# iptables: access internal webserver through extern IP

## mekki20

Heyho you Gentooists,

I have the following setup:

Internet <--> router with iptables (gentoo-box) <--> webserver (port 8080)

I also defined a forwarding rule so I can access the webserver from the outside:

```
iptables -t nat -A PREROUTING -p tcp -i $INTERNET_IF --dport 8080 -j DNAT --to 192.168.110:8080
```

I can reach the webserver from the outside, when I connect through a client somewhere on the internet.

But now comes the tricky part:  :Idea: 

I want to connect from the local network to my local webserver using the external IP of the router's $INTERNET_IF. So I would type into my browser:

http://<ip_of_external_nic_of_router>:8080

1. Is this possible at all?

2. If so, what do I need to add to my iptables-config?

I am sure, someone comes up with a good answer.

Greets from Melbourne

Christian

----------

## darktux

```

iptables -t nat -A PREROUTING -p tcp -i $IP_OF_THE_LAN --dport 8080 -j DNAT --to 192.168.110:8080

```

Just a guess though   :Wink: 

----------

## EnricoHorn

I would do it this way:

```

iptables -t nat -A PREROUTING -p tcp -d <external ip adress> --dport 8080 -j DNAT --to 192.168.110:8080

```

Hope this works.

----------

## mekki20

Thanks for your posts.

The 2nd one seems to be morelogically. But what do I do when the external IP changes? A cron-job? What a workaround?

Can't I just specify a the external interface instead of the external ip?

----------

## EnricoHorn

 *Quote:*   

> 
> 
> Thanks for your posts.
> 
> The 2nd one seems to be morelogically. But what do I do when the external IP changes? A cron-job? What a workaround?
> ...

 

I think you cant.

Cause packets from inside never touch the external interface!

I dont know if the following will work:

If you have a host name for your webserver:

Dont specify a IP-Adresse as the destination, specify a name.

Otherwise I dont have a clue how to make this.

----------

## mekki20

Hi thx,

I will try on Monday at work. Sounds good, since I have a registered domain name for that external interface.   :Smile: 

will post the results...

----------

