Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am configuring a router to redirect TCP port 5900 (yes, this is for VNC) to a specific IP address on the network. Here is what I have:

enter image description here

From a local computer on the same network, I can telnet to (port 5900) just fine. However, when trying to telnet to the machine (port 5900) using its external IP address, it doesn't work. (The connection times out.)

The router is a Gigaset SE567, if that helps.

share|improve this question
Also, I found this Mikrotik page to be pretty useful in understanding hairpin NAT... Mikrotik Wiki - Hairpin NAT – pmilb Dec 15 '11 at 18:58

You're running into the hairpin NAT problem. The problem is the following:

  1. Your client opens a connection to [externalIP]:5900
  2. Your gateway converts the target address to [InternalIP]:5900
  3. Your server on [internalIP] sees a connection from [InternalIP-2] and sends an ACK to [InternalIP-2]
  4. Your client sees an ACK from [InternalIP-2] and not from [externalIP] like it was expecting, and drops it. No connection is ever established.

The gateway needs to be smart enough to translate internal source addresses to itself so it can handle the correct translations. Consumer routers generally don't support this operation. The usual method is to just use the internal IP when connecting internally, or use a split DNS configuration.

share|improve this answer
That's odd though... my home router does this just fine (translating internal addresses like you mention) so I didn't expect this type of problem. What's a split DNS configuration? – Nathan Osman Mar 28 '11 at 2:44
Also, is there a special name for this type of problem? – Nathan Osman Mar 28 '11 at 2:45
Your internal DNS server resolves to and your external DNS server resolves to a real IP address. – sysadmin1138 Mar 28 '11 at 2:45
@sys: Aha! More examination of the router options page reveals a NAT address configuration page with the following: "Network address translation (NAT) directly translates an IP address from your home network to an address on the Internet. It only allows one machine from the home network to access the Internet." (Which is of course not an option.) – Nathan Osman Mar 28 '11 at 2:49
@GeorgeEdison Yes, the term for this problem is called NAT Hairpinning, named after the 'hairpin turn' the packet makes at your border router. – sysadmin1138 Mar 28 '11 at 2:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.