Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 0 down vote favorite

I'm on a NATed home network (10.0.0.0/8) with my cable modem having public IP 1.1.1.2 and a webserver "www" on the internal network 10.1.10.2 having port 80 forwarded by the cable modem.

Now I use a desktop client (10.1.10.3) to access www from a browser; DNS translates this to the webserver's public IP of 1.1.1.2, and the browser hangs. This happens on a variety of internal machines within my network, but works fine for clients outside of my LAN.

Also, internal clients can enter 10.1.10.2 on their browser and access the webserver just fine.

Question: Any idea why the public IP causes failure?

Note: I fixed this problem by running my own DNS (via dnsmasq) and setting "www" to 10.1.10.2, while forwarding all other names to an external nameserver.

share|improve this question
Off you fixed it, make an answer out of what you did to help future visitors – Luke Aug 24 '12 at 15:05
Why do you have your lan set up with a mask length of 8? – user142485 Aug 24 '12 at 15:08
@Luke I fixed the problem I had, but I'm posting here with a question that I don't have the answer for. – Fixee Aug 24 '12 at 15:50
@user142485 10.*.*.*/8 is a RFC1918 address range. You can set the mask to anything between 8 and 30 for a LAN, depending on how many hosts you have. (tools.ietf.org/html/rfc1918) – Fixee Aug 24 '12 at 15:52
@Fixee Yes, that is why I was curious as to why it is set to allow for over 16.5 million hosts. – user142485 Aug 24 '12 at 15:58
show 2 more comments

1 Answer

up vote 3 down vote accepted

For this to work, your router needs to support a feature called hairpin NAT. Basically it has to perform NAT translation even though the packet is not going on the WAN interface (which is the interface where NAT is normally applied). Some routers support this, some don't. Linux, for one, doesn't, and lots of home routers are built with Linux. You must have one of the kind that doesn't.

Be aware that even if hairpin NAT works, all of the traffic in that scenario is forced to go through the router, whereas if you communicate directly with the webserver's internal IP the traffic can go directly to the webserver at layer 2. For that reason, your dnsmasq solution is better. That solution is not always possible (e.g. if some hosts behind the NAT are statically configured to use a nameserver other than the one supplied by the DHCP server) but if it works for you you should go with it.

share|improve this answer
My router is a Comcast Business Class cable modem (that has a simple router built-in). I looked up Hairpin NAT and it appears to describe exactly my problem, so thanks very much for pointing me there. I will stick with dnsmasq given your point that it saves traffic through the router (and I can point all hosts in my network to my own name server, so this works for me!). – Fixee Aug 24 '12 at 21:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.