Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to have my "dmz"-connected visitors to be able to access services by their global DNS IP (wan) that are redirected to another zone, let's say "lan".

  • openwrt wan -
  • client is sitting in dmz -
  • httpd is in lan -, configured for vhost (resolves to

Now dmz guy tries to access with his browser and therefore will try to connect to, which in my imagination should go through wan zone, then get redirected back to lan.

Somewhere along the chains openwrt blocks this, because this connection does not succeed.

My traffic control configuration currently looks like this:

  • lan -> wan
  • dmz -> wan
  • lan -> vpn
  • lan -> dmz

Any pointers welcome!

share|improve this question
Have read your question 3 times but I am still not sure what you are getting at. Could you please rephrase the question? If I get the gist of your question you need to allow access to your LAN from the DMZ ip address, but I am not sure if that is what you are getting at or not. – Dave Drager Jan 24 '11 at 16:24
Yes, access to LAN from DMZ is the goal, but using global DNS resolution. I think that makes the difference here. I could easily have resolve to inside DMZ and set up a forwarding rule (that already works for vpn zone) but I would like have access also when using, for some reason those packets get dropped. I can't figure out what path the packets take when you address your router's WAN IP behind IP masquerade. – lkraav Jan 24 '11 at 17:08
Looks like I made a duplicate of this:…. I've also got some tips and keywords from openwrt forum, which I will be posting in an answer. Essentially this is a "NAT loopback" problem. – lkraav Jan 24 '11 at 20:59
up vote 0 down vote accepted

This particular scenario was an OpenWRT NAT loopback configuration issue. Looking at the changelog, this was implemented in base system /etc/hotplug.d/firewall/10-nat-reflection only starting from 10.03.1-rc4 (which I am running), but LuCI 0.9 is only able to assign redirects into "lan" zone. According to an OpenWRT developer LuCI 0.10 will be able to assign redirects to other zones as well. For now doing a manual redirect in /etc/config/firewall with "option dest dmz" will achieve the desired result.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.