Access pi from the outside

Question

I'm sure it has been asked before but I cannot find an answer that works for me.

I did it before but cannot get it to work again. I installed a raspbmc, it includes an apache for remote control of the xbmc. I installed apache2 for my own stuff, and mapped to 8080 since 80 was already taken. It works like a charm from the LAN.

Then I installed ddclient for getting my own IP to a constant, I have an account there that points to cacharro.ole32.com. I checked and the IP configured by ddclient at dnsdynamic.org and is Ok, there is the actual IP of my home (81.184.131.185 right now, it may change)

Then I created some port forwarding at my router for ports 80 like this:

remote port 80 to 80  (it asks for a range)
local port  8080 to 8080
local IP 192.168.1.101 (fix address for my pi, also tested, is Ok)

did the same for 22 (ssh) and 21(ftp)

Now I go to the internet, access cacharro.ole32.com or 81.184.131.185, or 81.184.131.185:80 or :8080 nothing happens. Same for ssh (putty) of FTP (filezilla and winscp)

I just cannot reach my PI from the outside.

Any clue? Any file you might want to check ?? As you can see I did some effort before coming here. I just don't know what else to test.

Answer 1

a) Are you sure you have set up port forwarding in your router correctly? You may need to restart your router for changes to take effect.

b) Are you sure your provider allows you to run services on those ports? Most home providers will not and even block incoming 'well-known' ports <1024, 8000-8999 etc

c) Do you have another firewall somewhere? Does your Pi have a firewall running (check your iptables)

Answer 2

Based on Guru Evi answer I was able to fix it, but I will rather extend the answer for future users facing the same issue. As stated the problem is firewall preventing connections from outside of the LAN, if you search services --configure-all iptables does NOT appear there, but it is there somewhere.

What we have to do to allow connections is edit /etc/network/if-up.d/secure-rmc , there delete the very last line, that happens to be a DROP command.

This will allow everybody to attempt to connect at any port. If you want more security you can add specific ports to the list with a line like: iptables -A INPUT -p tcp --dport 9091 -j ACCEPT