|
|
|
@ -2,20 +2,18 @@
|
|
|
|
|
|
|
|
|
|
# What is a port
|
|
|
|
|
|
|
|
|
|
Ports solve the problem of how to make many applications communicate over
|
|
|
|
|
the network simultaneously.
|
|
|
|
|
An IP address identifies specific machine on a network,
|
|
|
|
|
**a port** identifies specific **application** running on that machine.
|
|
|
|
|
|
|
|
|
|
A port is **a number** between [1 - 65,535] that gets assigned by the OS
|
|
|
|
|
A port is **a number** between [1 - 65,535] that is assigned by the OS
|
|
|
|
|
to any application that wants to communicate over the network.
|
|
|
|
|
This number is then added to every **packet** that is transmitted by that application.
|
|
|
|
|
The system knows that any **respone** packets with that port number belong
|
|
|
|
|
to that one application.
|
|
|
|
|
Can be choosen at random, can be hard set.
|
|
|
|
|
|
|
|
|
|
![pic_port_header](https://i.imgur.com/pXqs2Rg.png)
|
|
|
|
|
![pic_port_header](https://i.imgur.com/TM0pOQN.png)
|
|
|
|
|
|
|
|
|
|
# How NAT / firewall works
|
|
|
|
|
|
|
|
|
|
* It **allows outgoing** communication on any port.
|
|
|
|
|
* By default, it **allows outgoing** communication on any port.
|
|
|
|
|
* But **drops incoming** traffic unless it is a response to communication
|
|
|
|
|
initialized from the inside.
|
|
|
|
|
|
|
|
|
@ -26,29 +24,60 @@ where to send it...
|
|
|
|
|
<summary><b>More details</b></summary>
|
|
|
|
|
|
|
|
|
|
NAT is implemented in your router.<br>
|
|
|
|
|
It allows communication between two networks.
|
|
|
|
|
It makes your **LAN side** devices able to connect with the
|
|
|
|
|
outside world - **WAN side,** through one public IP.
|
|
|
|
|
All that the "the internet" sees is one device it communicates with,
|
|
|
|
|
but the LAN side can have hundreds of them.
|
|
|
|
|
|
|
|
|
|
<!-- ![pic_nat](https://i.imgur.com/QGO5bO6.png) -->
|
|
|
|
|
|
|
|
|
|
When you visit some website you initialize the communication.
|
|
|
|
|
|
|
|
|
|
* Your browser picks a random port as the **source port** and sends a request at some IP
|
|
|
|
|
using a well known https port 443 as the **destination port**
|
|
|
|
|
* Then the browser is waiting for a response at that random port.
|
|
|
|
|
* This traffic goes through your router and all that info is kept for a time in its state table.
|
|
|
|
|
* This allows it to know that when packets start coming from that IP, with that
|
|
|
|
|
source port number now being the destination port, it is a response and it
|
|
|
|
|
know where to send it.
|
|
|
|
|
"The internet" *sees* just one device it communicates with,
|
|
|
|
|
at least at this network level.
|
|
|
|
|
|
|
|
|
|
![pic_nat](https://i.imgur.com/Nk7u4MP.png)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
#### LAN side initialized communication
|
|
|
|
|
|
|
|
|
|
* You visit a website, let's say `youtube.com`
|
|
|
|
|
* Your browser has some random port assigned by the OS,
|
|
|
|
|
this will be the **source port**.
|
|
|
|
|
The local IP address of the machine it runs on will be the **source IP**
|
|
|
|
|
* Browser/OS ask DNS servers for IP address of `youtube.com`,
|
|
|
|
|
the answer is `142.250.191.78` - **destination IP**
|
|
|
|
|
* Youtube is a website, standard for https is using port `443` - **destination port.**
|
|
|
|
|
* All requred information are there. Destination[ip & port] Source[ip & port].
|
|
|
|
|
* Packets are send.
|
|
|
|
|
* The browser now waits for a response at that random port.
|
|
|
|
|
* Since the router is the **default gateway**, thats where the packets arrive.
|
|
|
|
|
* The router saves all that info in its state table for a time, could be seconds,
|
|
|
|
|
could be days depending on protocol and [state](https://serverfault.com/a/481909).
|
|
|
|
|
* Router doing the NAT now replaces the **source IP address** of that one machine,
|
|
|
|
|
with its own wan IP address,
|
|
|
|
|
it might also change source port but that is not as important,
|
|
|
|
|
and sends it out in the direction of the **destination IP**.
|
|
|
|
|
* Response comes back, router knows it is a response because it's coming from the
|
|
|
|
|
IP that it contacted recently and the **destination port** it uses is the same
|
|
|
|
|
number that was used as the source port.
|
|
|
|
|
* It checks the state table for the **original source IP and source port**,
|
|
|
|
|
put them in, now as destination and off the packets go.
|
|
|
|
|
* The browser receives response on its assigned port, from the IP it contacted.
|
|
|
|
|
|
|
|
|
|
#### WAN side initialized communication
|
|
|
|
|
|
|
|
|
|
* Want to connect to a jellyfin server to watch some movies from browser.
|
|
|
|
|
* You know the IP address or the url.
|
|
|
|
|
You also expect it to run on default port jellyfin uses `8096`
|
|
|
|
|
* The browser makes the request.
|
|
|
|
|
* The router sees it coming at port `8096`, but where does it send it?
|
|
|
|
|
There is nothing in the state table, that would tell it.
|
|
|
|
|
* So it drops it, unless there is a port forwarding rule that says
|
|
|
|
|
that if something comes to port `8096` send it to this local ip address
|
|
|
|
|
and at that port...
|
|
|
|
|
|
|
|
|
|
Youtube explanation videos if you want deeper dive:
|
|
|
|
|
|
|
|
|
|
* [NAT - Network Address Translation.](https://www.youtube.com/watch?v=RG97rvw1eUo)
|
|
|
|
|
* [Public IP vs. Private IP and Port Forwarding](https://www.youtube.com/watch?v=92b-jjBURkw)
|
|
|
|
|
|
|
|
|
|
---
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
</details>
|
|
|
|
|
|
|
|
|
|
# Double NAT (CGNAT)
|
|
|
|
@ -58,21 +87,20 @@ Youtube explanation videos if you want deeper dive:
|
|
|
|
|
**Bad News.**<br>
|
|
|
|
|
It is very likely that even when you do everything 100% correctly,
|
|
|
|
|
you still wont get your ports open.<br>
|
|
|
|
|
The reason being that you are behind double NAT.
|
|
|
|
|
The reason being that your machine is behind double NAT.
|
|
|
|
|
**Your ISP** - internet service provider, has you behind its own NAT device
|
|
|
|
|
and that WAN side of your router is not really "the internet" but ISPs LAN side.
|
|
|
|
|
and that WAN side of your router is not really "the internet", but ISPs LAN side.
|
|
|
|
|
|
|
|
|
|
A way to try and check, is looking up your [public IP online](http://icanhazip.com/)
|
|
|
|
|
then loging on your router and finding somewhere the IP address of your WAN interface.
|
|
|
|
|
then log in to your router and finding somewhere the IP address of your WAN interface.
|
|
|
|
|
If they are the same then your are not behind double NAT and port forwarding
|
|
|
|
|
will work straight away.<br>
|
|
|
|
|
If they differ and some local IP is there, then there is still a chance it will work,
|
|
|
|
|
but you wont know till you try.
|
|
|
|
|
|
|
|
|
|
But if you are failing to make port forwarding work, it's time to call your ISP
|
|
|
|
|
and inquire about public IP, how much would it cost.
|
|
|
|
|
It can be few € extra to your monthly bill, or a one time payment,
|
|
|
|
|
or they just enable it for you for free.. you dunno till you call.
|
|
|
|
|
and ask about public IP, how much would it cost.
|
|
|
|
|
It can be few extra € to your monthly bill.
|
|
|
|
|
|
|
|
|
|
# Port forwarding
|
|
|
|
|
|
|
|
|
@ -101,8 +129,8 @@ Generally what to expect
|
|
|
|
|
* It would be called port forwarding, or a virtual server, or be under NAT section.
|
|
|
|
|
* **The port** on which to expect traffic is obviously a core information,
|
|
|
|
|
sometimes it is called a service port or an external port.
|
|
|
|
|
* **IP address** is required, so that the router knows where to send traffic
|
|
|
|
|
that comes to that external port.
|
|
|
|
|
* **IP address** is required, so that the router knows where on the LAN side
|
|
|
|
|
to send traffic that comes to that external port.
|
|
|
|
|
* The setup might offer option for **internal port**,
|
|
|
|
|
this can be often left empty, or the same port number is put there.<br>
|
|
|
|
|
It is there to give you option to run stuff on your LAN network on a different
|
|
|
|
@ -126,9 +154,7 @@ For testing we can use websites that will test if a port is open at specified pu
|
|
|
|
|
|
|
|
|
|
## Windows
|
|
|
|
|
|
|
|
|
|
![port_listener](https://i.imgur.com/A9fxIbi.png)
|
|
|
|
|
|
|
|
|
|
* [Find the ip address](https://www.youtube.com/results?search_query=how+to+find+ip+address+windows)
|
|
|
|
|
* [Find the local ip address](https://www.youtube.com/results?search_query=how+to+find+ip+address+windows)
|
|
|
|
|
of the machine you are planning to use for the test.
|
|
|
|
|
* Follow the instruction in Port forwarding section of this guide
|
|
|
|
|
and forward port `666` to the IP of that machine.
|
|
|
|
@ -137,6 +163,8 @@ For testing we can use websites that will test if a port is open at specified pu
|
|
|
|
|
* If a windows firewall notification pops up with a question, answer yes.
|
|
|
|
|
* Go to [portchecker.co](https://portchecker.co/), set the port to 666 and press Check.
|
|
|
|
|
|
|
|
|
|
![port_listener](https://i.imgur.com/A9fxIbi.png)
|
|
|
|
|
|
|
|
|
|
In windows it is also pretty useful knowing that you can go
|
|
|
|
|
`Task Manager` > `Performance` > `Open Resource Monitor` > `Network` Tab
|
|
|
|
|
|
|
|
|
|