I have a domain and a WWW server within my network. I have one public address and running NAT on a router. Server is naturally port-forwarded. Let's say my domain is kitet.com so when anyone on the internet types kitet.com in a browser's address bar, a page from my server is shown. I need to configure my network in sucha way, so that when I am connected to it (from inside) I can also operate using my internet name (I am using some more services, WWW example chosen for simplicity).

Right now I can't connect to my site at all when I type my domain name in the browser, while being inside. I can connect from outside w/o problems.

I want to do this because I'm working mainly on my laptop, which is being moved between places, inside or outside my organization, and I require an SSL certificate that won't verify when i type e.g., when inside my network. This is also for my employees and guests that won't be able to visit my site ONLY while within my network...

So there is summary of what i want and tried to do:

  • My site kitet.com should work wherever I am, as kitet.com, not only local address
  • No entries inside "hosts" file (or any other file on personal computers, devices and so on) should be necessary to make it work
  • I already tried a linux router with kernel 2.2, where I added a PREROUTING entry, well, that worked, but I feel like all the traffic, that should go from e.g. my laptop to server is going through that router at all times, thereby generating unnecessary traffic on it. I dropped that approach.
  • I could run a DNS on my Win 2012 server, only I don't know how to configure forward lookups to map my domain address to a computer within my network. I feel like this is my last option here, please advise how do I configure it.


Imagine I'm in a train, or at a client's, accessing my kitet.com on port 443 to update my page, which is located on one machine, at the same time reading mail while connecting to the same kitet.com on port 110 which is in my LAN on another machine, at the same time demonstrating my projects on Team Server, which is - you guessed it - on yet another machine. I'm returning home and I STILL want to access kitet.com, without reconfiguring my mail program, to access servers at some or a local name, without telling Visual Studio that TFS is now at some or a different local name.

That's it, hope I made myself clear this time.


You could add a subnetwork to your internal network like so:

enter image description here

You could achieve the same thing with one router/server with multiple network cards to create a DMZ or at least two different subnets.

WARNING: this should only be done when you cannot introduce subdomains into the system

  • Not bad, I'll give you +1 for now, for all your efforts, until I set this monster up. – Kitet May 5 '13 at 19:45
  • Ok, so that would work in theory, but in the end I've chosen to just buy another ssl cert. Why I did that is out of the scope of this question, so I'm accepting the answer. – Kitet May 12 '13 at 14:23
  • Yeah, that would be the more sensible thing to do :) Good luck! – XyZZy May 12 '13 at 14:27

Option 1: Add a DNS entry to your existing router, this will point the domain to the correct IP address without routing all traffic through the router.

Option 2: Run an internal DNS server which will point your domain to the correct server when you're inside your network.

Install the DNS function of your Win 2012 server and define a new forward lookup zone. Here's how to define the forward lookup: http://www.youtube.com/watch?v=PZMD8wwvukE

Then make sure the people inside your network are using that DNS server and you're done!!

Since it already works from the outside, there's no more work to be done there either!

  • Thanks for your answer, however Option 1 won't work in case I have multiple servers (e.g. one for mail, one for www, one for TFS), which I have. Option 2 doesn't work at all at this time. Video shows a server having DS installed, mine doesn't have. Just installed DNS role and everything is empty, server doesn't even know it is within domain kitet.com. Simply adding forward lookup zone does nothing good. I think there's a need to configure DNS from ground-up. But knowing that DNS approach is possible within a NAT-ed network, I will continue looking thins up on the internet. – Kitet May 5 '13 at 14:31
  • Why won't option one work with multiple servers? You should try using a third party DNS-server for option 2. – XyZZy May 5 '13 at 14:47
  • Option 1 will not work for multiple servers behind a NAT, because I have only one WAN domain, no subdomains. Now that I think of it, Nothing will work with multiple servers. By the way why suddenly Windows Server 2012 DNS is no good? – Kitet May 5 '13 at 18:10
  • Maybe the windows server can still work, but i don't understand the problem you're having with it. A third party DNS-server might be simpler. The simplest is still option 1, it does not matter which domain names you have on the WAN side, this is LAN side. – XyZZy May 5 '13 at 18:17
  • I WANT it to work like it was WAN, re-read the question, I added case study. While exchanging comments with you, I solved first part, added a line to DNS on a router. This points kitet.com to one machine, web server. Would be nice if i could also point mail, TFS and other programs to their respective machines. See no way at this time. – Kitet May 5 '13 at 18:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.