I have a Cisco router configured NAT (4 static NAT and dynamic NAT). My problem is that I can't access internal servers using public IP addresses from the internal network.

I know what the problem is. I did a lot of Google searching about this problem, and I learned that most firewall/routers automatically handle this situation.

In case of Cisco, NAT hairpinning is the one of the solutions (I don't know if I am correct). How can i do that?.

enter image description here

i need to access the server using the IP address from my PC, but I can't.

  • Can you post a diagram and configuration of your router? There's not enough information to help you.
    – Ron Trunk
    Commented Dec 22, 2015 at 11:54
  • edited my question. hope this will help u Commented Dec 22, 2015 at 12:06
  • 1
    Unfortunately, you can't make the router do what you want. You can't use the outside address to get to the server in the configuration you have.
    – Ron Trunk
    Commented Dec 22, 2015 at 15:58
  • Do you need to actually use the IP address, or can you use the DNS name? You could modify your local DNS to return the local IP address instead of the public IP address.
    – Ron Maupin
    Commented Dec 22, 2015 at 16:37
  • 1
    Cisco "doesn't do that". There are some involved hacks to make it work, but you really don't want to go there. Basically, NAT applies to packets received on an interface; as internal traffic never passes through the "outside" interface, they never get translated. Under IOS, loopback interfaces and policy-routing can make it happen, but it's a config mess and processing nightmare.
    – Ricky
    Commented Dec 22, 2015 at 21:45

3 Answers 3


NVI NAT's already been brought up by Aaron D.

Here's a the relevant config bits of a working example. It's been done on a CISCO881 with IOS 15.4(3)M6a

Outside network: /24   on  FastEthernet4
Inside network: /23  on VLAN141/SVI141
exposed host:
external port:   2222
internal port:   22

Interface configuration:

interface FastEthernet4
 ip address
 ip nat enable

interface Vlan141
 ip address
 ! hairpinning did not work until ip redirects were disabled
 no ip redirects
 ip nat enable


ip access-list standard ACLv4_SUBNET141

NAT rules:

ip nat source static tcp 22 interface FastEthernet4 2222
ip nat source list ACLv4_SUBNET141 interface FastEthernet4 overload

In a nutshell:

  1. set the relevant interfaces to "ip nat enable" instead of "ip nat in/outside", and slightly modify the NAT rules.
  2. make sure that there is an NVI NAT style outbound policy, or the hairpinnable host won't be able to connect outbound or hairpin to itself.
  3. disable ip redirects on the "inside" interface, or hairpinning (at least not from the host itself) will not work.

Caution: NVI NAT can be VERY taxing on the CPU of low-end routers like the 800 series. Where my old 881 used to be able to deliver 50-60Mbit/s with classic NAT, switching over to NVI caused the throughput to drop to 20-30Mbit/s and would have the CPU glowing red when under load.

That was also the case when the to-be-hairpinned translation was not actually in use, just with traffic matching the normal "interface ... overload" outbound NAT rule.


On an ASA this is pretty easy. On a router, I think you can set up Nat/NVI to achieve what you want.

Try this: Cisco Router Easy Hairpin NAT


This is a case of port forwarding to the same network. For such DMZ's setups, hairpinning is preferred or having local DNS to resolve for such internal servers. Apart from them there is an equivalent solution for it.

The solution is to have DNAT rule for your LAN zone also so that the packet with destination ip from local client can be translated to and routed back to the same network by the router.

But again the problem is that the server will try to reply directly to the client since it belongs to the same network. Now to make the server reply the client via router we need to add an SNAT rule that would make the source as router.

Your SNAT rule should be very specific such that it applies only for traffic coming from local subnet and destined for This will solve your problem for sure.

To summarize you have to add a DNAT and an SNAT rule for LAN interface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.