So a little background: I'm a CS student mostly interested in development and software design, but also highly interested in everything Linux and servers. I've wanted my own RPi for a while and finally this week I had the chance to get one and start getting dirty with it. I got myself an Raspberry Pie Model 3+ Starter Kit.

So I decided to start off with something simple: getting a web server running and having Wordpress on top of it. I'm using Raspbian Stretch Lite. Everything works quite well, but I'm having some issues connecting to my RPi. I of course want it to have a public IP so I can connect to it remotely as well and have my website running publicly, so I've tried to achieve it in two ways:

1. Bridging the ethernet port on my router which is connected to the RPi

Everything worked quite nicely, outside my local network. So for example if I tried to connect to the website (http) on my cell phone (which was connected to 4G network) it was succesfull, as well as if I tried to connect to the SSH on my cell phone. BUT if I tried to connect to the RPi via HTTP or SSH on any of the devices in my LAN (devices that are connected to the same router as RPi, via Wi-fi or ethernet), the connection was unsuccessful.

2. Port forwarding the RPi

So since the bridging didn't seem to work, I tried if I can achieve it easily by port forwarding the SSH and HTTP ports from my router to my RPi.

Port forwarding

The problem I ran into was that now I was able to connect to the RPi via HTTP and SSH only through devices that were connected to the router by Ethernet. From devices outside my local network (for example my cellphone that was connected to the 4G) OR devices that were connected to the router via Wi-fi I was only able to access the website through HTTP, but I could not connect to it via SSH.

I'd really appreciate help with this, as I understand that I'm obviously missing or forgetting something really obvious. I'd appreciate help and answers to these questions:

  1. Which one is a better solution to get a public ID for my RPi, so it can be connected from outside of my LAN. Bridging an ethernet port or port forwarding?
  2. What am I missing, what causes these kinds of problems? I have very basic knowledge on networks through my studies (I'm just starting my 2nd year studies) and through work (I've been working since April solving problems with consumer level network devices), but obviously I'm missing some key pieces in here.

Thanks already!


So the dumbass brains that I have didn't realize that FTP != SSH. Obviously I need to port forward port 22 to be able to connect through SSH from external network. I forwarded port 22 and now I'm able to connect via SSH to my RPi as well.

But the problem still exists in my LAN, with devices that are connected via Wi-fi. So I still am not able to connect to the RPi via SSH using the LAN ip that my RPi has (, but by using the public IP. With devices that are connected via Ethernet I am able to connect to RPi SSH using the ip Does anyone have any idea why that could be?

  • You are aware of the fact that this has nothing to do with Raspberry in special but are common network questions better asked on superuser.com and most likely answerd there? – LotPings Jul 28 '18 at 10:52
  • 1
    Not really, if this is the wrong site I'll post the same question in superuser.com instead. I just thought that this most likely is something that people have dealt with before with RPi, as RPi serving as a web server is probably pretty common? – F4irline Jul 28 '18 at 11:14
  • 1
    @LotPings It depends on ... There may be special settings to configure the specific hardware (e.g. ethernet via USB, wifi without bridging capability). I would suggest to stay here with the question. – Ingo Jul 28 '18 at 11:32
  • @Ingo agreed, till now OP is unspecific on what RPi type, what exact Linux OS. Connecting a zero without (W)-Lan IS special otherwise the audience on unix.stackexchange.com may be broader to networking/routing/router issues. – LotPings Jul 28 '18 at 12:01
  • I actually found a stupid mistake in my port forwarding settings. I had forwarded FTP ports 20/21, instead of SSH which is 22. So now I am able to connect to my RPi via SSH from outside of my LAN. The issue still exists with devices connected to my LAN via Wi-fi though... Maybe this is the wrong page after all. – F4irline Jul 28 '18 at 12:09

To answer your first question: to connect to your web server from outside the internet it is easier to have a static public ip address, e.g. from your provider. Then you can simply connect to this address or by its dns name. The other way your router gets a mostly dynamic public ip address from your provider. The problem is to get this always changing ip address. You may use a dynamic DNS service from your provider or from a third party. Then you only use the fixed dns name. The changing ip address behind it will be managed by the dynDNS service.

To come to your second question: What are you missing isn't answered in some sentences. We should do it in two steps: first configure the local area network with a web server on a RPi. Any device on LAN and wifi can connect to the web site of the web server and via ssh. All devices can get into the internet via the router. The second step then is to open your router to get access from the internet to your web site and via ssh only to the web server. I assume this environment:

          /    wlan
cell-phone <.~.~.~.~-~.>                  +------------+
                        \                 |  INTERNET  |
        (dhcp)           \     (dyn-ip)   |            |
          /               \      /        |     G4     |
  PC(eth0) <-------------> ROUTER <-----> |      \     |
              ethernet    /\        wan   | cell-phone |
 RPI(eth0) <------------->  \             |            |
          \         |            |                        +------------+

Clean up your router from any port forwarding. Setup wifi to bridge with ethernet (that's mostly default). Many router have a security option that devices connected to wifi cannot talk to other devices on wifi. If possible enable this feature (on my router it's possible). I also suppose that a DHCP server on your router is enabled and that you have the RasPi with the web server given a static ip address There is also a ssh server running.

Now any device can ping any other device on the network and any device can browse the web site and can ssh into the web server.

The router has a wan connection to your provider using NAT (network address translation from source ip to (dyn-ip)) so all devices can go into the internet. The router gets on wan side an ip address (dyn-ip) from the provider that changed occasionally. Because of the nature of NAT there is no traffic possible from the internet into the local network.

If all is running this way you can now poke two holes into the firewall (NAT) of your router with port forwarding. That means all traffic coming in to (dyn-ip) on port 22 (ssh) or port 80 (http) should be forwarded to ip address port 22 or 80. The daemons behind these ports on the RasPi (ssh server and web server) will serve the connection.

Now the cell phone on the internet can also browse your web site and can ssh into the web server if it knows the (dyn-ip). To solve this look at the answer to your question 1. For testing you can look at the router what ip address it just has got from the provider.


There are three possibilities when trying to connect on a network fails:

  1. Connection times out. This means either there is no such address, or a firewall is silently discarding packets. The latter is considered a bad practice, and the only way this could happen on the Pi is if you intentionally configured a firewall that way.

    In your case, this may mean the Pi is not properly on the LAN, which is an issue with either the Pi configuration, the router configuration, or both.

    I have noticed that it is possible to be connected to the internet via a router that is not passing on your local traffic (which would cause a timeout). In this case, try shutting the connection down, clear the contents of /var/lib/dhclient if any (these are DHCP lease records, but I am not sure if Raspbian currently uses dhclient), and reconnect.

  2. Connection refused. This indicates there is no server listening on the requested port.

    In your case, this means either the server you think is running is not running (or not running on the port you think it is), or else this is the wrong IP address and you are being refused by some other device on the LAN.

  3. Unreachable or Prohibited. This indicates a firewall denied the connection (which is the normal response of a properly configured firewall, in contrast to the discarding of packets mentioned in #1).

    If you are running a firewall on the Pi, disable it until your sort your more basic problems out.

For more details about this, see: https://unix.stackexchange.com/a/73782/25985

Not the answer you're looking for? Browse other questions tagged or ask your own question.