Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've recently changed a network from a bunch of machines exposed to the net on a network to a more security conscious Firewall-fronted network with a DMZ for public services. Everything's mostly working perfectly now, but I've got the old problem of NAT Loopback where a machine within the LAN wants to access a public service via the public/external IP.

I've solved this problem previously in a small/SOHO environment simply using NAT loopback features of the router in use or a simple iptables rule to do the same, but I want to make sure I make the most resilient choice with the least concern.

It seems I can:

  • Use iptables as I've said to DNAT and MASQUERADE the change source/destination so the connection works correctly i.e

iptables -A PREROUTING -t nat -d ip.of.eth0.here -p tcp --dport 8080 -j DNAT --to iptables -t nat -A POSTROUTING -s -p tcp --dport 8080 -d -j MASQUERADE

  • Use split DNS, with internal mappings for public IP's
  • Potentially do some route nastyness by setting the Default Gateway to use a different externally exposed IP to then come back in the public route (messy)
  • Someone mentioned putting the Default Gateway within the DMZ as well (on serverfault), but I can't find the post again.

I'm sure this is a common issue for many with NAT'd networks, but I've not really seen the perfect solve all when it comes to fixing this problem.

What is your opinion?

share|improve this question
I assume your internal machines access these public facing services via DNS lookups and not direct IP access; if so, have your internal DNS server (if you have any) reply to internal clients with the internal IPs. –  jwbensley Oct 2 '12 at 8:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.