Solved Beginners firewall question.

[Henk-J]

I wanted to install NGINX om my RT-AX82U, and used these instructions:
My firewall /jffs/scripts/firewall-start script is as follows:


#!/bin/sh
iptables -I INPUT -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -p tcp --dport 443 -j ACCEPT

I must be overlooking something, as the NGINX works ok inport 80 from the LAN side but when I want to access using the WAN side (using hotspot on my phone or antoher internt connection, , unfortunatly it does not work.
So how to make port 80/443 directly accessible from the WAN side? (I know I could try port forwarding)

 

[ColinTaylor]

I would start by confirming that nginx is actually listening on the WAN interface.

netstat -nlp | grep -E ":80 |:443 "

 

[Henk-J]

Yes it works, it even shows my costum index.html

Started with 80 only:

admin@RT-AX82U-4BD8:/tmp/home/root# netstat -nlp | grep -E ":80"
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 2121/nginx: master
tcp 0 0 :::80 :::* LISTEN 2121/nginx: master

 

[RMerlin]

Check that your rules are properly applied, with "iptables -L INPUT -vn".

Make sure your public IP isn't CGNAT, and that you aren't double NATed. Also, some ISPs might block well known service ports such as 80,443,25, etc...

 

[Henk-J]

Check that your rules are properly applied, with "iptables -L INPUT -vn".

Make sure your public IP isn't CGNAT, and that you aren't double NATed. Also, some ISPs might block well known service ports such as 80,443,25, etc...

Yes it works, it even shows my costum index.html

Started with 80 only:

admin@RT-AX82U-4BD8:/tmp/home/root# netstat -nlp | grep -E ":80"
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 2121/nginx: master
tcp 0 0 :::80 :::* LISTEN 2121/nginx: master

Solved: I had portforwarding configured. Overlooked it

 

[Justinh]

Can you expand on that a bit for the ignorant? You don't need port forwarding in this case, and it interfered? Is this NGINX server upstream of the firewall?

 

[Henk-J]

I had port forwarding configured a very looong time ago, forwarded port 80/443, to an internal ip, and completly forgot all about it.