake up only in one of them?
54418
I have a web service running on debian 7 and listening on port 8080. I want to redirect 80 to 8080 for inbound connections and allow only port 80. Here is my iptables configuration:  root@localhost:~# iptables -v -L --line-numbers Chain INPUT (policy DROP 76 packets, 6266 bytes) num   pkts bytes target     prot opt in     out     source               destination          1       90  8898 ACCEPT     all  --  lo     any     anywhere             anywhere             2        0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:http 3     4515 3113K ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED  Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) num   pkts bytes target     prot opt in     out     source               destination           Chain OUTPUT (policy ACCEPT 4858 packets, 587K bytes) num   pkts bytes target     prot opt in     out     source               destination        and nat table:  root@localhost:~# iptables -L -n -v -t nat Chain PREROUTING (policy ACCEPT 14 packets, 2288 bytes)  pkts bytes target     prot opt in     out     source               destination              0     0 REDIRECT   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 redir ports 8080     0     0 REDIRECT   udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:80 redir ports 8080  Chain INPUT (policy ACCEPT 0 packets, 0 bytes)  pkts bytes target     prot opt in     out     source               destination           Chain OUTPUT (policy ACCEPT 841 packets, 53415 bytes)  pkts bytes target     prot opt in     out     source               destination           Chain POSTROUTING (policy ACCEPT 841 packets, 53415 bytes)  pkts bytes target     prot opt in     out     source               destination    i can't establish a connection from outside on port 80. What are likely deficiencies?
53097
I am attempting to set up a web server (nginx) that needs access to the internet while also being hooked up to an ELB but I am having trouble getting this solution working.  Details:   3 public subnets   a b c  3 private subnets   a b c  1 ELB   This has the three public subnets included in its default pool  1 NAT instance in public subnet   The various guides I have found useful for getting the public subnets hooked up to the ELB by pointing the subnets to the IGW.  These set ups do not take in to consideration the need for internet access.  When I change the route table for the single NIC from the IGW to the nat instance I get internet access but I lose the ability to connect to the ELB and visa versa, when I update the route table to use the IGW I lose the ability to connect to the internet.  I can allocate an EIP and give it access that way but was hoping to avoid exposing this server the internet via a public address if possible.  What I am thinking is that I can either 1) add a second NIC to the web servers that need internet access so they have a leg out via a NAT instance and also have a leg in the public subnet to connect to the load balancer or 2) I can use the nat instance as the gateway for my network.  Has anybody set something similar to this up?
26431
If several computers with local addresses (192.168.0.#) are connected to a router and each computer opens a web browser and requests a page over HTTP, when these TCP:80 packets are sent out, the router switches the local address with the static IP of the router (i.e. Provider given IP) so the server can reply to the appropriate address.   But how does the router know to which computer to forward the HTTP reply, since the TCP header does not contain the local IP address (does it?), and all computers are using port 80?  Does this have anything to do with the MAC addresses?   How exactly does this work?
50895
This is quite messed up, I know. Let me explain it all.  I have a dynamic DNS set on my router. I verified that, after port forwarding, I can connect to desired application (if I run something on port 1337 and forward the port to appropriate machine I can connect to it from outside with no issues).  Now, if I connect my Macbook to VPN and run something as described above, it works as expected. BUT, if I connect my machine running Ubuntu Server 16.04 to the VPN and run something or want to connect by ssh, it fails. I forwarded port I'm using for SSH connection on router. I also tried hosting a web server, which also failed.  What can I do about this issue? This doesn't make sense to me.  About Ubuntu Server machine: it's a clean install with openvpn client and ssh server configured, no firewall running, iptables not edited, connected to router via ethernet.  EDIT: Here are the routing tables:
104073
I have a Mikrotik RB2011 router, running RouterOS which connects to the internet via a static IP. In my lan I have two different servers, one that is on IP 192.168.89.11 and another on 192.168.89.12  My DNS (on cloudflare) resolves both myfirstserver.com and mysecondserver.com to my router's static IP.  Now, what I want to do is to somehow separate the traffic so all traffic for myfirstserver.com goes to 192.168.89.11 and traffic for mysecondserver.com goes to 192.168.89.12 (and both on port 80. I know I could just change ports but if these are servers publicly available, no user would set a different port than 80)  What I have tried so far, is to somehow mark the packets through mangle and then use that mark on NAT to do the proper dst-nat forward.  I try marking packets through either content or Layer 7 protocol regex (they work properly if the action is log. I can see them being logged correctly).  The thing is that after I mark them, it seems that NAT just ignores them and forwards the connection to the server that accepts the non-marked packets.  I think I have mixed up the order of filtering and the chains somehow.  Would someone be able to provide some pointers/assistance on how to accomplish this?  Thanks!  EDIT: My question is very specific, about marking packets in RouterOS on a Mikrotik router and checking the mark in NAT. it is not about whether i need a reverse proxy or whatever. Thanks  EDIT 2: @Cha0s asked my /ip firewall export so here it is:  /ip firewall layer7-protocol add name=haf1a regexp=haf1a  /ip firewall address-list add address=192.168.89.0/24 list=local add address=192.168.88.0/24 list=local add address=www.xxx.yyy.zzz list=local add address=192.168.87.0/24 list=local  /ip firewall filter add chain=input comment="default configuration" protocol=icmp add chain=input comment="default configuration" connection-state=established add chain=input comment="default configuration" connection-state=related add action=drop chain=virus comment="Drop 80 DoS attack" src-address-list=spammer add action=add-src-to-address-list address-list=spammer address-list-timeout=1d chain=input connection-limit=10,32 dst-address-list=!local dst-port=53 protocol=udp add action=drop chain=input dst-port=53 protocol=udp src-address-list=!local add action=add-src-to-address-list address-list=spammer address-list-timeout=1d chain=input connection-limit=30,32 protocol=tcp /ip firewall mangle add action=change-mss chain=forward new-mss=1422 out-interface=all-ppp protocol=tcp tcp-flags=syn tcp-mss=1423-65535  /ip firewall nat add action=masquerade chain=srcnat comment="default configuration" out-interface=ether1-gateway add action=masquerade chain=srcnat out-interface=pppoe-out1 add action=dst-nat chain=dstnat comment="No HAF mark" dst-address=www.xxx.yyy.zzz dst-port=80 packet-mark=!haf1 port="" protocol=tcp src-port="" to-addresses=192.168.89.41 to-ports=80 add action=dst-nat chain=dstnat comment="HAF mark" dst-address=www.xxx.yyy.zzz dst-port=80 packet-mark=haf1 port="" protocol=tcp src-port="" to-addresses=192.168.89.31 to-ports=80   where www.xxx.yyy.zzz is my external ip (static) and 192.168.89.31 and 192.168.89.41 my two servers inside my local network  My goal is to redirect any connections with haf1a in them (eg haf1a.lala.com) to the relevant server (192.168.89.31)
15666
This is a  about Active Directory DNS Settings. Related:     Assuming an environment with multiple domain controllers (assume that they all run DNS as well):  in what order should the DNS servers be listed in the network adapters for each domain controller? Should 127.0.0.1 be used as the primary DNS server for each domain controller? Does it make any difference, if so what versions are affected and how?
58997
I have a public ip as below which is static (my isp provided) as below:  IP Address: x.x.146.50 Subnet Mask:    255.255.255.240 Default Gateway:    x.x.146.49 DNS1:   x.x.1.196 DNS2:   x.x.7.196   But what is my Network, Broadcast and DNS (this scared me for ages, looking for a easy way to do 100% accurate calculating/math).  iface eth0 inet static     address x.x.146.50     netmask 255.255.255.240     network ????????????     gateway x.x.146.49     broadcast ?????????   Follow up: (short cut)  $ ipcalculator 8.8.8.8/28 Address:   8.8.8.8              00001000.00001000.00001000.0000 1000 Netmask:   255.255.255.240 = 28 11111111.11111111.11111111.1111 0000 Wildcard:  0.0.0.15             00000000.00000000.00000000.0000 1111 =&gt; Network:   8.8.8.0/28           00001000.00001000.00001000.0000 0000 HostMin:   8.8.8.1              00001000.00001000.00001000.0000 0001 HostMax:   8.8.8.14             00001000.00001000.00001000.0000 1110 Broadcast: 8.8.8.15             00001000.00001000.00001000.0000 1111 Hosts/Net: 14                    Class A  1) It tells me Broadcast what to copy and paste 2) It tells me Netmask what to copy and paste 3) It tells me Network what to copy and paste   Now its Easy! i was always finding them complex in my head to do manual calculation and server is down for 20 days :P. Not not anymore.
92715
I am running VMware Workstation 8 (build 471480). I want to setup a small content server, mainly for images and such for my website, on my desktop in a virtual server (just for the heck of it)... I now have everything installed on a VMWare virtual machine running Ubuntu Server and already have the web server running. I have tested it and it works fine within the network when accessing it from the host.  I now need to make it work on the public Internet and am planning on using noip.com, as i have done on many other occasions.  The problem is that my router is a Linksys E2500 and it only allows port forwarding to IPs within its subnet (192.168.2.**)  The host system connected to the router has an IP of 192.168.2.177. The VMware Workstation 8 virtual machine has a Network type of NAT and the IP for the server on it is 192.168.43.130.  I have already forwarded port 80 and 22 to 192.168.2.177, but how can i get my Windows 7 system to then forward that port to the server ip?
80945
I'm reposting  I asked on the  SE, bacause I have been redirected to Super User.  I have successfully set up two Linksys routers running DD-WRTv24 to do WDS. They have the same SSID, but different static local IP addresses. There is no security: it's just for testing; no Internet connection.   When I open my notebook, I see the SSID shared by the routers in the list of WiFi access points, and I can connect to it. Once connected, I can ping both routers' local IP addresses, so I know that the WDS is working. But I can't find a way to find out which of them I have actually connected to.  I wouldn't like to have different SSIDs, because I plan to have the access points hand-off users to one another, and I want it to be transparent for the users. I configured one AP to distribute DHCP IP addresses in one range, and the other in another range, so I can discover which AP I connected to at first, but I want a way to discover which AP I'm connected to now, so that I can find out whether the hand-off actually occurred.
115270
Is a "port"  a communication endpoint (in the transport layer)?  Is a "port number"   an address assigned to a port?  Given a port, can we change the port number assigned to it, similar to that it is possible to change the IP address assigned to a network interface? From      sockets with TCP port 53 and UDP port 53 are distinct sockets   What does the quote mean? Specifically,   Can a port be used by two transport protocols (e.g. TCP and UDP) simultaneously? (My understanding is that a port is part of a transport protocol, and can't belong to another protocol even at a different time.) Does the quote mean that a port number 53 can be assigned to a port in TCP  and to a port in UDP at different times (but not simultaneously)?