Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm a newbie to IOS. In the past I've used consumer routers which seem to have the smarts to automatically route requests to internal hosts addressed by their public name back to the internal network. I think this is called hairpinning.

I need to do that so that an office laptop can access a server on our office network by its public name both from outside the office and inside.

This thing has me stumped but I'm sure it is a piece of cake for a network expert.

Note: We don't have an internal DNS (we only have 4 machines).

share|improve this question

2 Answers 2

up vote 1 down vote accepted


  1. my understanding of the question is right (please see comment @petrus)
  2. and that you are exposing your internal server to the internet using a static nat using something such as:

    (config)# ip nat inside source static PRIVATE-IP PUBLIC-IP extendable

(no PAT, only plain, old and boring static nat) then any DNS reply in which in the payload there is a reference to the PUBLIC-IP (the same used in the static NAT) is going to be re-written to the PRIVATE-IP.

So if the pre-conditions are met (i.e. the use of static NAT) when your users query the external DNS server for your hostname they are going to receive the re-written DNS answer (PRIVATE_IP) and should connect to your server with no issues.

Your external users will be connecting to your server as usual, that is, using the PUBLIC-IP address of your server.

You may want to take a look to the following document: Network address translation of DNS responses

share|improve this answer

If you're asking, then I'll guess that what bothers you is the NAT (hum, pat actually) configuration.

If so, look at the following example :

ip nat inside source static tcp 22 interface FastEthernet1/0 22

This line will forward all incoming request on FastEthernet1/0 (WAN interface), tcp port 22, to the internal host, also on tcp port 22.

If you're on the inside, then there is no need for any configuration on the router and you should be able to reach the server directly.

share|improve this answer
My understanding of the question is what the OP is looking for is how his internal users can access the internal server using the server's "public" address, that is the server address that the external DNS server is translating for OP's external users...if this is the case then this NAT rule will not work...then it may very well be that my question understanding is wrong and if so please disregard this comment... –  jliendo Apr 7 '11 at 1:38
indeed, you could be right... let's wait for more informations! –  petrus Apr 7 '11 at 13:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.