7

Ok my title is a little bit convoluted. Allow me to explain.

I have a server in my LAN that listens for HTTP connections at let's say 192.168.1.10:1234. I can access this address from my other computers and everything works as expected.

Now to access this server from the Internet I have forwarded the port 5678 to the port 1234. If I go to a PC outside my house and enter 62.62.62.62:5678 (my ISP address with the forwarded port) in the web browser, I am able to access my server.

If I do the same exactly thing from within my LAN I get a timeout error.

What is wrong here?

(I am newbie in networking so please forgive my ignorance.)

Improve this question
2
  • 2
    Twisty already answered, but if you want more information google on 'hairpin NAT'.
    – Hennes
    Dec 30, 2017 at 17:34
  • I think this older question and the answers may be useful reading for your case as well: superuser.com/q/1176489/326546
    – kasperd
    Dec 31, 2017 at 0:34

2 Answers 2

Reset to default
11

It is possible to access your internal server using the router's public IP address/forwarded port, but your router must support loopback network address translation (a.k.a. hairpin NAT) and be configured accordingly.

Without loopback translation in effect, IP packets destined for your router's public IP address will arrive on its private network interface. Here the packets are simply dropped, usually because the router requires packets destined for its public IP address to arrive on its physical WAN interface (there are other possible ways this traffic may be handled, including NAT occurring, but the end result is always that the connection cannot be completed).

However, with loopback translation configured, when the packets destined for the public address arrive on the private interface, their destination address will be rewritten to be that of the internal server. Then the normal port translation will be applied, further resulting in the destination port being rewritten as well.

Improve this answer
0
0

Twisty already answered your question as it stands, but as a pointer to what you can do about it; in a similar situation for my LAN I configured the on-lan DNS server (built into the router, or a windows SBS machine I can't remember which, not authoritative for my domain name; only answers requests from LAN clients because they're configured to try it first - indeed some LAN machines even just have a hosts file entry alluding to the same) to report downloadsite.mydomain.com as 192.168.1.10, but the actual external authoritative DNS reports downloadsite.mydomain.com as 62.62.72.62

This way someone on the lan can form and test the link downloadsite.mydomain.com/somefile.txt and give it to an external third party, confident that it'll work out

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.