Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've set up Routing and Remote Access (Windows Server 2003) to forward publicip:80 to a server on the private internal network, and that's working great. Incoming requests from the internet to port 80 are correctly forwarded to our internal web server and everything is fine.

However, requests on the server itself are not being forwarded. That is, if I open a console window and type "telnet publicip 80" from the server on publicip, the request is not forwarded to the private server.

I understand that in RRAS I've mapped port 80 on the public interface to the private server and that's why it's not working; but I don't know how to configure it so that requests from the local PC are also forwarded to the private server.

I'd appreciate any help or feedback on the matter.


share|improve this question
Try to test open ports – ITGuy24 Dec 17 '09 at 16:29

What you're looking for is called "hairpin NAT", and Microsoft's NAT implementation doesn't appear to support it. Packets that aren't traversing the NAT'd interface don't get NAT applied (i.e. sourcing from the private or local interface, destined for the private interface).

Microsoft's documentation isn't particularly clear about it (that I've ever been able to find, at least), but RRAS clearly doesn't behave in a manner that indicates support for hairpin NAT.

You can accomplish the same effect, by name at least, by creating a DNS zone in your local DNS server for the public name, and referring to the private IP address. (So, if your web site is "", create a DNS zone "", with a single blank "A" record in it referring to the private IP address of the web server.)

Your only other option is to switch to a NAT implementation, like Linux iptables, that supports hairpin NAT.

share|improve this answer
I can confirm RRAS doesn't support this, at least until Windows 2003 (don't know for 2008); IIRC, ISA Server supports it, though. – Massimo Dec 15 '09 at 18:31
I've also heard it called NAT Masquerading – Mark Henderson Dec 18 '09 at 10:09

Other options. If you are accessing by name, you can put an entry in the local hosts file on the RRAS server pointing the name to the interal ip. If you are accessing by IP, you should be able to put in a static route that says route publicip through privateip. The server at privateip should see the packet say "hey, that's me" and handle it appropriately, although you might require a route on the other side to get packets back correctly depending on your network setup.

share|improve this answer
up vote 0 down vote accepted

I've solved it by using 'netsh interface portproxy' as detailed at

This doesn't solve it at the network layer as RRAS does, but it does solve it without resorting to 3rd party software. Since only the localhost will pass through the RRAS filter, addressing this at the software layer is not an issue.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.