I have a weird port forwarding problem. I tried to open my port 22 to the outside network. I was able to access it as long as I am not inside the LAN. I can access it from my office for example. But from within the LAN, I can access the port using the local ip, but I can't access the port using the external IP. It's as if the router is blocking the loopback. I've check all my router settings, turned off anything firewall/filtering related. Any ideas?


Assuming Spiff is correct, and your router can't handle port forwarding to the external ip from within the network there is a small work around (and it does sound like this is the case);

You can edit the hosts file, which can be found at /etc/hosts in most unix-systems and in C:\Windows\system32\drivers\etc\ on Windows.

if you add  example.com

in that file, your computer will go to the ip spesified whenever you try to access example.com. You will of course have to do this on every computer that you wish to use within the network.

You can check the wikipedia article for more details on where to find it: https://en.wikipedia.org/wiki/Hosts_file


Given that you mentioned port forwarding, I assume your home gateway is acting as a NAT -- or more specifically NAPT -- gateway. What you're trying to do is called "hairpin NAT" or "NAT hairpinning", in reference to the way a literal hair pin doubles back on itself (the same allusion is used by the term "hairpin turn" for a sharp bend where a road doubles back on itself).

Some NAT gateways are crap and don't support hairpinning. It may be time to explore your upgrade options.

  • This is a pretty new router so I doubt that's the problem.
    – erotsppa
    Apr 28 '10 at 2:11
  • 6
    "New" doesn't mean "high quality". There's always plenty of crap on the market at any given time.
    – Spiff
    Apr 28 '10 at 3:30
  • And that comment holds true eight years later! Jun 20 '18 at 15:13
  • @erotsppa - As Tim_Stewart says, "holds true 8 years later" (2018)... it's all down to cost and what's required to implement the solution vs the demand for such a solution. Your typical "home" modem/router has no need for such functionality... a business, however, will have very different requirements (staff working on and off-site, for example, shouldn't have to change settings to get their, say, email (if they use an on-prem mail-server) working when they work in the office and when they work off-site etc. Business-grade devices are often higher performing and have these capabilities.
    – Kinnectus
    Jun 21 '18 at 10:30

There is a real simple answer to this one. The NAT is getting in the way.

  1. Your computer opens a connection to [ExternalIP]
  2. Your Router forwards that connection to [SSHInternalIP]. Your SSH server sees a connection from [YourInternalIP].
  3. Your SSH server sends its packets to [YourInternalIP].
  4. Your computer sees a strange packet coming from an IP it never talked to and discards it.
  5. Your connection to TCP/22 fails because the TCP 3-way handshake never completes.

You're trying to talk to a Public IP, but the replies are coming from an internal IP. Your computer can't make the two work together. The solution is to use the Internal IP whenever you're behind the router. I work around this problem on my laptops by using different ssh connection strings depending on where I am.


From what I understand from running an OpenBSD router with NAT, Spiff is correct in his response: the problem you are experiencing is caused by the NAT gateway not supporting what you're trying to do.

Your workstation is sending packets with a source IP of an internal address (say,, but the destination address is your exernal IP. When the packets arrive at your (SSH?) server on port 22, the server replies to your workstation directly and there's no NAT happening; now, when your workstation gets a reply from when it was expecting a reply from your external address, it drops the packets.

It seems like a trivial issue at hand, but it can be resolved by updating your workstation's HOSTS file, adding an internal DNS server (or editing the DNS server's entries), or creating a NAT rule to handle the internal->external->internal traffic.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.