The dual router setup creates a nested NAT environment that breaks direct port forwarding for Nextcloud. To resolve this, you must configure Port Forwarding on the primary (internet-facing) router to point to the secondary (LAN) router, and then forward the specific HTTP/HTTPS ports from the secondary router to your Ubuntu 24.04 server. This ensures external DDNS traffic reaches your Nextcloud instance correctly.
Understanding the Dual Router Network Topology
In a typical home or small office setup with two routers, one acts as the gateway connected to the modem (Router A), and the second is connected via LAN to Router A (Router B). Router A performs Network Address Translation (NAT) for the entire local network. Router B also performs NAT for devices connected to it, such as your Nextcloud server running on Ubuntu 24.04.
This "Double NAT" scenario means that when an external user tries to connect to your public IP address, the request hits Router A first. Without explicit instructions, Router A does not know where to send the incoming traffic for your internal services. It simply drops the packet because no service is listening directly on its WAN interface for those specific ports. The solution involves creating a chain of forwarding rules that guide the traffic from the internet, through Router A, into Router B, and finally to your Nextcloud server's private IP address.
Verifying Your Network Configuration
Before configuring forwarding rules, you must identify the correct IP addresses involved in the chain. Log into the admin panel of both routers. Note the WAN IP address of Router A, which is your public IP. Then, note the LAN IP address assigned to Router B by Router A. Finally, confirm the static local IP address of your Ubuntu 24.04 machine hosting Nextcloud. Ensure that the Ubuntu server has a static DHCP reservation or a manually configured static IP to prevent address changes that would break the forwarding rules later.
Configuring Port Forwarding on the Primary Router
The first step is to tell Router A how to handle incoming traffic destined for your Nextcloud service. You need to set up Port Forwarding (sometimes called Virtual Server or Application Rule) on Router A. Access the web interface of Router A using its administrative credentials. Navigate to the section typically labeled "Port Forwarding," "NAT," or "Virtual Servers."
Create a new rule for TCP port 80 (HTTP) and TCP port 443 (HTTPS). Set the protocol to TCP. For the destination IP address, enter the LAN IP address of Router B, not the Ubuntu server itself. Save the configuration. This step effectively tells Router A: "Any traffic coming in on ports 80 or 443 should be forwarded to Router B's internal IP address." If you are unsure about the exact menu names, consult your router's manual, but the logic remains consistent across most brands like TP-Link, Netgear, or ASUS.
Configuring Port Forwarding on the Secondary Router
Once Router A is forwarding traffic to Router B, Router B must decide what to do with it. Since Router B also uses NAT, it will drop incoming packets unless told otherwise. Log into the admin panel of Router B. Locate the Port Forwarding or Virtual Servers section again. Create new rules for TCP ports 80 and 443.
This time, set the destination IP address to the static local IP of your Ubuntu 24.04 Nextcloud server. Save these settings. Now, the path is complete: Internet -> Router A (WAN IP) -> Router B (LAN IP) -> Ubuntu Server (Private IP). Test this locally by accessing your Nextcloud URL from a device on the same Wi-Fi network if possible, though true external testing requires moving off the local network or using a mobile data connection.
Handling UPnP and DMZ Alternatives
Some users might consider enabling UPnP (Universal Plug and Play) on both routers to automate this process. However, UPnP is often disabled by default for security reasons and can be unreliable in complex setups. An alternative is placing the Ubuntu server in the DMZ (Demilitarized Zone) of Router B. This exposes all ports on the server to Router B, which is generally less secure than specific port forwarding. If you use DMZ on Router B, you still need port forwarding on Router A to point to Router B. Always prefer specific port forwarding for better security hygiene.
For more details on managing firewall rules that might interfere with these connections, see
Iptables Command: A Guide to Firewall Configuration on Ubuntu Router.
Updating Nextcloud and DDNS Settings
With the network path established, you must ensure Nextcloud is aware of the external domain name provided by your Dynamic DNS (DDNS) service. In your Ubuntu terminal, navigate to your Nextcloud installation directory. Use the
occ command to set the overwrite host and overwrite CLI arguments. Run
sudo -u www-data php occ config:system:set overwritehost --value=your-ddns-domain.com. This forces Nextcloud to generate links using your DDNS domain rather than the local IP address.
Restart the Apache or Nginx service and PHP-FPM to apply changes. Check the Nextcloud log file at
/var/log/nextcloud/nextcloud.log for any errors related to trusted domains. If you encounter connection issues similar to remote access problems, review
Can't Connect to VM Remotely: Troubleshooting Guide for additional diagnostic steps regarding network reachability.
Testing and Troubleshooting Connectivity
To verify the setup, disconnect from your local Wi-Fi and use a smartphone on cellular data to access your DDNS domain. If the page loads, the port forwarding is working. If it fails, check the following:
- ISP Blocking: Some ISPs block ports 80 and 443 for residential customers. Try using alternative ports like 8080 or 8443, and update your DDNS provider to reflect the new port.
- Firewall Rules: Ensure UFW on Ubuntu allows HTTP and HTTPS traffic. Run
sudo ufw allow 80/tcp and sudo ufw allow 443/tcp.
- Cable Connections: Verify that the cable between Router A and Router B is plugged into a LAN port on Router A and the WAN/LAN port on Router B as specified by the manufacturer.
If you suspect routing issues affecting other services like VPNs, refer to
Routing Traffic Coming to OpenVPN Access Server to the VPN Not Working for advanced routing diagnostics.
Frequently Asked Questions
Why does my Nextcloud work locally but not externally?
This indicates that the internal network path is correct, but the external port forwarding rules are missing or misconfigured. Ensure that both the primary and secondary routers have forwarding rules pointing to the correct internal IPs for ports 80 and 443.
Can I use a single router instead of two?
Yes, using a single router simplifies the setup significantly as you only need one set of port forwarding rules. However, if you already have two routers, configuring them correctly as described above is a viable solution without replacing hardware.
What if my ISP blocks port 80 and 443?
Many residential ISPs block standard web ports. In this case, configure your Nextcloud to run on alternative ports like 8080 or 8443. Update your DDNS record to include the port number (e.g., mydomain.ddns.net:8080) and adjust the Nextcloud overwritehost setting accordingly.
How do I check if port forwarding is working?
Use an online port checking tool from a device outside your local network, or use your smartphone on cellular data to visit your DDNS URL. If the site loads, the ports are open. If it times out, the forwarding rules are incorrect or blocked by a firewall.
Do I need to disable the firewall on Ubuntu?
No, you should not disable the firewall entirely. Instead, configure UFW to explicitly allow traffic on ports 80 and 443. Disabling the firewall leaves your server vulnerable to attacks. Properly allowing only necessary ports maintains security while enabling connectivity.