Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm a newbie to IOS. In the past I've used consumer routers which seem to have the smarts to automatically route requests to internal hosts addressed by their public name back to the internal network. I think this is called hairpinning.

I need to do that so that an office laptop can access a server on our office network by its public name both from outside the office and inside.

This thing has me stumped but I'm sure it is a piece of cake for a network expert.

Note: We don't have an internal DNS (we only have 4 machines).

share|improve this question
I wrote a post about how to allow a guest subnet to use public IPs for your DMZ hosts, might be interesting:… – Kyler Jun 17 at 17:20
up vote 1 down vote accepted


  1. my understanding of the question is right (please see comment @petrus)
  2. and that you are exposing your internal server to the internet using a static nat using something such as:

    (config)# ip nat inside source static PRIVATE-IP PUBLIC-IP extendable

(no PAT, only plain, old and boring static nat) then any DNS reply in which in the payload there is a reference to the PUBLIC-IP (the same used in the static NAT) is going to be re-written to the PRIVATE-IP.

So if the pre-conditions are met (i.e. the use of static NAT) when your users query the external DNS server for your hostname they are going to receive the re-written DNS answer (PRIVATE_IP) and should connect to your server with no issues.

Your external users will be connecting to your server as usual, that is, using the PUBLIC-IP address of your server.

You may want to take a look to the following document: Network address translation of DNS responses

share|improve this answer

What you are looking to do is perform REVERSE PORT ADDRESS TRANSLATION.

People call it all sorts of crazy things like: NAT Hairpinning, NAT-on-a-stick, NAT reflecting, and NAT loopback.

Just to clear this up,.. Hairpinning is a technique used in a NAT-on-a-stick configuration that involves having the NAT "loopback" the traffic. This sounds like what you want, but is very likely NOT what you want. These configuration in their simple form have only one interface. They practically turn a router into a NAT server to a switched network.

It is difficult to get to these kind of questions using Google, so I will rephrase:

If you cannot reach an internal server using the GLOBAL IP address and port, then this post is FOR YOU!

You have to configure another type of NAT called NVI instead of traditional NAT.

To configure NAT NVI you substitute:

ip nat outside or ip nat inside for ip nat enable in interface configuration mode.

ip nat inside source static a.b.c.d xx int fa0 yy for ip nat source static a.b.c.d xx int fa0 yy in global configuration mode.

ip nat source route-map NAT_MAP interface Dialer1 overload for ip nat inside source route-map NAT_MAP interface Dialer1 overload in global configuration mode.

Now, you should be able to access your web server from the LAN using the GLOBAL IP ADDRESS.

This is GREAT, right ?! Not so if you have a dynamic IP address, because as soon the router reboots, it will start up, and the NAT entries will be classical NAT entries instead of NVI entries. This breaks "port forwarding" in general, so I wrote a script to re-enter the statements as soon as the interface is placed in up status. I'm just going to leave this here, and if anybody needs help feel free to ask.

(BTW, you can tell this is happening to you if you have ip nat source static ... statements visible in the output of show ip nat translations instead of ip nat nvi translations.)

The script is available here:

Save it, and copy to the router. Look inside the file for how configure IOS to use the script.

Good Luck!

P.S. Enabling NVI makes your router take a slight performance hit. This may be more notable on older routers or 800 series.

share|improve this answer
Great answer, but you should adjust your formatting to make it more readable. In particular, use code blocks and tags instead of italics etc. – fukawi2 Jan 13 '15 at 2:31

If you're asking, then I'll guess that what bothers you is the NAT (hum, pat actually) configuration.

If so, look at the following example :

ip nat inside source static tcp 22 interface FastEthernet1/0 22

This line will forward all incoming request on FastEthernet1/0 (WAN interface), tcp port 22, to the internal host, also on tcp port 22.

If you're on the inside, then there is no need for any configuration on the router and you should be able to reach the server directly.

share|improve this answer
My understanding of the question is what the OP is looking for is how his internal users can access the internal server using the server's "public" address, that is the server address that the external DNS server is translating for OP's external users...if this is the case then this NAT rule will not work...then it may very well be that my question understanding is wrong and if so please disregard this comment... – jliendo Apr 7 '11 at 1:38
indeed, you could be right... let's wait for more informations! – petrus Apr 7 '11 at 13:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.