up vote 0 down vote favorite
share [g+] share [fb]

I have a public IP, say, 123.45.67.89 And a private network of 192.168.1.0/24

When I am anywhere outside the private network, I can connect to the public IP. When I am inside the private network, I cannot communicate with the public IP (HTTP/IMAP/etc).

I am told that my DNS should resolve to the private IP from the public IP when inside the network.

Is this true, and how would I go about doing this? On server 2003 (the DNS server) I setup a reverse lookup of 123.45.67.0 and created a pointer of 123.45.67.89 to my private hostname. After an ipconfig /flushdns on a client, this doesn't appear to be working.

link|improve this question
feedback

3 Answers

up vote 1 down vote

The problem you are getting is that the router does not have NAT traversal enabled. If you want to connect to your server from inside the network you will need to enable NAT traversal (if it is an option) or you will need to use the private IP. You should also be able to use an internal DNS option where an internal domain name points to that private IP.
Configuring a public DNS record to point to a private IP or hostname will not work.

link|improve this answer
Using the private IP/domain name is not an option. For example, my cell phone pulls emails from our server via the public IP, works fine. When I enter the building and connect to the building's wireless I get a private IP and can no longer retrieve email from the server's public IP. In terms of NAT traversal, I am not sure. Everything worked fine before on a Linksys, but a company has installed a Cisco router and now the public IP inside no longer works and they have told me to configure my DNS to resolve the public IP to the private IP of our server. The DNS server is on Server 2003. – Fase Aug 24 '11 at 15:34
1  
I think asking the folks that installed and may manage the Cisco hardware would be a good start. As @MaQleod says, there is a config change needed to achieve your goal. However, the Cisco may have been configured this way intentionally to address a security issue. – Dave M Aug 24 '11 at 16:06
I have contacted them and their response was to set it up on my DNS server, which to me sounds incorrect. Provided you are using a third party DNS server it would also not work - something that wasn't the case with the Linksys router. – Fase Aug 24 '11 at 16:19
The irony, Dave M, is that the network administrators themselves probably asked the "How do I do hairpin NAT with Cisco kit?" question somewhere such as ServerFault, and got the answer that's all over the WWW: "I don't know myself. Just use split-horizon DNS instead." – JdeBP Aug 24 '11 at 22:00
feedback
up vote 1 down vote

DNS does not route anything – it only resolves names.

The function you are looking for is Split-horizon DNS. You can set up your DNS server to resolve the same name to different addresses, depending on where the request comes from. For example:

192.168.0.1 → dnsserver:  query  'mail.example.com.' A
dnsserver → 192.168.0.1:  answer 'mail.example.com.' A 192.168.1.42

45.67.89.0 → dnsserver:   query  'mail.example.com.' A
dnsserver → 45.67.89.0:   answer 'mail.example.com.' A 123.456.78.9

For Windows Server 2003, you'll probaly need a second DNS server. See these two pages for more information.

link|improve this answer
I'm quite sure this is way outside what is necessary as I said in a comment above, a simply Linsys router had everything working fine. Once it was replace with an industry grade Cisco router it no longer worked. Although this may work, I do not have a second DNS server. – Fase Aug 24 '11 at 16:32
You are wrong to be quite sure. (If you knew the right answer, you wouldn't be here asking the question, would you?) This is what is necessary. grawity is right. MaQleod has said the same thing. I say the same thing. Heck, you've told us in that self-same comment that your own network administrators have said the same thing to you. Set up the split-horizon DNS service. Your network administrators aren't providing hairpin NAT any more, and have told you to set your DNS servers to provide split-horizon service instead. So do that! – JdeBP Aug 24 '11 at 21:25
feedback
up vote 0 down vote accepted

The solution was to use a hostname instead of the public IP. The hostname used for the public IP was the one assigned by the ISP. From there, I added an entry in the DNS to forward traffic to the hostname to the private IP. On the outside of the network the hostname will obviously resolve to the public IP. I was told that the reason this wasn't an issue before with the Linksys router was because Linksys has weaker security and the NAT engine allowed it. The Cisco router will not allow it due to security. It is not possible to connect to the router's public IP when behind it on a private IP.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.