does port mapping work in reverse?

Hope I understood your question correctly. Here goes!

Normally, yes, port mapping does work both ways.

If your client is on the internal network you need make sure the client knows to connect to the servers internal IP using port 23.

If your client is on the internet you need to make sure client knows to connect to your external IP using the whatever port you map to the servers on port 23.

The port mapping on the router only needs to be done if you want to connect to the server from the internet.

Lokrado said:

right, how do i do portmapping on the mac?

Click to expand...

In the application or its configuration files.

Lokrado said:

the application would be system preferences and the configuration files are inaccessible, anything else you wanna add while talking about L2TP which uses UDP 1701 and is not ment to be changed.

aka, i'm looking for a terminal command/utility

Click to expand...

If it's not meant to be changed, then why would you change it? All of OS X's configuration files are accessible.

You're description above is confusing when you say moving port 1 to port 2. It's not clear what you're trying to do.

Lokrado said:

does portmapping work in reverse?
say i have an AEBS and i change port 1 from the external to port 2 on the internal network, would my outgoing traffic from my internal network on port 2 be forwarded to port 1 on the external network?

the same goes for on a mac - is there a command i can do to make portmapping on device, in reverse aswell.

say i wanted to make an L2TP server running on os x server run on port 23, i would need to map on the AEBS and on the client.
or is there a different way i could do this?

Click to expand...

We could probably help you best if you could explain exactly what you're intending to do, and why you can't do it on standard ports. I don't typically suggest running any services on non-standard ports if you can help it.

Lokrado said:

I would need an in-machine port mapping app or terminal utility. I do not want to configure the apps as i use these standardized protocols normally in other places, hence the port mapping, or port changing if you will.

Click to expand...

The firewall used by OS X (IPFW) will do port mapping for you. If you google for that plus OS X you will find many examples of how to do it and you can select the method that most suits you.

and if i can access and read/modify the system preferences and/or VPN client config file ill eat my hat and freak out due to security issues.....

Click to expand...

If you are the administrator of the box, you can modify anything and everything in it. Anything else would be silly.

A.

Lokrado said:

so something like this?

25100 allow udp from any 67 to any dst-port 68 in

would forward port 67 to 68 on udp inbound? - what about outbound? What does the DST mean?

Click to expand...

Thats only adds a firewall rule. Simply put it means the firewall will allow UPD traffic from any source IP on port 67 to travel to any destination IP on port 68 through the inbound traffic flow on the firewall.

It won't do the actual port translation.

What you want is a static nat statement. It's been a long time since I have had to mess with the IPFW stuff so can't remember the syntax but lookup the natd and divert commands.

Still not sure why you want to do this on your client computer. You shouldn't need to mess with the firewall and nat rules just to get your client software to connect to a service on a non-standerd port.

Lokrado said:

25100 allow udp from any 67 to any dst-port 68 in

would forward port 67 to 68 on udp inbound? - what about outbound? What does the DST mean?

Click to expand...

Unless you have the firewall turned on, it's already allowing all traffic anyway. All you would need is something like this:

sudo ipfw add 100 forward 127.0.0.1,22 ip from any to any 33 in

The syntax is a bit funny, but this means 'send any inbound traffic for port 33 to localhost port 22'. Note, you do *not* need any natd/divert statements as suggested by the previous poster since you aren't doing any NAT.

A.

Lokrado said:

what would happen to the traffic going out of local port 22? would it get sent thru port 33?

Click to expand...

Outbound traffic that is a response to inbound traffic to port 33 would be sent from port 33. If some other machine talks directly to port 22, the return traffic would be sent from port 22.

A.

Alrescha said:

Unless you have the firewall turned on, it's already allowing all traffic anyway. All you would need is something like this:

sudo ipfw add 100 forward 127.0.0.1,22 ip from any to any 33 in

The syntax is a bit funny, but this means 'send any inbound traffic for port 33 to localhost port 22'. Note, you do *not* need any natd/divert statements as suggested by the previous poster since you aren't doing any NAT.

A.

Click to expand...

This should work, but you'd need the rule on both the server, and then reverse the ports on the client if you plan to not set any app or service to non-standard ports.

You've stated this is on a network you don't have control over. There may be legal issues involved here, as you're actually granting yourself non-authorized remote access to the network (more serious than you may think). To be safe I'd verify that you have permission to do this. I don't know your particular situation, but this is just to warn you that if it's a work machine you could put your job on the line. Though, if their network operators are competent, your attempt to circumvent may be futile as other ports are likely to be under the same restrictions. Also, many companies have VPNs already that you can use.

If it's just another restrictive ISP, you're usually pretty safe to run stuff on nonstandard ports, but it may violate your terms of use. But also sometimes just a quick call to them may get your traffic unblocked on the port you are wanting to use. I personally purchase a block of static IPs from my ISP and they allow me to run any service I wish (with the exception of illegal content, spam/malware, and pornography IIRC) for an extra $15 a month.