IIS help - external connections

**sapi** · September 15, 2007, 11:15 PM

Okay, I'm stupid (safer to admit that right now than have it pointed out later)

Put simply, I've decided to muck around with setting up an IIS http/ftp server on my computer, for various reasons.

As far as I can tell, everything's installed correctly.

I can connect perfectly over both protocols (ftp/http) over the local network (ie localhost/ftp://localhost); however I can't seem to get a connection working over the net.

A http connection to my external IP times out, and a ftp connection returns the error (from squid) '(10061) WSAECONNREFUSED, Connection refused.'

Is there some blindingly obvious option to enable external connections that I'm missing?

EDIT: I think that my problem might have something to do with the IP address set for the site; currently it's at 'all unassigned', but I'm worried that that might limit it to local IPs only (certainly the only IP in the drop down list is my LAN one). I've tried manually setting it to my external IP, but that doesn't work; and it's not a practical solution regardless, considering I'm on a dynamic IP. I'll look into getting an account with no-ip.com, though honestly I've nfi what to do with it then

**Simetrical** · September 16, 2007, 12:47 AM

(Can my answer be to use Apache instead? No? Aww.)

If I understand you correctly, it sounds like you've set up this server on a local area network using NAT. Normally, NAT routers will only forward packets corresponding to outgoing connections, and will reject all incoming connections. If that's your problem, you'll need to set up port forwarding for ports 80, 20, and 21 to the computer that you're trying to make act as server. The procedure for this varies depending on your network hardware and firmware: check with your network router's manufacturer for details.

The IP address set for the site in IIS should be fine on the default setting, unless it has exceptionally bizarre defaults. It should just accept any incoming traffic that arrives on port 80, whatever the destination IP is.

**sapi** · September 16, 2007, 12:58 AM

Okay

I did actually have port 21 (what IIS showed the FTP port to be) forwarded, but apparently I needed 20 as well. Thanks for that

So FTP's working, which is half the battle; but despite having port 80 forwarded, http still refuses to load (but shows the iistart page on the LAN). There's no error message, it just sits at 0%

(Can my answer be to use Apache instead? No? Aww.)

**Simetrical** · September 16, 2007, 07:06 PM

Sounds like a firewall, ignoring connection attempts on restricted ports. Do you have a firewall installed? If so, it should be configured to allow incoming connections on port 80 from any computer. (Why it would allow ports 20 and 21 but not 80 I'm not sure.)

**sapi** · September 17, 2007, 07:29 AM

Norton is allowing all traffic on port 80, inbound...but no change

I had a quick poke around the router firewall (disabled, nonetheless); and nothing was wrong there, as far as I could see...

EDIT: I disabled the firewall for a second, and tried to load the site. No go

It looks like the problem might have a different cause...

**Simetrical** · September 17, 2007, 10:54 PM

What happens if you try to telnet in on port 80? Try typing "telnet 123.45.67.89 80" at the command line of a Windows computer somewhere, replacing the IP address as appropriate. Also, try installing nmap and running "nmap -A -T4 123.45.67.89" if you own the computer (if you don't, be sure to get permission first from the owner or an appropriate tech person before running nmap on it).

It still strikes me that either bad port forwarding or a firewall rule is at fault. It's likely on the part of the router, whatever it is, since it works within the network, although it's possible IIS is configured to only accept connections from the local network for some reason. Check into that as well, and make sure that's not the default behavior (or if it is, override it).

**sapi** · September 18, 2007, 03:52 AM

telnet reports connect failed on port 80

nmap reports that port 80 is filtered (the scan was run with the firewall *off*, as otherwise it was blocking it as an attack attempt)

All ports are forwarded in the same manner, to the same local (static) IP.

The firewall is set up to allow all connections on both local and remote http ports (port 80) as the top rule in the hierarchy; and as I said earlier, trying a remote connect with the firewall disabled gave the same result.

There are no router firewall options enabled, that I can see.

The only authorisation rule active, at both a server and site level, is allow:all users

I'm not 100% sure what nmap means when it says that port 80 is filtered, as out of interest I did some poking around last night with regards to ISP restrictions on port access/server usage, but found nothing that indicated that any would be in place in my case...

Thanks for your help thus far, by the way

**Simetrical** · September 18, 2007, 04:12 PM

Hmm, there's a thought. It may be that your ISP doesn't want people running Web servers and they filter it that way. Try running a traceroute on port 80 to see where the connection is rejected, then. (I'm not sure of the syntax for that on Windows: perhaps tracert hostname:80? On Linux it's traceroute -p 80 hostname.)

Edit: Also, you can tell the server to run on some other port, like 81 or 8080, if port 80 is blocked. Then of course you'll have to access the site with http://hostname:81/ or http://hostname:8080/ instead of just http://hostname/.