Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a DSL router which acts as NAT (SNAT & DNAT). I have setup a server on internal network ( at port 43201). DSL router was configured to "port forward" (or DNAT) all incoming connections to

I created a virtual server for port forwarding on DSL router. I also added following iptables rules for port forwarding.

iptables -t nat -A PREROUTING -p tcp -i ppp_0_1_32_1 --dport 43201 -j DNAT --to-destination
iptables -I FORWARD 1 -p tcp -m state --state NEW,ESTABLISHED,RELATED -d --dport 43201 -j ACCEPT

# ppp_0_1_32_1 is routers external interface.
# routers internal IP address is and server is setup at

Problem is that connections coming from external IP addresses are able to access internal server using External IP address, but internal clients (under NAT) are not able to access server using external IP address.

Example: http://<external_address>:43201 is working from external clients
But, internal clients are not able to access using http://<external_address>:43201

This seems to be similar to the problem described in (NAT HOW-TO Destination NAT Onto the Same Network).

Firstly, I am not able to understand why is this a problem for internal clients? Secondly, what iptables rule will enable internal clients to access server using external IP address? Please suggest.

share|improve this question
up vote 2 down vote accepted

This is because if your internal client tries to communicate with the server (within the same subnet) using the public IP, it has to send the request via the gateway (NAT box). The gateway will then do the DNAT from public IP to server private IP and then forwards it.

In the normal case, the web server will a request coming from the internal client IP address (same subnet). So, it will send back the reply directly without going through the gateway. The client will refuse to process the reply as it is sending to public IP and receiving the response from another (private) IP. It is confusing. Isn't it?

One solution is to talk to the server using private IP from internal clients. This can be hidden by implementing DNS split (internal & external views).

Another option is to force the traffic (from/to server) to go via the gateway (NAT box).

share|improve this answer

Not only is it similar to the problem described in the link it is identical to the problem described in the link. Either do the split horizon DNS as mentioned by Khaled or add a SNAT like so (as described in that link):

iptables -t nat -A POSTROUTING -d -s \
  -p tcp --dport 43201 -j SNAT --to

I'm assuming the external IP is and the internal subnetwork is a /24.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.