To rewrite the destination IP address for a local server on a LAN using OpenWRT, you must configure Destination NAT (DNAT) rules within the firewall. This is typically achieved by editing the /etc/firewall.user file or using the LuCI interface to add a custom rule that redirects incoming traffic from a public or external IP to your internal server's private IP address.
Understanding the Network Context
Before applying any changes, it is crucial to understand the direction of the traffic flow. In networking terminology, "rewriting the destination IP" refers to Destination NAT (DNAT). This process occurs when an external client sends a packet to your router's WAN interface, and the router modifies the packet's destination address before forwarding it to a device on your Local Area Network (LAN). This is commonly used to host services like web servers, game servers, or remote desktop applications behind a NAT gateway.
If you are looking to enumerate devices on your network to identify which IP belongs to your server, you might find resources on Full Network Enumeration on Kalilinux without Assigned IP Address helpful for discovery purposes, though the actual routing configuration happens on the OpenWRT device itself. The core requirement is knowing the exact private IP address of the target server and the port numbers involved in the communication.
Configuring via the Command Line
The most reliable method for advanced users is editing the firewall user script directly. OpenWRT executes commands in /etc/firewall.user every time the firewall service starts. To add a DNAT rule, you need to use the iptables command with the PREROUTING chain, which handles packets as they arrive before routing decisions are made.
# Example: Redirect TCP port 80 from WAN to local server 192.168.1.50
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.50:80In this command, -i eth0 specifies the WAN interface; replace eth0 with your actual WAN interface name if it differs. The --dport 80 flag targets HTTP traffic, but you can change this to any port required by your application. The --to-destination parameter sets the new IP address and optional port for the internal server. After adding this line, save the file and restart the firewall service using /etc/init.d/firewall restart.
Using the LuCI Web Interface
For users who prefer a graphical interface, OpenWRT provides a way to add custom firewall rules through LuCI. Navigate to Network > Firewall and select the Custom Rules tab. This section allows you to input raw iptables commands that will be applied automatically upon saving and reloading the firewall configuration.
Enter the same iptables command structure described above into the text box. It is important to note that while LuCI manages zones and policies, complex NAT scenarios often require manual intervention in the Custom Rules section because standard port forwarding forms may not support all edge cases or specific interface bindings. If you are setting up a bridge for this setup, ensure you review Setting Up Guest WiFi on OpenWRT using LuCI to avoid conflicting bridge configurations that might interfere with your NAT rules.
Verifying and Troubleshooting
After applying the rules, verification is essential to ensure the traffic is being rewritten correctly. You can check the active NAT rules by running iptables -t nat -L -n -v. Look for your rule in the PREROUTING chain and verify that the packet counts are increasing as clients connect. If the count remains zero, the rule might not be matching due to incorrect interface names or zone definitions.
Another common issue is that the return traffic from the server must also be routed back through the OpenWRT gateway to maintain the connection state. OpenWRT handles this automatically via connection tracking, but if you have strict source routing or additional firewalls on the internal server, you may need to allow established connections. Ensure that your internal server has a static IP address assigned via DHCP reservation or static configuration to prevent the DNAT rule from breaking after a reboot or lease renewal.
Related Considerations for Advanced Setups
In some complex network topologies, such as those involving virtual Ethernet pairs or bridges, identifying the correct IP addresses can be challenging. If you are working with containerized environments or virtual interfaces, you might need to determine the IP of a veth pair. For guidance on this, refer to How to get the IP address of veth in a bridge?. Additionally, if your OpenWRT instance relies on a hotspot for package installation or updates during setup, understanding connectivity is key, as detailed in How to Connect OpenWRT to Hotspot for Package Installation.
Frequently Asked Questions
Why is my port forwarding not working even though the rule is added?
This is often caused by the ISP blocking inbound ports or the router being behind Carrier-Grade NAT (CGNAT). Check your WAN IP against what websites like whatismyipaddress.com report to ensure they match. If they do not match, you cannot forward ports directly to your router.
Can I forward multiple ports to different internal servers?
Yes, you can add multiple iptables rules in the /etc/firewall.user file or the LuCI Custom Rules section. Each rule should specify a unique destination port and target the corresponding internal IP address and port combination.
Does this work for UDP traffic as well?
Absolutely. Simply change the protocol flag in your iptables command from -p tcp to -p udp. This is particularly useful for DNS forwarding, VoIP services, or online gaming servers that rely on UDP protocols.
What happens to the source IP address of the client?
In standard DNAT, the source IP address of the client remains unchanged when it reaches the internal server. However, if you also want to hide the source IP or perform Source NAT (SNAT), you would need to add a separate MASQUERADE rule in the POSTROUTING chain.
How do I remove a DNAT rule if I made a mistake?
To remove a rule, first identify its number using iptables -t nat -L PREROUTING --line-numbers. Then, delete it using iptables -t nat -D PREROUTING [rule_number]. Alternatively, edit the /etc/firewall.user file to remove the line and restart the firewall service.