Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a DSL router which acts as NAT (SNAT & DNAT). I have setup a server on internal network (10.0.0.2 at port 43201). DSL router was configured to "port forward" (or DNAT) all incoming connections to 10.0.0.2:43201.

I created a virtual server for port forwarding on DSL router. I also added following iptables rules for port forwarding.

iptables -t nat -A PREROUTING -p tcp -i ppp_0_1_32_1 --dport 43201 -j DNAT --to-destination 10.0.0.2:43201
iptables -I FORWARD 1 -p tcp -m state --state NEW,ESTABLISHED,RELATED -d 10.0.0.2 --dport 43201 -j ACCEPT

# ppp_0_1_32_1 is routers external interface.
# routers internal IP address is 10.0.0.1 and server is setup at 10.0.0.2:43201

Problem is that connections coming from external IP addresses are able to access internal server using External IP address, but internal clients (under NAT) are not able to access server using external IP address.

Example: http://<external_address>:43201 is working from external clients
But, internal clients are not able to access using http://<external_address>:43201

This seems to be similar to the problem described in http://www.netfilter.org/documentation/HOWTO/NAT-HOWTO-10.html (NAT HOW-TO Destination NAT Onto the Same Network).

Firstly, I am not able to understand why is this a problem for internal clients? Secondly, what iptables rule will enable internal clients to access server using external IP address? Please suggest.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

This is because if your internal client tries to communicate with the server (within the same subnet) using the public IP, it has to send the request via the gateway (NAT box). The gateway will then do the DNAT from public IP to server private IP and then forwards it.

In the normal case, the web server will a request coming from the internal client IP address (same subnet). So, it will send back the reply directly without going through the gateway. The client will refuse to process the reply as it is sending to public IP and receiving the response from another (private) IP. It is confusing. Isn't it?

One solution is to talk to the server using private IP from internal clients. This can be hidden by implementing DNS split (internal & external views).

Another option is to force the traffic (from/to server) to go via the gateway (NAT box).

share|improve this answer

Not only is it similar to the problem described in the link it is identical to the problem described in the link. Either do the split horizon DNS as mentioned by Khaled or add a SNAT like so (as described in that link):

iptables -t nat -A POSTROUTING -d 1.2.3.4 -s 10.0.0.0/24 \
  -p tcp --dport 43201 -j SNAT --to 10.0.0.2

I'm assuming the external IP is 1.2.3.4 and the internal subnetwork is a /24.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.