Dead-simple Juniper firewall hairpinning [closed]

Question

I have a SRX100 firewall running JunOS 12.1. I have a WAN interface proxy ARPing ten or so static routable IPs. I have a LAN interface on a simple class-C subnet (we'll call it 192.168.0.x). I'm using destination NAT and appropriate policy openings to allow in selective services from WAN to LAN (e.g. POP, IMAP, HTTP(S), etc.). Everything is working as expected.

Currently I'm fudging local DNS to point to internal addresses for hosts which are exposed through NAT. However I'd like to have my internal clients hit these services (and only these services) through the external IPs so I can do away with the local DNS. I've also been told to soon implement a DMZ for certain forward-facing services which necessarily means creating rules like this. Can anyone point to a simple simple tutorial for allowing this using the Web interface GUI?

Would a simple augmentation of the existing destination NAT rules and policy suffice?

Answer 1

Have you looked at the nice Juniper KB article that is titled "How to setup Hairpin NAT"?

Configuration example from their page (obviously not using your IP address space):

set security nat source rule-set hairpin from zone default
set security nat source rule-set hairpin to zone default
set security nat source rule-set hairpin rule hairpin-source match source-address 10.0.0.0/24
set security nat source rule-set hairpin rule hairpin-source then source-nat interface

set security nat destination pool server address 10.0.0.5/32
set security nat destination rule-set hairpin from zone default
set security nat destination rule-set hairpin rule hairpin-destination match destination-address 155.100.1.1/32
set security nat destination rule-set hairpin rule hairpin-destination then destination-nat pool server