Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a one to one NAT on pfsense that assigns a public IP to an internal IP (running a web server).

When I open the public IP from an internal machine, it will not resolve to the internal IP, instead it opens the router web page.

When I open the public IP from outside my LAN it will go through to the internal IP that is running the web server.

Why can't I open the public IP internally?

share|improve this question

I'm also guessing it will be the hairpin NAT issue as mentioned above. There are lots of different names for the same thing - pfSense calls this NAT Reflection.

At the bottom of the relevant NAT/port forward rule, check the 2nd option from the bottom - NAT reflection should be enabled.

The change the default for new rules, you can go to system, advanced, Firewall/NAT then under the Network Address Translation section, uncheck the first box that says Disable NAT Reflection for port forwards.

Also depending on your setup, you may need to disable the HTTP_REFERER and DNS Rebinding checks under System, Advanced, Admin Access. However I would try with the checks enabled first.

share|improve this answer
I have one ip with port forward, another ips use 1 to 1 nat, the ip used with port fowarding works :) however nat 1 to 1 does not work. – 001 Feb 20 '12 at 3:38
I'm guessing it may be easier for you to use split DNS so internal clients get the internal IP of your webserver rather than the actual external router IP. To do so, you will need to create an A record for to point to the internal/actual IP address of your webserver. To do so, assuming you are using pfSense for DNS, just go to the DNS forwarder section and make an entry at the bottom. If you are using Windows Server DNS, you can make an entry in DNS under Control Panel/Administrative Tools. – Robin Gill Feb 20 '12 at 20:48

Your router's web-based administration is on port 80, so when an inside machine accesses the router on port 80, that's what they get. Moving the router's web administration to another port (typically 8000 or 8080) might fix the problem, unless the router doesn't support hairpin NAT (NATing connections from the inside back to the inside) at all.

share|improve this answer
the router is pfsense :) thats my only router... ok i will try to move the port and see if this helps :) – 001 Feb 19 '12 at 7:01
changing the port, didnt work. :( – 001 Feb 19 '12 at 7:48
pfsense requires a specific rule for hairpin NAT. – David Schwartz Feb 19 '12 at 8:15
Setting NAT Reflection in the NAT mapping rule to "Enable (Pure NAT)" fixed it here. – Koen Zomers May 24 '14 at 14:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.