Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I asked a similar question a while ago, but foolishly referenced inside-to-inside NAT. Not being a network admin my terminology on the networking side of things was limited and lead to answers that answered my question, but not the spirit of my question.

Imagine a situation which is common for most small/medium businesses that host their own servers:

  1. You have a single firewall with multiple interfaces. They are LAN, WAN, and DMZ.

  2. Your web/mail servers have RFC1918 addresses that are 1:1 NAT'd from the DMZ interface to public IPs.

  3. Devices on the LAN interface regularly communicate with devices on the DMZ interface.

  4. You have an Active Directory domain named your web servers are in the external zone.

In a lot of deployments, it is common to see the internal DNS servers (AD Domain Controllers) hosting an internal copy of the zone with the RFC1918 addresses. Why don't more organizations configure NAT U-turns/hairpins so that you don't need a second copy of this zone with different information? Why don't organizations simply have internal DNS for and external DNS for and call it a day?

Yes, in large businesses you would ideally have separate DMZ firewalls and even separate DMZ internet connections. This isn't the case in any SMB that I know.

Yes, the ASA has some crappy licensing regarding this. I don't care about licensing constraints, it's just money. I know they can be configured to allow this with same-security-traffic.

I worked in a Juniper shop for years where this worked fine without any crazy configurations, how is it that Cisco admins seem to have so many problems with this? Is it really much easier to accomplish on Juniper kit? It is a limitation of IOS that makes Cisco network admins not interested in configuring it?

share|improve this question
I don't know about other locations, but my Internet connection is only 10mb, so my firewall interfaces are only 100mb at one site. If I had a hairpin NAT then traffic would be going through that 100mb interface, instead of connecting to the internal host directly through the switches which all do at least 1GB. – Zoredache Sep 27 '13 at 17:13
If your network connection is only 10Mb then you have 90% of that interface free (at least) at all times. In most places that I've seen, mail and web traffic to these internal sites will not amount to 90Mb. I, personally, would like to see a simplified DNS infrastructure in this case, but I can see the argument for the other side as well. – MDMarra Sep 27 '13 at 17:17
@Zoredache hate to follow up with a second comment, but if you can reach your web-accessible servers in a DMZ without actually traversing the firewall, doesn't that defeat the purpose of having a DMZ in the first place? Shouldn't the firewall have to be involved to ensure isolation of your web-facing systems? If it isn't involved, why have a DMZ interface at all? Why not just have everything NAT'd out from the LAN interface and simplify even further. – MDMarra Sep 27 '13 at 17:32
I don't bother because I have IPv6, making this unnecessary. – Michael Hampton Sep 27 '13 at 18:21
@MichaelHampton But my Belkin router doesn't support IPv6 :( – ewwhite Sep 27 '13 at 18:27

Not everyone's network uses devices that can NAT at LAN speeds. It's not unusual to have devices that can route 100Mb/s but NAT a tenth of that while your LAN is all gigabit.

Often you have servers in the DMZ that you need high-speed access to locally. You want to back up your mail and web servers, right? And do you want your backups in the DMZ?

NAT also breaks long-lived, idle connections because the translation times out. Hairpin obscures the origin IP address, making audit trails useless. NAT, other than 1-to-1, is a painful hack, and you want internal traffic to be reliable.

Attack resistance is another issue. Connection flooding can cause your NAT device to run out of slots and there are companies that reboot their Internet-facing equipment regularly and would prefer not to disturb long-lived internal connections. Even if your equipment is entirely reliable, separating the internal network from the devices that handle the public IP space is just a good idea.

share|improve this answer

This is how I was taught, so I don't have a better answer... but for me, it eliminates the reliance on the firewall device. In small businesses, the firewalls are typically low-end products (think Linksys/Dlink/Sonicwall). Relying on it to access internal resources from inside the network can create problems. It's a bad dependency.

I have a client now who reboots their Cisco ASA 5510 firewall several times a day to fix a VoIP problem for remote users (probably an xlate issue). For their internal users who use Exchange and the usual public/private services, having internal DNS redirection at least limits the impact of the firewall reboots.


But I needed it in a pinch recently...

enter image description here

share|improve this answer
I'd hope someone self-hosting production web-sites isn't running it through a Linksys :) although, I'm sure if it's been done you've seen it. And if the firewall was down, no one is getting to your mail/web anyway so it doesn't matter much. – MDMarra Sep 27 '13 at 17:20
I have a client now who reboots their Cisco ASA 5510 firewall several times a day to fix a VoIP problem for remote users So should I not use a laptop because I know a user that regularly spills coffee on it and is without one for days at a time? An obvious misconfiguration on a single device doesn't come across as a valid reason for this. I see ASA clusters deployed all the time that are rock solid and never need to be rebooted. And if they do, it's one at a time. – MDMarra Sep 27 '13 at 17:32
The firewall is healthy... but it's just an example that the firewall doesn't need to be in this path. – ewwhite Sep 27 '13 at 17:55
If the DMZ hosts don't need the firewall in the picture for LAN clients to communicate with them, then you don't really have a DMZ... – MDMarra Sep 27 '13 at 17:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.