Cisco NAT hairpinning

Question

I have a Cisco router configured NAT (4 static NAT and dynamic NAT). My problem is that I can't access internal servers using public IP addresses from the internal network.

I know what the problem is. I did a lot of Google searching about this problem, and I learned that most firewall/routers automatically handle this situation.

In case of Cisco, NAT hairpinning is the one of the solutions (I don't know if I am correct). How can i do that?.

i need to access the server using the IP address 202.192.68.235 from my PC, but I can't.

Answer 1

NVI NAT's already been brought up by Aaron D.

Here's a the relevant config bits of a working example. It's been done on a CISCO881 with IOS 15.4(3)M6a

Outside network: 172.19.31.0 /24   on  FastEthernet4
Inside network:  172.19.140.0 /23  on VLAN141/SVI141
exposed host:    172.19.141.24
external port:   2222
internal port:   22

Interface configuration:

interface FastEthernet4
 ip address 172.19.31.2 255.255.255.0
 ip nat enable

interface Vlan141
 ip address 172.19.140.1 255.255.254.0
 !
 ! hairpinning did not work until ip redirects were disabled
 !
 no ip redirects
 ip nat enable

NAT ACL:

ip access-list standard ACLv4_SUBNET141
 permit 172.19.140.0 0.0.1.255

NAT rules:

ip nat source static tcp 172.19.141.24 22 interface FastEthernet4 2222
ip nat source list ACLv4_SUBNET141 interface FastEthernet4 overload

In a nutshell:

1. set the relevant interfaces to "ip nat enable" instead of "ip nat in/outside", and slightly modify the NAT rules.
2. make sure that there is an NVI NAT style outbound policy, or the hairpinnable host won't be able to connect outbound or hairpin to itself.
3. disable ip redirects on the "inside" interface, or hairpinning (at least not from the host itself) will not work.

Caution: NVI NAT can be VERY taxing on the CPU of low-end routers like the 800 series. Where my old 881 used to be able to deliver 50-60Mbit/s with classic NAT, switching over to NVI caused the throughput to drop to 20-30Mbit/s and would have the CPU glowing red when under load.

That was also the case when the to-be-hairpinned translation was not actually in use, just with traffic matching the normal "interface ... overload" outbound NAT rule.

Answer 2

On an ASA this is pretty easy. On a router, I think you can set up Nat/NVI to achieve what you want.

Try this: Cisco Router Easy Hairpin NAT

Answer 3

This is a case of port forwarding to the same network. For such DMZ's setups, hairpinning is preferred or having local DNS to resolve for such internal servers. Apart from them there is an equivalent solution for it.

The solution is to have DNAT rule for your LAN zone also so that the packet with destination ip 202.192.68.235 from local client can be translated to 10.0.6.35 and routed back to the same network by the router.

But again the problem is that the server will try to reply directly to the client since it belongs to the same network. Now to make the server reply the client via router we need to add an SNAT rule that would make the source as router.

Your SNAT rule should be very specific such that it applies only for traffic coming from local subnet and destined for 10.0.6.35. This will solve your problem for sure.

To summarize you have to add a DNAT and an SNAT rule for LAN interface.