0

I'm a newbie to IOS. In the past I've used consumer routers which seem to have the smarts to automatically route requests to internal hosts addressed by their public name back to the internal network. I think this is called hairpinning.

I need to do that so that an office laptop can access a server on our office network by its public name both from outside the office and inside.

This thing has me stumped but I'm sure it is a piece of cake for a network expert.

Note: We don't have an internal DNS (we only have 4 machines).

1
  • I wrote a post about how to allow a guest subnet to use public IPs for your DMZ hosts, might be interesting: systems-co.blogspot.com/2016/06/…
    – user361153
    Jun 17, 2016 at 17:20

3 Answers 3

1

Assuming...

  1. my understanding of the question is right (please see comment @petrus)
  2. and that you are exposing your internal server to the internet using a static nat using something such as:

    (config)# ip nat inside source static PRIVATE-IP PUBLIC-IP extendable

(no PAT, only plain, old and boring static nat) then any DNS reply in which in the payload there is a reference to the PUBLIC-IP (the same used in the static NAT) is going to be re-written to the PRIVATE-IP.

So if the pre-conditions are met (i.e. the use of static NAT) when your users query the external DNS server for your hostname they are going to receive the re-written DNS answer (PRIVATE_IP) and should connect to your server with no issues.

Your external users will be connecting to your server as usual, that is, using the PUBLIC-IP address of your server.

You may want to take a look to the following document: Network address translation of DNS responses

1

What you are looking to do is perform REVERSE PORT ADDRESS TRANSLATION.

People call it all sorts of crazy things like: NAT Hairpinning, NAT-on-a-stick, NAT reflecting, and NAT loopback.

Just to clear this up,.. Hairpinning is a technique used in a NAT-on-a-stick configuration that involves having the NAT "loopback" the traffic. This sounds like what you want, but is very likely NOT what you want. These configuration in their simple form have only one interface. They practically turn a router into a NAT server to a switched network.

It is difficult to get to these kind of questions using Google, so I will rephrase:

If you cannot reach an internal server using the GLOBAL IP address and port, then this post is FOR YOU!

You have to configure another type of NAT called NVI instead of traditional NAT.

To configure NAT NVI you substitute:

In interface configuration mode (config-if)

Replace:

ip nat outside and/or ip nat inside

With:

ip nat enable

Replace:

  ip nat inside source static a.b.c.d xx int fa0 yy

With:

  ip nat source static a.b.c.d xx int fa0 yy

In global configuration mode (config)

Replace:

  ip nat source route-map NAT_MAP interface Dialer1 overload

with:

  ip nat inside source route-map NAT_MAP interface Dialer1 overload

Now, you should be able to access your web server from the LAN using the GLOBAL IP ADDRESS.

This is GREAT, right ?! Not so if you have a dynamic IP address, because as soon the router reboots, it will start up, and the NAT entries will be classical NAT entries instead of NVI entries. This breaks "port forwarding" in general, so I wrote a script to re-enter the statements as soon as the interface is placed in up status. I'm just going to leave this here, and if anybody needs help feel free to ask.

(BTW, you can tell this is happening to you if you have ip nat source static ... statements visible in the output of show ip nat translations instead of ip nat nvi translations.)

The script is available here:

https://github.com/vittorio88/cisco-scripts/blob/master/fix_nvi.tcl

Save it, and copy to the router. Look inside the file for how configure IOS to use the script.

Good Luck!

P.S. Enabling NVI makes your router take a slight performance hit. This may be more notable on older routers or 800 series.

1
  • Great answer, but you should adjust your formatting to make it more readable. In particular, use code blocks and tags instead of italics etc.
    – fukawi2
    Jan 13, 2015 at 2:31
0

If you're asking, then I'll guess that what bothers you is the NAT (hum, pat actually) configuration.

If so, look at the following example :

ip nat inside source static tcp 172.22.151.10 22 interface FastEthernet1/0 22

This line will forward all incoming request on FastEthernet1/0 (WAN interface), tcp port 22, to the internal host 172.22.151.10, also on tcp port 22.

If you're on the inside, then there is no need for any configuration on the router and you should be able to reach the server directly.

2
  • My understanding of the question is what the OP is looking for is how his internal users can access the internal server using the server's "public" address, that is the server address that the external DNS server is translating for OP's external users...if this is the case then this NAT rule will not work...then it may very well be that my question understanding is wrong and if so please disregard this comment...
    – jliendo
    Apr 7, 2011 at 1:38
  • indeed, you could be right... let's wait for more informations!
    – petrus
    Apr 7, 2011 at 13:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .