We have a Verizon Router and we have configured some port forwarding rules.

For example: port 8443 will go to one of our internal addresses We also have DNS entries for mysite.com to point to the Router Address.

When we are external and visit mysite.com:8443 - everything works as expected. However if we are internal and visit mysite.com:8443 - it spins forever.

I am assuming we need an internal DNS server to resolve? Assuming this is the case and we set up an internal DNS (any info appreciated) - when a request originates inside the network - what is the resolution?

CHECK INTERNAL DNS (would map hostnames to local addresses) AND THEN CHECK EXTERNAL DNS (would map hostnames to router address)?

If anyone could provide any info or confirm what I am saying that would be great.

Additional Info:
Router Model: MI424WR-GEN3I Found 'DNS Server' functionality that allows me to enter hostname + ip address combinations but it does not seem this is being used for resolution when i ping from a machine inside the network.

The router connects to a Watchguard XTM515 Firewall which has a DNS Server of setup in its DNS Servers list.

  • 3
    Look for NAT loopback functionality within the router if applicable and test with it. Otherwise, yes, point the record DNS to the internal IP address of your server. – Pimp Juice IT Oct 2 '17 at 21:33
  • Thank you - I will do that. I did find a 'DNS Server' entry. in which I seem to be able to add host name / ip address entries within the router but when pinging they do not seem to resolve. The router model is MI424WR-GEN3I – Scott Moniz Oct 2 '17 at 22:38
  • No NAT Loopback functionality as far as I can see. I think the resolution has to do with the computer not using the router's dns tables. If i do an ipconfig /all should i see as one of the DNS entries? – Scott Moniz Oct 2 '17 at 23:19
  • 1
    Can you do NAT loopback with Watchguard? You should be able to and point it accordingly from there. watchguard.com/help/docs/fireware/11/en-US/Content/en-US/nat/… – Pimp Juice IT Oct 2 '17 at 23:35
  • 1
    Nat loopback with watchguard seems very promising. We are running an older firmware version that made the docs hard to follow. We contacted Watchguard and they provided us directions on upgrading the firmware. We will be exploring NAT loopback in the Watchguard. Wish i could upvote you but I am new to superuser. Thanks Facebook! – Scott Moniz Oct 4 '17 at 17:42

Your router seems to be lacking NAT Hairpinning (also known as NAT Loopback or NAT Reflection). Similar features are also sometimes called Reverse NAT.

As @facebook rightly points out, this feature is sometimes simply disabled in a device. The quickest and easiest solution is to enable it (if possible), so you may wish to check your router settings before taking any additional steps.

I am assuming we need an internal DNS server to resolve?

Setting up an internal DNS server could potentially resolve this issue, yes.

Assuming this is the case and we set up [an internal DNS server] - when a request originates inside the network - what is the resolution?

Essentially, the computer asking for mysite.com needs to contact your internal DNS server before routing it to any additional sources (likely via forwarding). Your internal DNS server would simply have a local entry for mysite.com pointing to your local web server(s) (via internal IPs).

If you need DNS server software, ISC BIND is a good choice. It is robust and comes available for both Windows and Linux.

  • Yes, I do not see any NAT hairpinning or NAT loopback in the router specs. There is a DNS table in the router which has: Hostname, IP and I tried entering my hostname / internal ip there. e.g. dev.mysite.com but no luck. Running ipconfig /all I only see listed under DNS servers. I tried to put in the firewall, but it doesnt seem that worked. It seems my computer does not want to use the DNS in the router? – Scott Moniz Oct 2 '17 at 23:32
  • I found a bit of conflicting information regarding support for this feature in the router you have (apparently there are multiple revisions using the same basic name). That said, I found one credible site which suggests "bypassing" your router with a second (one that supports NAT loopback). It seems they were suggesting to possibly use the your device in some variation of bridge mode (where it only handles data, not routing). They indicated NAT loopback for your base model of Actiontec router doesn't always work well/consistently. – Anaksunaman Oct 2 '17 at 23:55
  • 1
    Thanks for the info Anaksunaman - Thats unfortunate to hear. Perhaps I can setup the loopback in the watchguard firewall as someone else suggested. Finding it hard to follow as the documentation and my UI seem to be slightly different possibly due to versions. – Scott Moniz Oct 3 '17 at 0:08
  • 1
    Confirmed by Watchguard - we were using an old version of the UI that did not have the options shown in their documentation. We will be thinking about upgrading at some point – Scott Moniz Oct 17 '17 at 18:08
  • 1
    Youre welcome - thanks for your invaluable help. – Scott Moniz Oct 17 '17 at 22:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.