Help debug wrong remote addr ip when port forwarding

Backstage4031 · November 18, 2025, 6:58pm

I have public IP on router's WAN port. The router is set up to Firewall->Port forward 80, 443 ports to my other PC in local network. When I access the HTTP server by typing my public IP in phone's browser (I use celular network, not connected to Wi-Fi) I see 192.168.1.1 in the logs.

2025/11/18 18:21:53.161 ERROR   http.log.access handled request {"request": {"remote_ip": "192.168.1.1", "remote_port": "47830", "client_ip": "192.168.1.1", "proto": "HTTP/1.1", "method": "GET", "host": "<PUBLIC_IP>:8087", "uri": "/", "headers": {"Connection": ["keep-alive"], "Accept": ["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"], "Accept-Encoding": ["gzip, deflate"], "Sec-Gpc": ["1"], "Upgrade-Insecure-Requests": ["1"], "Priority": ["u=0, i"], "User-Agent": ["Mozilla/5.0 (Android; Mobile; rv:145.0) Gecko/145.0 Firefox/145.0"], "Accept-Language": ["uk-UA,en-GB;q=0.5"]}}, "bytes_read": 0, "user_id": "", "duration": 0.000311765, "size": 0, "status": 502, "resp_headers": {"Server": ["Caddy"]}}

After reading several topics, especially Port forwarding 443 to internal Nginx uses wrong client IP it seems I should be getting real client ip, right?

My /etc/config/firewall

config defaults
	option input 'DROP'
	option output 'ACCEPT'
	option forward 'DROP'
	option synflood_protect '1'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'DROP'
	option output 'ACCEPT'
	option forward 'DROP'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'My service 1'
	option src 'wan'
	option src_dport '60000'
	option dest_ip '192.168.1.214'
	option dest_port '60000'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'My service 2'
	option src 'wan'
	option src_dport '60000'
	option dest_ip '192.168.1.214'
	option dest_port '60000'
	option reflection_src 'external'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'My service 3'
	option src 'wan'
	option src_dport '25565'
	option dest_ip '192.168.1.214'
	option dest_port '25565'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'HTTP'
	list proto 'tcp'
	option src 'wan'
	option src_dip 'MY_PUBLIC_IP'
	option src_dport '80'
	option dest_ip '192.168.1.214'
	option dest_port '80'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'HTTPS'
	option src 'wan'
	option src_dip 'MY_PUBLIC_IP'
	option src_dport '443'
	option dest_ip '192.168.1.214'
	option dest_port '443'

config rule
	option src 'lan'
	option dest 'wan'
	option name 'Reject Ecoflow'
	list src_mac 'MAC_ADDRESS'
	option target 'REJECT'

config zone
	option name 'vpn'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option masq '1'
	option mtu_fix '1'
	list network 'lan'
	list network 'wg0'

config forwarding
	option src 'lan'
	option dest 'vpn'

config forwarding
	option src 'vpn'
	option dest 'wan'

config rule
	option src 'vpn'
	option name 'Allow VPN DNS'
	option dest_port '53'
	option target 'ACCEPT'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'Test'
	option src 'wan'
	option src_dport '8087'
	option dest_ip '192.168.1.178'
	option dest_port '8087'

Hardware: Redmi AX6, qualcommax/ipq807x.
Software: OpenWrt 24.10.4 (r28959-29397011cc)

I even factory reset OpenWRT configuration, but it didn't help.

Set up nginx on the router and it shows correct remote addr, so this breaks only when port forwarding to other PCs in my LAN.

Here's port forward rule which was used for the test above.

config redirect
	option target 'DNAT'
	option name 'Test'
	option src 'wan'
	option src_dport '8087'
	option dest_ip '192.168.1.1'
	option dest_port '8087'

brada4 · November 18, 2025, 7:10pm

config redirect
	option target 'DNAT'
	option name 'Test'
	option src 'wan'
+      option family 'ipv4'
+      option proto 'tcp'
	option src_dport '8087'
	option dest_ip '192.168.1.178'
-	option dest_port '8087'

egc · November 18, 2025, 7:11pm

Backstage4031:

config zone
	option name 'vpn'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option masq '1'
	option mtu_fix '1'
	list network 'lan'
	list network 'wg0'

Not saying this is the problem but remove network lan from this zone.
Reboot afterwards

Backstage4031 · November 18, 2025, 7:23pm

Huh, you know what? It fixed the problem! Thanks! I've spent wayy to much time on this.

mk24 · November 18, 2025, 7:27pm

Having the same network listed in two zones is an indeterminate situation, going to cause problems.

brada4 · November 18, 2025, 7:42pm

Will add warning to fw4

system · November 28, 2025, 7:43pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.