1

On internal network I have a client and a server. Server is hosting example.com and fake.example.com that are also open to the internet through NAT. Any computer on the internet can access example.com or fake.example.com, but internal computers get redirected to router page when accessing either either site. How do I troubleshoot this issue, or what things should I take a look at?

Server: 10.10.0.10 with NAT route to public ip x.x.x.170 Client(s): 10.10.0.100 with NAT route to public ip x.x.x.174

example.com A record is set to x.x.x.170 so is fake.example.com

nslookup example.com and tracert example.com do indeed come back to x.x.x.170

Improve this question
3
  • 1
    This sounds like an internal DNS problem. You need to change your internal DNS to use your internal IP addresses for their respective servers/services. Otherwise, your system will route you to the router instead of the NAT'd service.
    – CIA
    Sep 16, 2015 at 21:09
  • Your internal clients should be using an internal DNS server to resolve these names and the internal DNS server should return the internal ip addresses of these servers for internal queries for these names.
    – joeqwerty
    Sep 16, 2015 at 21:14
  • Our directory is setup to via domain internal.example.com and our locally hosted website is example.com This is offtopic question, but wouldn't this new forward lookup zone for example.com interfere with internal.example.com?
    – jM2.me
    Sep 16, 2015 at 21:27

1 Answer 1

Reset to default
2

The device that is performing your NAT simply isn't NATing properly when the request is coming from the internal network. This is common; Cisco ASAs have this "problem" by default. Depending on your device, you may be able to configure it to allow this type of connection (commonly called a "hairpin"), or it may not be possible and you'll have to have DNS resolve differently for internal clients.

Improve this answer
4
  • I have hairpin enabled, but perhaps after switching to a bigger ip address block inside-to-inside nat rules need to be setup? I am on the right track with this?
    – jM2.me
    Sep 16, 2015 at 21:14
  • Is your device an ASA? If so, I remember that the config to enable hairpinning is complex and far more than a single command, so I wouldn't be surprised if changing your network config would necessitate also changing the hairpin config. That said, I don't remember the actual steps enough to tell you what to do or even be 100% sure of what I just said.
    – wfaulk
    Sep 16, 2015 at 21:17
  • I am using Ubiquity EdgeRouter. This link looks like something that would be of help, but after going through it still routes to switch. Will have to give DNS a try
    – jM2.me
    Sep 16, 2015 at 21:22
  • 1
    I'm not familiar with that device, but that documentation makes it clear that hairpinning doesn't just happen automatically, so that matches my assumption. It also looks like well-written documentation, so I'd just try it again. That said, there's nothing wrong with disabling hairpinning and just having different IPs for your internal network.
    – wfaulk
    Sep 16, 2015 at 21:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .