1

I'm trying to make my public IP reachable also from inside LAN.

I know that it's better to spilt DNS in order to have an internal zone that solves hosts with internal IP, but for a lot of reasons this is not applicable to my environment.

I have a "simple" configuration, a server and few NAT ports:

set nat destination rule 4002 description 'NAT inbound'
set nat destination rule 4002 destination address 'x.y.z.k'
set nat destination rule 4002 destination port '80,443,10050,10051,11051'
set nat destination rule 4002 inbound-interface 'bond1'
set nat destination rule 4002 protocol 'tcp'
set nat destination rule 4002 translation address '10.0.0.190'

set nat source rule 4002 description 'NAT outbound'
set nat source rule 4002 outbound-interface 'bond1'
set nat source rule 4002 source address '10.0.0.190'
set nat source rule 4002 translation address 'x.y.z.k'

When I try to access the public IP from internal network I cannot reach it. It's a problem similar to How to implement Nat loopback/reflection?

I've found a solution here: http://onebadpixel.com/blog/2014/01/22/part-5-nat-translation/

And so I've tried to add this to configuration:

set nat source rule 1000 description 'NAT hairpin'
set nat source rule 1000 destination address '10.0.0.128/24'
set nat source rule 1000 outbound-interface 'bond0'
set nat source rule 1000 source address '10.0.0.128/24'
set nat source rule 1000 translation address 'masquerade'

But it still don't work.

Any suggestion on how to change my configuration in order to use DNS hairpin?

I'm not expert in Vyatta, I came from Cisco ASA world where it was easy... just add "dns" on the NAT rule ;)

Thanks Fabio

  • I did this a while back so I might not be remembering things correctly but don't you also need the appropriate firewall rules on the interface – Drifter104 Aug 3 '15 at 17:11
0

You can view an example here (answer from SteveP):

http://forum.vyos.net/showthread.php?tid=6554

(VyOs is an open source fork of Vyatta and this should be applicable)

Note the the hairpin is done through a nat destination rule and not a nat source.

NAT destination change the destination IP address (which is what you need in this case) and is performed prior to the routing decision while NAT source rewrite the source IP address is processed after the routing decision.

Also in your configuration "10.0.0.128/24" is curious. You should use either 10.0.0.0/24 for the network or 10.0.0.128 for the host.

  • Thanks, about the network is correct 10.0.0.0/24, 10.0.0.128/24 was an error due to various tests putting the single IP and/or the network with mask. I've checked the message on the vyatta forum and the configuration seems similar to mine. I will ask there, maybe someone have a solution. – Fabio Aug 4 '15 at 12:03
  • did you test with a nat destination rule? – JFL Aug 4 '15 at 12:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.