Reverse Proxy using Entware

From DD-WRT Wiki

Jump to: navigation, search


[edit] Introduction

Often we need to access various http and https services lying behind the router from the Internet. A common solution to this problem is to use port forwarding and assign to each of those services a different port.

Example, pretend we have the following services running in the LAN.

  • nas: storage device used to keep files accessible through http web requests
  • home automation: web interface to control your home devices, lights and heating
  • dev service: imagine you are a developer working on an api and you want it to be accessible from the Internet

By default all of those services are listening on port 80 (let's simplify and ignore for now TSL https connections). In a standard router with port forwarding you would need to:

  1. change the default port of home automation and dev with this configuration
    • nas:80
    • ‎homeautomation:81
    • dev:82
  2. from the router assign the forwarding to the relative IPS
  3. say you have and you mapped it to your public IP address, to access the various services you would need to use the following URLs:

Now this clearly this is not ideal and reverse proxy is here to help.

First, we need to edit the DNS configuration of our domain name adding CNAMES, if you use a Dynamic DNS service, to always point to your (non static) IP address, replace DESTINATION with your DynDNS URL. If you instead have a static IP address, just replace DESTINATION with

To do so add the following CNAMES.

  • homeautomation - DESTINATION

Once saved, and after waiting few minutes to allow the DNS update to propagate, you will be able to use the following addresses, in an indistinct way connect to your public address:

Now without a reverse proxy those URLs would always point you to the service listening on port 80, in this example, the NAS.

The reverse proxy allow us to specify, based on the original URL, where this should be forwarded to. So in our case we want to point maybe the lan hostname nas.home or maybe an IP address Then we have to say to point desktop.home or another IP and so on.

At each request, the reverse proxy running in your router will forward those to the right target machine within your LAN.

[edit] Notes

  1. I strongly recommend not to use dynamic IP addresses, to do so in the DHCP reservation table in the router's web ui, add the MAC address of nas, desktop and homeautomation reserving an IP. This will make the IP static but will also give you an automatic hostname resolution so nas.home will be always resolved with your nas IP, even if you change it. (I use home as internal domain name)
  2. If you don't have a domain name, you can buy it for a very little amount of money nowadays. I bought mine from services like
  3. If you need a Dynamic DNS service, you can use for free (you need to confirm the setup every month for the free plan) or

[edit] How to setup a reverse proxy using Entware-3X

  1. Make sure you can write inside opt folder
    To try it type:
    cd /opt/ (click enter) 
    mkdir test  (click enter)
    If the command is successful delete the folder
    rmdir test (click enter)
    and go to the point 2)
    If the command failed you need to mount jffs to opt executing the following command, or use USB mounted to /opt:
    mount --bind /jffs/ /opt/
  2. Install entware: see Installing Entware
  3. If the installation was successful, then issue the following commands to update opkg:
    opkg update (click enter)
    opkg upgrade (click enter)
  4. Now you can install 'nginx':
    opkg install nginx (click enter)
  5. Locate the nginx.conf configuration file, where you need to configure the reverse proxy. Run the command:
    find / -name 'nginx.conf'
  6. Add the configuration to the nginx.conf file, that normally is located in /jffs/etc/nginx/nginx.conf. To edit the file type:
    vi /jffs/etc/nginx/nginx.conf (click enter)
    SHIFT + i to start editing, press ESC to stop editing
    :wq to save and exit vi
  7. Change the web interface default port from 80 to 81 (or any other one) and disable the https if you want to reverse proxy also https urls. To do that run:
    nvram set http_lanport=81 (click enter)
    nvram commit (click enter)
  8. In the UI now navigate to Administration > Commands and add the following scripts to run at startup:
    mount --bind /jffs/ /opt/ (only if required, not if using USB)
    Remember to click the button Save Startup, because you need the file system to be mount at every reboot and you want to run automatically nginx as well.
  9. Restart the router and everything should be setup.

[edit] Links with examples