Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this community
We have a nat with prerouting like this: iptables -t nat -I PREROUTING -p tcp -d mysite.com --dport 37777 -j DNAT --to-destination 192.168.1.2:37777
If I try to connect from other network, the service works fine. Unfortunatelly, when I try to connect from inside the network the connection times out. Am I forgotting some thing? Thanks in advance.
The option you are looking for is NAT Hairpinning.
When the client from within the network tries to access the public IP address of the router, the destination of the connection is changed to 192.168.1.2:37777. The server receives the start of the handshake and replies to the source address (still the client) with the response to a handshake. Since the client only remembers talking to the router's IP address and not the one of the server, the client sees this connection as being invalid.
With hairpinning, when the destination is changed, the source is also changed to the router's IP address if the client is within the LAN. This means that the server passes it back to the router and the router relays the packets to the client. From the clients point of view, this looks like it is talking to the router.
Edit: As for iptables, you're looking to add something along the lines of
iptables -t nat -I POSTROUTING -p tcp -d 192.168.1.2 -s 192.168.1.0/24 --dport 37777 -j SNAT --to-source 192.168.1.1
