Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a question about whether something is 'possible' by default or requires additional setup.

Lets say I have two systems behind a firewall and they are in the same domain and subnet. System 1 has IP and has IIS installed (aka listening to port 80). The other system is just a normal system that has outbound internet traffic.

Should system 2 (The outbound traffic system) be able to hit the external ip and have it redirect to the server running IIS without having to modify any host file or NAT setting?

Here is a topology of what I am taking about:

alt text

Should the computer system at be able to hit (either directly with the IP or through a registered dns like the external ip ( and have it 'resolve'/redirect to the internal server located at

share|improve this question

migrated from Nov 1 '10 at 16:53

This question came from our site for professional and enthusiast programmers.

Your images will look better if you save them as PNG instead of JPEG. JPEG's compression algorithms make anything other than photographs look smeary. Line drawings, diagrams and cartoons, and images with large flat areas of color are especially susceptible. – Andy Lester Nov 1 '10 at 16:54
I will update the image as soon as I have 10 pts ;) – BabelFish Nov 1 '10 at 17:03
Please use a descriptive title instead of a generic one. – Dennis Williamson Nov 1 '10 at 18:06
up vote 5 down vote accepted

This is a pretty well known problem. When your internal client accesses the external IP address, dumb-NAT will forward that packet to the server. It looks kind of like this: ->

At which point the dumb-NAT will rewrite the packet, so what the internal server sees: ->

So it will reply: ->

Unfortunately, was expecting a reply from, not, so it just discards the packet and the connection never completes.

There are a couple ways of handling this, some NAT gateways do this intelligently. Most home router/firewalls don't. But the term for what it is doing is Source-NAT, where the source-address gets rewritten instead of the destination.

share|improve this answer
did you mean -> for the first line (just to make sure we are on the same page) and the second one would be -> – BabelFish Nov 1 '10 at 17:29
@BabelFish Yes, quite. I updated to rectify that. – sysadmin1138 Nov 1 '10 at 17:49

If this a PURE firewall then you could run into problems but in reality most firewalls will act to some degree as a limited router and so yes this should just work. It certainly works on all the firewall/routers I've used. Do you know what your FW is?

share|improve this answer

Here is a very nice explanation of this problem, given in an equivalent context. The solution is to configure what the MikroTik page calls "hairpin NAT". I have also seen the technique referred to as "NAT reflection", in the context of pfSense and m0n0wall.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.