Member Avatar for Staric

I have a Windows Server running and i need to assign a static public ip through DD-WRT to it, so my remote desktop users can still access it via that, however I am coming up with nothing after scowering the DD-WRT website.

  • 3 Contributors
  • 3 Replies
  • 692 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by montelaphone

Dani AI

Generated

Short primer and recommended path.

wanted one of several purchased public IPs assigned to a Windows Server behind DD‑WRT. ’s DMZ/port‑forward idea is a quick fix but is blunt (it exposes the whole host). ’s suggestion to remove NAT works too, but it makes the machines directly public. A safer, more flexible compromise on DD‑WRT is one‑to‑one (static) NAT: bind the extra public addresses to the WAN as aliases and create DNAT/SNAT rules so each public IP maps to a single private host. This preserves private addressing for the rest of the LAN while letting a server appear at its own public IP. (wikidevi.wi-cat.ru)

How to implement (conceptual example — replace placeholders and test carefully):

WANIF=$(get_wanface)
ifconfig $WANIF:1 <PUBLIC_IP> netmask <NETMASK> broadcast <BCAST>
iptables -t nat -I PREROUTING -d <PUBLIC_IP> -j DNAT --to-destination <PRIVATE_IP>
iptables -t nat -I POSTROUTING -s <PRIVATE_IP> -j SNAT --to-source <PUBLIC_IP>
iptables -I FORWARD -d <PRIVATE_IP> -j ACCEPT

Put the alias lines in the router’s Startup script and the iptables lines in the Firewall script (Administration → Commands → Save Startup/Save Firewall) so they persist across reboots. Test from outside, then tighten forwarding rules to exactly the ports you need. (wikidevi.wi-cat.ru)

Checks, pitfalls and security notes.

Confirm with the ISP that your block is routed to the router’s WAN and that the WAN connection is set to the static type required by one‑to‑one NAT; many vendors’ docs note this requirement. If you instead switch DD‑WRT to “Router” (Advanced Routing) you disable NAT and can assign public addresses directly — but that exposes hosts. NAT/aliasing is convenient, yet it’s not a substitute for layered security: avoid exposing administrative services directly to the Internet — use a VPN or hardened jump host (bastion), restrict source IPs, enable logging/MFA and keep the server patched. (tp-link.com)

If the DD‑WRT build lacks features you need (IP aliasing, persistent rules or reliable forwarding), consider a small gateway appliance or pfSense-type platform that has built‑in 1:1 NAT and a GUI for those mappings.

Recommended Answers

All 3 Replies

Member Avatar for rch1231

What you need to do is add the port 3389 to the DMZ and point it toward the server that needs to be available. The router will let one host normally be available to the outside on specific ports. Look up DMZ in your router docs.

Member Avatar for Staric

This still doesn't allow the outside world to access my server via one of the 5 static public ip's i purchased. Also this creates a security risk since it forwards all ports not just the one i want opened for rdp(3389)

Member Avatar for montelaphone

You could diable NAT and assign your public address as your router's address. For instance, if your WAN Ip range was with 5 useable (excluding your WAN IP), in the basic setup under net work setup you would enter the following.

Local IP address: for example which would be the same as your router's public IP.
Subnet Mask:
Gateway:
DNS: you may need to enter your ISP's DNS server/s

Once you have saved this you then need to disable nat by going to Advanced routing and selecting "Router" under operating mode. Save and apply

If you've left DHC enabled all the network devices connected to the router should be assigned one of the 5 available public addresses ( - ), otherwise you can manually assign these on each device.

Ofcourse another option would be to use PAT and translate alternative ports such as 3390,3391,3392, etc to 3389 and send these to the relevant private IP's.

Now if someone could help me set up routed with NAT on the same firmware I'd be a very happy man :D

Edited by montelaphone because: n/a
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.