Access computer on internal network from Internet

My setup: Ubuntu 13.10 server with ufw, facing outside world on eth0, IP forwarding and masquerading working OK. Internal network 192.168.0/24 on eht1, no problem accessing the internet. I need to access ports 81, 8000 and 554 on 192.168.0.101 coming to/from the internet (it's a DVR for a CCTV system, which I need to monitor remotely). How can I achieve this? Thanks in advance for the help.

2 Answers

Let's solve:

• the ports under 1024 (like 554) are reserved to the Administrator (root), so any software which uses them must be executed as root (or safer with the sudo software). It's a safety measure.

• the ports you want to use should be opened, execute those commands:

  sudo ufw default deny
  sudo ufw enable

  ...to enable the ufw iptables wrapper. Then execute:

  sudo ufw allow <port number>

  ...for any port number you want to open (81,8000 and 554) to any type of connection from any host (the sintax may vary from version to version, always read man ufw). The sintax to control the ufw interface is reported here, I suggest to read it.

After that you need to open the ports on your default gateway (a router or a switch) if it features an hardware firewall (like the Netgear and Belkin routers).
Now you have the desired remote access. :-)

Let us know by commenting down here if it's all ok & have a nice experience.

Update:

This is how solved it:

1) Insert rules for three ports:

ufw allow 81
ufw allow 8000
ufw allow 554

2) in /etc/ufw/before.rules I added the following lines in the NAT section (just before POSTROUTING):

:PREROUTING - [0:0]
-A PREROUTING -p tcp --dport 81 -j DNAT --to-destination 192.168.0.101:81
-A PREROUTING -p tcp --dport 8000 -j DNAT --to-destination 192.168.0.101:8000
-A PREROUTING -p tcp --dport 554 -j DNAT --to-destination 192.168.0.101:554

3) Reload the firewall:

ufw reload

In Firefox I type http//myserver.com:81 ( is our regular webpage) and I'm redirected to the DVR on the internal network which runs the CCTV programs I need to access from the internet (ports 8000 and 554 are used to access the system using a smartphone)

Again, thanks for the help.