Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I currently have 2 Ubuntu 12.04 servers which are load balanced. If I go to anyone on them from the shell and type:

wget stackoverflow.com

The page is fetched into index.html. However, assuming the site hosted on those servers is called mysite.com, calling

wget mysite.com

I get:

Resolving mysite.com (mysite.com)... 50.XXX.YY.ZZZ
Connecting to mysite.com (mysite.com)|50.XXX.YY.ZZZ|:80... failed: Connection refused.

where 50.XXX.YY.ZZZ is the public IP of mysite.com. Any ideas what is wrong on those servers?

share|improve this question

2 Answers 2

up vote 6 down vote accepted

The basic issue is this:

  1. The server has a private inside IP address. (I'll call it 192.168.0.2 for simplicity.)

  2. It opens a connection from its private inside IP address to its public address. (From 192.168.0.2 to 59.XXX.YY.ZZ)

  3. This goes to the router, following the server's default route. (Since the machine doesn't know the public address is associated with itself.)

  4. The router port forwards the request to the public IP address and forwards it to the machine. The request still has a source of 192.168.0.2 but now it has a destination of 192.168.0.2.

  5. The machine receives a connection from 192.168.0.2 to 192.168.0.2, accepts the connection, and sends itself a response. (Since it knows 192.168.0.2 is local.)

  6. The machine is baffled to receive a response from 192.168.0.2 since it was expecting one from 59.XXX.YY.ZZ, and the connection attempt fails.

For hairpin NAT to work, the router has to not only forward the request to the correct inside machine rewriting the destination but it also has to rewrite the source to make sure the reply packets go back through the router so they can be NATted too. Many routers can't do this, and many that can require specific configuration.

share|improve this answer
    
I've always called this "loopback NAT". –  HTTP500 Jul 16 '12 at 20:46

Put

127.0.0.1 localhost mysite.com

in your /etc/hosts

I assume that it routes packages outside your box with the public IP and somehow they not get back.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.