I have a very simple gateway running a minimal Linux which is serving as an IP router with NAT and DHCP on the LAN, and a static IP on the WAN. The gateway router from the LAN side goes to a big switch from which about 200 users gain access (DHCP assigns them NAT addresses). Of these 200 hosts on the LAN I have one which (call it Argon) that I'd like to access at a fixed static IP address from both within the LAN and from the WAN. Let's say my NAT is, the LAN address on my gateway is, Boron is a host on the LAN with IP, and Carbon is a host on the WAN with the IP

Say that I own the IP I'd like to assign to Argon, and be able to send and receive both TCP and UDP traffic from both Boron (at and from Carbon (at where both Boron and Carbon would send messages to the IP address to reach Argon.

I don't think my router has the capability to run DNS or VPN so I'd like to avoid these routes as solutions if possible. However if the constraints I've places make the problem unsolvable I'd prefer to set up a DNS as a solution rather than VPN so if anyone has a DNS solution for this problem (that isn't dynamic DNS) I'd appreciate those solutions too.

Apologies if the question is basic, or not on point; I'm definitely a networking novice.

Thank you for your help.


If already points to the WAN interface on your router, you should just have to add a static route to the internal host on the router.

ip router add dev eth1

Where eth1 is the LAN side nic on the router. (Ensure that ip forwarding is on for both interface wan and lan on the router).

Then just assign to the nic on Argon. Unless it has a LAN IP in the subnet, Argon will have to set it's route as:

ip route add dev eth0
ip route add default via

internal clients should have no trouble. Packets will leave internal hosts via the NIC defined for the default gateway. The default gateway is your router. The route has a route to back out it's LAN interface.

I think this should work. If it doesn't, you'll have to figure out how to deal with hairpin forwarding on your distribution. (I really think it should work by default in most cases...).

If you want to attempt to assign to the router itself and then use NAT to direct everything to an internal IP for Argon the magical phrase becomes "Hairpin NAT". You can read more about that rabbit hole here: Can't access domain internally via public IP address

And for the sake of completion... if does not currently point to your router's wan nic... you will have to talk to the provider about getting routed to your router. (Consumer grade equipment won't cut it here)

For those that like pictures (I'm not great at diagrams and all I had installed was paint) here is what the routes look like without NAT:

Linux Hairpin Routing without NAT

  • If the first configuration doesn't work. You can add a 'bridge interface' to the router, assign the lan ip to the bridge and add the lan nic to the bridge. The bridge should then have an option available to enable hairpin... – Daniel Widrick Aug 11 '15 at 23:31
  • Thanks a lot for your help Daniel, I was able to get your first solution to work but you hairpin diagram was actually very helpful in that; so thanks for taking the time to draw it. – darkhipo Aug 12 '15 at 19:03

What you are describing is called SNAT or 1:1 NAT in other terms. It maps a single address on one network, to a single address on another and is the most common way to expose services on a single host (usually to the internet) on the planet. So providing your gateway supports it, you need to create a 1:1 NAT of to

All traffic to is then directed at and all traffic leaving the network via the 10 interface on the gateway would come from

Hope this helps!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.