2

I'd like to understand why trying to connect to a server in the same network, using the public IP address (provided by the router/NAT), and the port doesn't' work. (I'll assume two interfaces in the router/NAT, one connected to the internet, and the other connected to the private network. I will also assume I'm using TCP.)

You can see the diagram here:

enter image description here

I have a NAT table which allows connections to my internal 192.168.1.4:80 host, which is running an http server.

IP internal  |  Port internal |  IP external  Port external |  Port nat 
192.168.1.4         80                *            *             80

If I connect from host B with ip 8.8.8.9 and port 55231, this entry would be added:

192.168.1.4         80             8.8.8.9       55231           80

And everything would work correctly. The 'loopback problem' comes when trying to connect to (80.53.56.67,80) from an internal host, such as host A 192.168.1.4 with port 60000. The datagram sent by this host would look like this:

IPsrc:192.168.1.4, IPdst:IPnat, Proto:TCP|| PortSrc: 50243, PortDst: 80

So, a new entry would be added to the NAT table:

192.168.1.4       50243        IPnat       80       60000

The datagram replies of the server would look like this:

IPsrc:192.168.1.4, IPdst:IPnat, Proto:TCP||PortSrc: 80, PortDst: 60000

I don't see the problem here; in my opinion it should work correctly. I can't see why this wouldn't work. Is it the order in which the NAT-routing is done?

Improve this question

1 Answer 1

Reset to default
0

I think I understand your question now. You are asking about hairpin routing. Some routers support this, but some don't.

The routers which support this specifically look for traffic which should hairpin. The routers which don't support this do normal routing, and they send traffic destined for external addresses out the WAN interface, per the routing table.

This is completely dependent on the router make, model, and software version.

What happens on the routers which don't support this is that the traffic from the inside host to the external server address has the destination address looked up in the routing table, and that points to the WAN interface, so the the traffic is sent to the WAN interface, which is an outside interface, so the inside source address gets translated, per the inside source NAT rules, to an outside address (usually the WAN interface address), and the traffic is sent out the WAN interface. This is all based on normal routing rules.

The traffic will travel to the ISP router, which will promptly drop it since it is coming in from an interface where the destination address is. Routers drop traffic destined for the network from which it originates.

Improve this answer
4
  • Thanks for the reply. That's the datagram of the connection from the same host. So my internal host would connect to the IPnat:80 server, which happens to be in my same host. It's supposed to be a 2-way nat.
    – lpares12
    Mar 23, 2016 at 18:53
  • @deuseux12, you are very confusing. First you write, "external host," The you write, in the next sentence, "the same host." That leads one to believe you mean the same external host. You need to edit your question to clarify things, and a diagram would help a lot.
    – Ron Maupin ♦
    Mar 23, 2016 at 19:10
  • I edited the question to make it easier to understand and added a diagram. Thanks for your time.
    – lpares12
    Mar 23, 2016 at 20:04
  • When the datagram from the client arrives to the NAT. It would look like this: IPsrc:192.168.1.4, IPdst:80.53.56.7, Proto:TCP|| PortSrc: 50243, PortDst: 80, the Router would trigger this routing entry if 80.53.56/24 -> eth1 and then it would do the NAT IPsrc:80.53.56.7, IPdst:80.53.56.7, Proto:TCP|| PortSrc: 50243, PortDst: 80 and send the packet to the network. The router is not able to take the packet again, right?
    – lpares12
    Mar 24, 2016 at 8:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.