Cannot access website in LAN. NAT Hairpinning in nftables

Question

I am trying to get NAT hairpinning working on my router. I cannot access my local website host on my LAN (192.168.1.3). I am using nftables with the following config:

enp1s0 = WAN enp2s0 = LAN

#!/sbin/nft -f
flush ruleset
table ip nat {
        chain prerouting {
                type nat hook prerouting priority -100; policy accept;
                iifname "enp1s0" tcp dport { 80, 443 } dnat to 192.168.1.3
                meta nftrace set 1
        }

        chain postrouting {
                type nat hook postrouting priority 100; policy accept;
                ip saddr 192.168.1.0/24 ip daddr 192.168.1.3 tcp dport { http, https } counter snat 192.168.1.1
                oifname "enp1s0" masquerade
                meta nftrace set 1
        }
}

How exactly can I get hairpinning to work? I have seen people use split DNS but I am not too sure how to set that up.

Answer 1

To do NAT Hairpinning in nftables you can add a DNAT rule which is checking if the destination address of the packages is the external ip of your network. You also need to do masquerading on the internal interface (LAN).

flush ruleset

define wan = enp1s0
define lan = enp2s0

define webserver = 192.168.1.3
define extip = 1.2.3.4

table ip nat {
        chain prerouting {
                type nat hook prerouting priority dstnat; policy accept;
                tcp dport { 80, 443 } ip daddr $extip dnat to $webserver
        }

        chain postrouting {
                type nat hook postrouting priority srcnat; policy accept;
                oif $wan masquerade
                oif $lan masquerade
        }
}