I have a DSL router which acts as NAT (SNAT & DNAT). I have setup a server on internal network ( at port 43201). DSL router was configured to "port forward" (or DNAT) all incoming connections to

I created a virtual server for port forwarding on DSL router. I also added following iptables rules for port forwarding.

iptables -t nat -A PREROUTING -p tcp -i ppp_0_1_32_1 --dport 43201 -j DNAT --to-destination
iptables -I FORWARD 1 -p tcp -m state --state NEW,ESTABLISHED,RELATED -d --dport 43201 -j ACCEPT

# ppp_0_1_32_1 is routers external interface.
# routers internal IP address is and server is setup at

Problem is that connections coming from external IP addresses are able to access internal server using External IP address, but internal clients (under NAT) are not able to access server using external IP address.

Example: http://<external_address>:43201 is working from external clients
But, internal clients are not able to access using http://<external_address>:43201

This seems to be similar to the problem described in http://www.netfilter.org/documentation/HOWTO/NAT-HOWTO-10.html (NAT HOW-TO Destination NAT Onto the Same Network).

Firstly, I am not able to understand why is this a problem for internal clients? Secondly, what iptables rule will enable internal clients to access server using external IP address? Please suggest.


This is because if your internal client tries to communicate with the server (within the same subnet) using the public IP, it has to send the request via the gateway (NAT box). The gateway will then do the DNAT from public IP to server private IP and then forwards it.

In the normal case, the web server will a request coming from the internal client IP address (same subnet). So, it will send back the reply directly without going through the gateway. The client will refuse to process the reply as it is sending to public IP and receiving the response from another (private) IP. It is confusing. Isn't it?

One solution is to talk to the server using private IP from internal clients. This can be hidden by implementing DNS split (internal & external views).

Another option is to force the traffic (from/to server) to go via the gateway (NAT box).


Not only is it similar to the problem described in the link it is identical to the problem described in the link. Either do the split horizon DNS as mentioned by Khaled or add a SNAT like so (as described in that link):

iptables -t nat -A POSTROUTING -d -s \
  -p tcp --dport 43201 -j SNAT --to

I'm assuming the external IP is and the internal subnetwork is a /24.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.