How do I port forward if the public/external IP is shared on both my computers?

You can only forward port to one IP at a time

Your laptop has one internal IP, and your main computer another internal IP. Router cannot magically choose to which one of those to forward port 443. You must specify one or the other.

What you could do:

Forward port 4431 to one computer, and 4432 to another, and then let the client choose which one it wants by specifying https://name.example.com:4331/ for example
Make your laptop and main computer have same IP, but then there can only be one turned on at the same time - if you want to use laptop, you must first turn off desktop, and vice versa. But forwarding will then always go to the powered on computer
Floating IP. Have your laptop and main computer have different internal IPs, and make router forward to third internal IP - which you would put up as additional address to either laptop or desktop (but again, only of of them at the time). Advantage over (2) is that you can use both computers for other things; disadvantage is it is more work (unless you manage to script it)

UPDATE if you only want forwarding to your laptop to work, and you've removed forwarding to your main computer (ALL forwardning, not just port forwading - for example, removing main computer as DMZ), than it might be local linux firewall. Try (as root)

iptables -F INPUT; iptables -P INPUT ACCEPT

Matija Nalis

Posted 2016-08-20T11:46:38.773

Reputation: 2 107

Well, of course I opened the port for my laptop and it's own internal IP. It's only open for that one IP and not for my desktop computer or any other computer in my network. The problem is just that (imo) when canyouseeme.org or any other open port checking tool tries to connect to that specific port over my public IP first of all connects to my main pc and not to my laptop since both, my computer and laptop, share the same public IP address. – Psyqological – 2016-08-20T12:15:27.743

@psyqological sorry, the question was unclear. It seems now to me that you want only laptop to work? See the updated answer then, the original answer is only for forwarding to both computers – Matija Nalis – 2016-08-20T12:23:53.567

Yes, I do. To be honest, I don't really know how to remove forwarding to my main computer :/ I also tried the iptables command as root but nothing happens. Sorry for asking these totally retarded questions... – Psyqological – 2016-08-20T12:32:20.873

@psyqological do your connections always go to main computer? Can you confirm that is really the destination? Maybe canyouseeme.org connects to port 443 that is running service on your router, and not being forwarded anywhere? better try with some other uncommon port like 4431. What about when you remove all port forwarding? Do they stop going to main computer or still go there? That would indicate there is other option active for main computer somewhere (like DMZ). You must disable that first before playing with laptop. – Matija Nalis – 2016-08-20T12:36:03.340

I think my question is too unclear :D so if I enable the port for my main pc it's obviously not open at/on my laptops IP address. If I open the for my laptop it's not visible/accessible at/on my main computers ip address nor at/on the ip for my laptop. – Psyqological – 2016-08-20T13:26:08.910

@psyqological what does tcpdump -npi any port 443 say on your laptop when you try to connect from outside (canyouseeme.org) to it? And what does it say when you try to connect from your main computer to laptops internal IP and port 443? – Matija Nalis – 2016-08-20T13:30:58.720

Mhm, I'm new to this site. Could we somehow swap this to a private chat? – Psyqological – 2016-08-20T14:14:55.767

Nah, you'd need 20 rep, and its public anyhow. Just post the answers to questions here and/or update the question... – Matija Nalis – 2016-08-20T14:26:23.223

Ok, well I did enter the command you replied to me. Idkk what it does but I stopped it now, this it what came out at the end: 3984 packets captured 4002 packets received by filter 18 packets dropped by kernel – Psyqological – 2016-08-20T14:31:16.583

(man tcpdump would tell you what it does - shows any trafic for port 443). What I am interested in is what it does show when you try to connect from internal host, and what from external host (separated one from another). Put output on http://pastebin.com and link here , as more than just last line is needed to troubleshoot.

– Matija Nalis – 2016-08-20T18:13:41.030

When I type in tcpdump -npi any port 443 at first: http://pastebin.com/khNUCGQ7 Then before I activated the port 443: http://pastebin.com/cTtkAwhV After that I activated the port for my laptop: http://pastebin.com/FBN62SwB

– Psyqological – 2016-08-20T20:09:59.530

just to check - after you activated port 443 forwarding to your laptop, you tried to connect to it from outside (with canyouseeme.org)? if you did, there is no trace in that last log you posted - it should show canyouseeme connecting to 192.168.178.21:443. And that means that problem is happening before linux laptop - eg. your router never did that port forward for some reason (maybe it also has DMZ configured). You could try reseting it to factory defaults and setting up from scratch if you're comfortable with that. – Matija Nalis – 2016-08-20T20:41:24.327

Yea, I already thought about that. I mean it's just weird that it works if I open the port for my main PC but does not for my laptop. That's why I think canyouseeme.org for example tries to connect to that specific IPv4 address with the specific port but since my main computer were in the network first and it's sharing the IP with my laptop it tries to send the request to my windows PC first... if that makes any sense lol – Psyqological – 2016-08-20T20:59:47.243

Alright, I checked. No DMZ. I could activate DMZ tho (for any computer) by port forwarding "exposed host" though – Psyqological – 2016-08-21T11:16:37.023

As a workaound, you can try setting your linux laptip as DMZ exposed host and checj if it works then – Matija Nalis – 2016-08-21T11:20:23.033

Tried that too and checked every common port. Doesn't work. It could be something like the firewall blocking the incoming traffic since I'm able to get access when using "nc -lvp <port>" //EDIT: exposed host works with "nc -lv". So it has to be something blocking the incoming traffic – Psyqological – 2016-08-21T12:14:26.857

Try some other port, for example 4431. As said before, it is possible that router itself is using/blocking port 443 access. – Matija Nalis – 2016-08-21T13:29:40.673

1So... I changed the port to 4444 and it didn't work. But then I just tried using the port in Veil and Metasploit to infect a windows 10 virtual machine and it worked. Since I did that the port is accessible somehow. I don't really know how and why but okay :D – Psyqological – 2016-08-21T19:16:37.237

I apologize this is in german but idk how to change the language: https://gyazo.com/aca84a76069ccdc46bbb25a2d08d7db8 - you should still be able to identify what I did there. The local IP is from my laptop, the "superuser.com" is just the name. I could type in everything, it doesn't matter and the port is 443.

– Psyqological – 2016-08-20T12:03:50.923

How do I port forward if the public/external IP is shared on both my computers?

Answers