Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to host a CalDAV and CardDAV server for devices that will roam between being on the LAN to outside my network (such as my iPhone and laptops). A static IP is prohibitively expensive.

I have a my own domain, a Mac Mini with Lion Server, a SonicWall TZ 200 and a dynamic address (the SonicWall keeps the dynamic account updated). I would normally set up a static IP and use split horizon DNS so those roaming devices can point to and function on and off my LAN.

Is a similar setup possible with the dynamic address? I am happy to set up the clients with either or but I would prefer to use my domain.

Would either hairpin NAT on the SonicWall or split horizon DNS using the Lion Server allow this to work?

share|improve this question

The reason split horizon DNS is set up is almost always because an internal service cannot be reached off of the LAN. For example, Active Directory domain controllers that also hold internal DNS. If your all of your services are intended to be externally reachable then split DNS isn't necessary, strictly speaking. Discard any use of split DNS in your design until you find a sure reason to use it.

Hairpin NAT / tromboning would be how anyone behind your firewall would reach your server, which is acceptable. The biggest downside to hairpinning is that it "unnecessarily" engages your SPI engine and anything else running in the firewall like UTM services. However, if that's how you intentionally designed it, then it's hard to call it "unnecessary" - the TZ 200 can take a decent amount of traffic and I highly doubt a CalDAV/CardDAV service will be getting thousands of requests per second from your internal network. =)

share|improve this answer
I've set up hairpin NAT like this… which works for the standard port, but I can't connect on the SSL port 8443. If I enter a local IP and select SSL I can connect so the problem must be in the server name and/or cert which is self signed, and not as of course. – ridogi Apr 21 '12 at 4:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.