0

We have a nat with prerouting like this: iptables -t nat -I PREROUTING -p tcp -d mysite.com --dport 37777 -j DNAT --to-destination 192.168.1.2:37777

If I try to connect from other network, the service works fine. Unfortunatelly, when I try to connect from inside the network the connection times out. Am I forgotting some thing? Thanks in advance.

0

The option you are looking for is NAT Hairpinning.

When the client from within the network tries to access the public IP address of the router, the destination of the connection is changed to 192.168.1.2:37777. The server receives the start of the handshake and replies to the source address (still the client) with the response to a handshake. Since the client only remembers talking to the router's IP address and not the one of the server, the client sees this connection as being invalid.

With hairpinning, when the destination is changed, the source is also changed to the router's IP address if the client is within the LAN. This means that the server passes it back to the router and the router relays the packets to the client. From the clients point of view, this looks like it is talking to the router.

Edit: As for iptables, you're looking to add something along the lines of iptables -t nat -I POSTROUTING -p tcp -d 192.168.1.2 -s 192.168.1.0/24 --dport 37777 -j SNAT --to-source 192.168.1.1

  • Interestingly I discovered this network uses one gateway for input traffic and other for output traffic. The rule was on the input router only. After I added the same rule on the other router the problem was solved. Thanks for the tips. – Fisher Jan 30 '18 at 11:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.