Loopback to public IP address in local network

Question

I have following situation

We host internal web pages on our Windows Server 2003 for business proposals [purposes?] which we can access on 192.168.0.X:80 on the local network. We also have a FreeBSD router for our internet gateway which hosts static IP addresses in the 217.199.X.X subnet. Our external locations have internet access and they are coming into the local network through static IP and forwarding some ports on different local IP addresses depending on what type of services they are calling. One part of our business uses customized IE with predefined shortcuts for many local web pages on IE.

What I want to do is to create those shortcuts in the customized Internet Explorer that are going to be the same for clients from the local network as they are from the public network.

To be more clear here is one example:

If I want to access ReportServer from my internal network I call

http://192.168.1.1%3A80/ReportServer

for that same report server outside of my local network I can get it from

http://217.199.133.42%3A80/reportserver

But if from the local network I call

http://217.199.133.42%3A80/reportserver

I can't access my report server.

What can I do? One of the things that I'm already doing is that clients from outside the local network use a VPN to get access to the local network, but in that case they are losing their internet connection for other services.

Thank You in advance

Answer 1

What you're looking for is called "hairpin NAT". Requests from the internal interface for an IP address assigned to the external interface should be NAT'ted as though they came in from the external-side interface.

I don't have any FreeBSD familiarity at all, but reading the "pf" manual for OpenBSD (http://www.openbsd.org/faq/pf/rdr.html) the proposed solutions of split-horizon DNS, using a DMZ network, or TCP proxying lead me to believe that "pf" doesn't support hairpin NAT.

I'd look at going the route of split-horizon DNS and not using IP addresses in URLs internally but, instead, using names.

Answer 2

Why not use split horizon dns instead of hardcoding IP addresses everywhere? You would have ext.yourdomain pointing to 217.x.x.x on the outside, and then 192.x.x.x on the inside.

Answer 3

Ill answer to my questions just to broaden horizons for those with similar problems.

I am contacted my ISP and asked them to try solving my problems. What they had offered me is another public IP address just for server, Now I have local traffic on the WAN side of FreeBSD and We made specific pipes for faster throughput fol local traffic to public IP of Server