Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I currently have 2 Ubuntu 12.04 servers which are load balanced. If I go to anyone on them from the shell and type:


The page is fetched into index.html. However, assuming the site hosted on those servers is called, calling


I get:

Resolving ( 50.XXX.YY.ZZZ
Connecting to (|50.XXX.YY.ZZZ|:80... failed: Connection refused.

where 50.XXX.YY.ZZZ is the public IP of Any ideas what is wrong on those servers?

share|improve this question
up vote 6 down vote accepted

The basic issue is this:

  1. The server has a private inside IP address. (I'll call it for simplicity.)

  2. It opens a connection from its private inside IP address to its public address. (From to 59.XXX.YY.ZZ)

  3. This goes to the router, following the server's default route. (Since the machine doesn't know the public address is associated with itself.)

  4. The router port forwards the request to the public IP address and forwards it to the machine. The request still has a source of but now it has a destination of

  5. The machine receives a connection from to, accepts the connection, and sends itself a response. (Since it knows is local.)

  6. The machine is baffled to receive a response from since it was expecting one from 59.XXX.YY.ZZ, and the connection attempt fails.

For hairpin NAT to work, the router has to not only forward the request to the correct inside machine rewriting the destination but it also has to rewrite the source to make sure the reply packets go back through the router so they can be NATted too. Many routers can't do this, and many that can require specific configuration.

share|improve this answer
I've always called this "loopback NAT". – HTTP500 Jul 16 '12 at 20:46

Put localhost

in your /etc/hosts

I assume that it routes packages outside your box with the public IP and somehow they not get back.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.