Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm setting up a small office network with a single public IP (let's say it's 69.16.230.117). I've configured NAT on the router with incoming traffic forwarded to the server (say the server has a private IP of 192.168.0.2).

Is it okay to configure the client machines on the same subnet to access the server via the router's public IP (69.16.230.117)? In practice it's never caused me problems, but I've heard, here and there, that it is a bad idea, and one should use the private IP (192.168.0.2).

Does connecting to the default host via public IP from within its subnet cause any issues?

Please refrain from writing "never! it breaks the intranet!" ;-)

share|improve this question
    
Why do you want clients to use the public IP? (not being facetious, I'm curious) –  Kara Marfia May 29 '09 at 18:28
    
No worries, Kara. It's more convenient to configure services on their laptops using the same IP for the office, and outside. Of course, we could set up VPN, or have them access the server via its hostname too... I'm mainly asking the question out of curiosity, now that I know a good forum to ask in :-) –  username May 29 '09 at 18:35

6 Answers 6

up vote 1 down vote accepted

It may cause issues if your router does not have "NAT loopback" enabled. In this case all your traffic will be dropped, or redirected wrong (for instance to the router's web interface).

But usually this feature is not directly available in web interface. In some Zyxel routers you can enable this functionality by invoking the command "ip nat loopback on". Some other routers could only enable this by configuring iptables (from root access).

share|improve this answer

No, there's nothing there that causes a connectivity problem.

There are security issues in this scheme, though. Be very, very sure that your firewalls on the NAT'd server are correct. It would be far better to put this machine on its own subnet, away from the other internal NAT machines, in order to establish a demilitarized zone (DMZ) of sorts.

share|improve this answer
    
+1 to the 'put the server in a DMZ' if it isn't already suggestion, but otherwise I can't think of any security reasons why you shouldn't do this and it makes setting up shortcuts and such easier for mobile workers. –  Peter May 29 '09 at 18:26

I've had issues with this configuration in the past where internal clients could not access the NATed public IP address. That would be about the only issue I can see other than the fact that using the external IP introduces extra hops in the path compared to just using the internal IP

share|improve this answer
3  
Usually this is a result of traffic trying to come back in the same interface it left on which firewalls balk at. –  Peter May 29 '09 at 18:28

It will work, your clients will route out to your router, then back into your router to the services provided on your NAT network. Depending how smart the tcp/ip stack on your router is it may actually go one hop out and come back in but that's doubtful. As you can imagine this is a little less optimal. It also has the disadvantage that any service you want to provide to clients on your network has to be publicly accessible. Also if you add a second server you start to have a mismash of port forwards to provide services. If your clients are using the internal nat addresses for their services you only have to provide port-forwarding for those services that have to be externally available.

It's kinda like walking out your front door to go into your back yard. It'll work, you'll get there but it's generally easier to just walk out the back door.

share|improve this answer

I've had cases where internal clients were treated different on the server itself.

eg. Allowing admin access to those connecting internally vs externally.

You could also configure your internal DNS to point to the internal IP, so on the intranet you connect internally, and externally you'll get the external IP.

share|improve this answer

It seems a little odd to me; effectively you are forcing all of your internal traffic to hit your NAT device, get NATted and then be sent back through the LAN interface to the internal server. Depending on how many concurrent internal users you are expecting, this could end up causing you performance problems, as you will end up consuming both CPU and memory on your NAT device. This could potentially have a negative effect on both your outbound internet access from the office, as well as inbound access for remote users.

As your office grows, it would be worth keeping an eye on your router/firewall's performance. If you start experiencing connections issues (packet drops, refused connections), then switching your internal clients back to using the LAN IP may be a useful step.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.