- 0 Posts
- 7 Comments
The client will look up your domain at whatever DNS it uses. It will return your public IP.
Client will send a packet with that as destination. It will reach the router which goes ‘I know! The call is coming from inside the house!’ and sends it to the server without modification.
The server gets it and sends a response, but the response is addressed back to client’s local IP.
Client gets the response, but that packet’s origin (in the header) is server’s local IP.
Client goes ‘wtf, I didn’t call you?!’ And drops the packet, still waiting for a response with your public IP as its origin.
This can be solved with the router modifying the appropriate traffic’s headers so that the headers match the expected, called NAT Loopback, or by using IPv6 global addresses.
It might also work running a local DNS server that returns your server’s local IP for a given domain, but that might yield certificate errors, and won’t work if devices ignore the DNS coming from DHCP.
I was using straight firewall rules for some years, but lost the template when the NAT Loopback checkbox started working (OpenWRT).
Back in University (2010-2013), I lived in a dorm on campus that had internet through the university’s network.
It was extremely cheap and fast (100/100 at equivalent to 3 USD per month), but Internet access was metered with a max of 50 GB / month.
However, access to University resources was not metered, and every student had ssh access to the datacenter.
That -D was a godsend.
What about the third way?