Smart Hub Plus - can you forward port 80?

[David-A-James]

I'm not quite sure what my EE Smart Hiub Plus is - the sticker on the bottom of it says SH32B, but in Hub Manager: Home > Advanced Settings > Technical Log > Information, the product code is shown as SH31B ...

Anyway, the question is: can you port forward port 80?

The answer appears to be no - I believe I have ports 80 and 81 both set to forward to port 80 on the same system:

When accessed internally (from the LAN side of the Smart Hub), port 81 goes to the 192.168.1.2 device (as hoped) but port 80 goes to the Smart Hub's own Hub Manager page.

When accessed externally (i.e. from something not on the internal network), port 81 goes to the 192.168.1.2 device (as hoped) and port 80 times out.

Is not being able to port forward port 80 the expected behaviour?

In case it is relevant, the hub's firmware version is r3.8.11-R-1414606-PROD-83002 with GUI version 2.36.9.

[bobpullen]

---

@David-A-James wrote:

I am accessing port 80 and port 81 using the same domain name (which, via Cloudflare, gets to the external IPv4 address of the Smart Hub Plus).

---

Just a thought, and doubt it's the case but...

Are the servers being accessed via a web browser? If so, I assume you're using the format http://domain.tld:81 and http://domain.tld:82 for the 'non-standard' HTTP ports.

What about port 80? Are you just typing the domain name, or are you appending ':80' to the end? I'm wondering if web browsers are trying to force https instead of http which uses a different port entirely (443).

If I find some time, I'll try and do something that better mimics your setup, with the multiple rules, and see what happens.

[David-A-James]

@bobpullen Yes, I'm accessing the server via a web-browser (Google Chrome from a Windows laptop), and yes, I'm using http://home.domain.tld:81/ and http://home.domain.tld:82 for the non-standard ports (home.domain.tld is the A record in the DNS).

Those both work. Connecting from outside my LAN and using Developer Tools in Google Chrome, the "Request URL" starts with "http://" and the "Remote Address" shows as external-IPv4-address-of-hub:81 or :82 respectively.

If I try either http://home.domain.tld/ or http://home.domain.tld:80/ then Developer Toools reports "home.domain.tld didn't send any data ERR_EMPTY_RESPONSE"

Connecting from inside the LAN, with no port specified or with port 80 specified, I get to the Hub Manager on the Smart Hub Plus.

I have also now tried deleting the port forwarding rule for port 81 (so that there are no two rules forwarding to the same device) and the behaviour is unchanged.

I think you said you have not done this with an SM32B.

In a perfect world, someone who has source code for the firmware would come along and confirm or deny whether port 80 can be forwarded and whether the firmware on the SM31B and the SM32B is actually the same (I guess there is zero chance of such a person responding!), but so far as I can see, with this SM32B running firmware version r3.8.11-R-1414606-PROD-83002 port 80 cannot be forwarded.

[WillKirk]

Rough examples, not using your IPs but referencing:

if EE Router is: 192.168.1.254

if Web Server is: 192.168.1.10

Internal DNS for testing should set: domain.com = 192.168.1.10

Sounds to me like you have your internal domain name pointing at the EE router (192.168.1.254) and then trying to Port Forward. Port Forward will only work for outside connections passing inbound through the WAN to the internal network. It does not work if you are already in the internal network.

So Port Forward will work to take Public IP to internal private IP and port. Example:

Rule: 192.168.1.10 port 80 - 80

This says Destination NAT from whatever hits this router from outside port 80, and send it to 192.168.1.10 port 80.

So make sure your internal DNS is pointing to the internal private IP of web server. Make sure your port forward is doing the same.

if you are getting the web interface of the EE router, you have one of those two pointing AT the router.

[WillKirk]

In addition I am running r3.8.11-R-1414606-PROD-83002 and port 80 and 443 work as expected for the two websites I run from my loft.

[David-A-James]

@WillKirk 

Let me try to describe this again, as I believe I am doing what you say  ...

In the external DNS, home.domain.tld is an A record pointing to the external IPv4 address of the Smart Hub Plus.

Internally, my Smart Hub Plus has IPv4 address 192.168.1.254

These are my port forwarding rules now:

From a device outside the LAN (I have tested this myself using a 4G LTE router containing a Three SIM (and so compeletely separate to my EE broadband) and I have also had a friend test it who lives on the opposite side of the country) http://home.domain.tld:81/ correctly goes to the web server at  192.168.1.2, http://home.domain.tld:82/ correctly goes to the webserver at 192.168.1.31, and the non-standqrd ports 9361 and 9362 correctly go to the relevant services on the servers at 192.168.1.31 and 192.168.1.33 respectively. However, http://home.domain.tld/ or http://home.domain.tld:80/ both time out.

Connections from the outside are, as you say, where the port forwarding is necessary.

But to complete the description of what happens, if I try to connect to the three HTTP URLs and the 2 non-standard services from inside the LAN (still using the home.domain.tld hostname), ports 81, 82, 9361, and 9362 all work as expected (and Developer Tools in the Chrome browser for the two HTTP URLs shows the external IPv4 address of the hub). In this case port 80 connects to the Hub Manager which is perhaps what I would expect.

So port forwarding for connections from inside the LAN (to the domain name that points at the external IP address of the Smart Hub) do actuall work (except for port 80 and I'd probably not expect that to work).

Whether or not port forwarding works for connections like this from inside the LAN to the external address of the router varies from router to router - over the years I have had some routers on which it works and some on which it does not work (third party routers and routers from other non-EE ISPs). But I don't care whether port forwarding works or not when connecting from inside the LAN. I only reported those results for completeness.

So whilst port forwarding port 80 (for external connections) works for @bobpullen and you, it doesn't work for me (unless I am doing something really stupid and I don't think I am).

What version of the Smart Hub Plus do you have? SM31B (the one with an RJ11 socket to support both FTTC and FTTP) or SM32B (which doesn't have an RJ11 socket and so only supports FTTP)?

[XRaySpeX]

It is the Internal ports that are the ones being Port Forwarded. These are the ports on which your devices/servers are listening. The External ports are like aliases you hand out to remote users to address your internal devices/servers. In fact most peeps config Port Forwarding with External range = Internal Range.

In your 3 cases of Port Forwarding to Internal port 80 from outside, the 2 with the External "alias" 81 & 82 will always work. However the 1 with the External "alias" 80 can't work as it gets directed immediately to the router's HTTP GUI before it ever hits the Port Forwarding rules. This in turn refuses to accept access from outside & so times out. It was this I was thinking of in my 1st response.

When you address these External ports from inside your LAN. External ports 81 & 82 will still work but 80 will again access the HTTP GUI but this time will be accepted as it's coming internally.

So the upshot is if you want to Port Forward port 80 of a local device/server all you've got to do is give it an External "alias" so it doesn't get mixed up with the router's HTTP GUI.

[David-A-James]

@XRaySpeX : Your original reply (before editing) said "I think you are confusing which ports are being Port Forwarded".

I don't think I am confused (I've been using port forwarding for many years), but I do appear to have confused many of the people replying to my question. I probably gave too many details and have confused people by my comments about what happens to requests coming from the LAN side of the hub/router. I've spent a large part of my life dealing with technical support questions and I always preferred to have too much information rather than too little.

Perhaps my original quesion would have been clearer if phrased as "can I forward incoming requests from the outside world (that is the WAN side of the Smart Hub Plus)  on port 80 to a server on the LAN side of the Smart Hub Plus?"

@XRaySpeX : You say "However the 1 with the External "alias" 80 can't work as it gets directed immediately to the router's HTTP GUI before it ever hits the Port Forwarding rules. This in turn refuses to accept access from outside & so times out. It was this I was thinking of in my 1st response"

Yes, that is what I see.

I'd comment that getting "directed immediately to the router's HTTP GUI before it ever hits the Port Forwarding rules" is a decision made by the hub's firmware and the firmware could instead have incoming external requests obey the port forwarding rules before hitting the HTTP GUI (particularly as the HTTP GUI refuses to accept incoming requests from the outside - for good reasons). See my last paragraph below for other routers that have made a different decision.

@XRaySpeX : you say "So the upshot is if you want to Port Forward port 80 of a local device/server all you've got to do is give it an External "alias" so it doesn't get mixed up with the router's HTTP GUI"

That is what I am doing with the rule for forwarding incoming requests on port 81.

But @bobpullen  and @WillKirk both say that they do have redirection of incoming requests from the outside world on port 80 forwarding to servers on their internal network.

I'm trying to understand what may be different in their configuration (where this port forwarding works) and in my configuration (where, so far as I can see, it does not work).

@bobpullen has said he has done this with (amongst others) an SH31B, buf has not done this with an SM32B but "firmware should be common across the SH3x devices as far as I know" - but unless anyone has access to the source of the firmware, we don't know that the firmware is the same on the SH31B and the SH32B.

@WillKirk has not said what version of the hub he has it working on.

Whether forwarding incoming requests on port 80 from the outside world works is going to depend on exactly what the hub/router does - just as an example, my previous hub/router (a PlusNet Hub One (I think) using FTTC from PlusNet) did happily forward incoming requests from the outside worls on port 80 even though its management pages were served on port 80 on the LAN side of the hub/router. It's too long ago to remember for sure, but I think I have also had forwarding of incoming requests on port 80 working using third-party routers before that (in the days of an ADSL2 connection).

[WillKirk]

EE Smart Hub Plus: SH31B

Firmware: r3.8.11-R-1414606-PROD-83002

Port Forwarding Screenshot

Dynamic DNS Screenshot

The images will likely have to be approved before they can be viewed.

One of the websites being hosted is buonacorsi.com which is a single page for access to a family's grandma's life story monologue. So you will be able to see that this works. There is a redirect within the webserver itself from port 80 to 443, so both ports are open but if you go to http://buonacorsi.com it will go to the site using port 80 first before redirecting. Port 80 is open so that the SSL certificate can be renewed automatically - part of the certbot requirements.

As you can see, the forwarding is pretty standard. The Raspberry Pi has a local private IP Address. The A record at the domain name registry at Zoneedit is a DYN one as the public IP Addresses supplied are always dynamic so you will need to use this type of service in order to use a domain name. Just an A record pointed at your IP Address will only work if your router hasn't rebooted and been provided with a new public IP. Hence the screenshot for the Dynamic DNS page.

Do not believe any personal information is left on these and as the website is public, I see no problem in that - it's just not relevant to anyone outside of that family.

Assuming the firmware level is the same I doubt very much the model of router will make any difference as it would be the same software, and the hardware would be near identical - and this is a 'software' issue you believe you are having.

Aside from that I can't really say much else. There used to be issues where you could not see domains from your own IP if they were hosted on your own IP as this would cause a loop. But I do not appear to have this issue in this case, so I suspect the router handles that.

[WillKirk]

Here is a thought - a thought only, but the theory fits.

Assuming your web server you are trying to access also has a http to https redirect which you haven't accounted for:

1 - You do not have Port 443 open in the Port Forwarding, so if it is successfully accessing Port 80 from outside but then attempting a redirect to port 443 it will not get anywhere and would result in what you are seeing.

2 - Trying the above internally would land you at the router page on https as it would successfully reach port 80, then attempt a redirect to the 'external public IP' but on port 443 - as the router itself knows the destination of that external public IP — itself — then it would simply process the request on port 443 on the router itself, showing you the Hub Manager page - you should be able to check this in the browser to see if it shows https or not.

Again, as I said, an idea based on a 80 - 443 redirect you had forgotten about. If there isn't one, then the theory dies.