On my OSX server there is a folder that is configured in the Server App to be accessible via WebDAV. This folder is used to sync OmniFocus. On my router, I have set up a dynamic dns. When I am outside my home network (physically away or when connected via a vpn), I can connect and sync fine via:

https://<server name from dyndns>/<username>/<path to WebDAV folder>

However, when I am in my home network, the connection to WebDAV does not work (other connections, AFP, f.ex, do work).

What could be some reasons why I can't connect to WebDAV from within my home network? What log files could give hints and where are they stored?

I am running OSX server 10.9.3. and server.app. Thanks for your help.

1 Answer 1


Your router (NAT gateway) is probably not doing Hairpin NAT correctly. Hairpin NAT is when the NAT must do both outbound and inbound NAT on the same packet. It's needed in your case because your WebDAV client is trying to connect to the external IP address of your NAT. So your NAT has to do outbound NAT on the packet to send it to that public IP address. But then it realizes that the public IP address is its own address, and it has a port forwarding entry for how to forward connection attempts to port 80 (or 443 or whatever), so it has to do inbound NAT on the same packet in order to properly forward it to your WebDAV server.

Some home gateways that do Hairpin NAT correctly on most ports will choke on port 80 because they have their web-based administration UI running on that port. Sometimes you can get them to stop choking by either disabling web-based administration on the WAN interface, or by moving the web-based UI to a different port if it lets you configure that. But some don't let you change the port, and still choke even if you don't have web-based administration enabled on the WAN port.

Here are some other things to try:

  1. Look in your NAT gateway's UI or online help for a way to turn on Hairpin NAT if it's not on by default. If you rolled your own NAT gateway with, say, iptables on Linux, look online for tips on adding Hairpin NAT rules to your iptables config.
  2. Make sure you're on the latest firmware for your make/model/hardware-revision of your home gateway box, in case Hairpin NAT is something they've recently fixed.
  3. If none of the above work, consider either buying a better home gateway, or loading an aftermarket firmware distro such as DD-WRT onto your box.

I'm guessing you're not using an AirPort base station (Extreme/Express/Time Capsule) as your home gateway. In my experience, Apple consistently gets Hairpin NAT right on all of their gateways.

If your cable or DSL modem box is the same box that's acting as your NAT gateway, and you have access to an AirPort base station, consider disabling your modem box's NAT and DHCP server features making it just a transparent bridge. Then plug the WAN port of your AirPort Base Station into the LAN port of your modem box, and configure your AirPort base station to do NAT. You could do this with almost any Wi-Fi router, but I can't vouch for any others as to whether they do Hairpin NAT correctly.

  • Thanks Spiff -- I found this problem hard to debug: A) reproducibility: also on iPad, when in a VPN network, I can access my webDAV (this is my current solution) B) Are there any relevant log files for webDAV on OSX? C) I own an ASUS DSL-N55U-B, which is modem + router. I am following your line of thought quite well. I could not find a way to move the port for the web interface nor a seeting related to Hairpin NAT (side note: there are4 seeting related to WAN, that I don`t understand) D) What is a good modem + router for DSL in Germany that support some form of dyndns?
    – Claus
    Jun 12, 2014 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.