2

We have a webserver on our LAN. Externally, we can use the public domainname (let's say business.com) to access the website. Internally, we need to use the local IP. We also want to use the public domainname internally.

When we use the public domainname, it points to the public IP, and cannot access it.

Here are some (what I think) related config lines in the cisco router.

     interface Vlan10
     ip address 192.9.200.253 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
     ip tcp adjust-mss 1412
    !
    interface Vlan20
     ip address *external ip 1* 255.255.255.248
     ip nat outside
     ip virtual-reassembly in



ip domain name business.com
    ip host www.business.com. *external ip 1*
    ip name-server 8.8.8.8
    ip name-server 195.238.2.21
    ip name-server 4.4.4.4
    ip name-server 195.238.2.22


    ip dns server
    ip nat inside source list nat-list interface Vlan20 overload
    ip nat inside source static tcp 192.9.200.175 80 *external ip 1* 80 extendable

    ip route 0.0.0.0 0.0.0.0 *external ip 0*
    !
    ip access-list extended nat-list
     deny   ip 192.9.200.0 0.0.0.255 host 192.9.200.90
     deny   ip 192.9.200.0 0.0.0.255 host 192.9.200.94
     permit tcp any any
     permit udp any any
     permit icmp any any
     deny   ip 192.9.200.0 0.0.0.255 host 192.9.200.175

Some extra info:

VLAN10 = LAN side, VLAN20 = WAN side.

192.9.200.253 = router IP

192.9.200.175 = webserver IP

I've tried changing

ip domain name cisco.business.com
        ip host www.business.com. *external ip 1*

To

ip domain name business.com
        ip host www.business.com. 192.9.200.175

But that didn't fix the issue.

If there is any more info needed, let me know.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 9:58
3

Depending on the firewall type, hairpinning can get pretty messy. If your LAN client try to access the public IP address (which actually is your router's, not your server's), their sessions are bound for the Internet - they're source NATed by the router, then turned sharply around ("hairpin" curve) by the destination NAT rule aka port forwarding, and connected back inwards.

Usually, that two-stage NAT requires forwarding by the router's CPU instead of its hardware, so it's costly in regard of router resources, and it's slow. Because of that, hairpinning often requires explicit activation and is generally not recommended. Many devices don't even support it at all.

A much cleaner solution is to use split-brain DNS - on the internal DNS server you simply resolve the server's name to the private LAN IP address. That way, local users connect to an internal server directly, without involving the firewall. Very often, this is much faster and much less costly.

You need to make sure that each client is getting the hostname resolved to the private IP address, ie. use the DNS server with the split-brain setup.

| improve this answer | |
  • This is exactly what I want and need. I thought by setting the host table like this: "ip host www.business.com. 192.9.200.175", that the cisco router would be smart enough to use that IP address instead of resolving it via the external DNS. When I google split-brain DNS, it's all about setting this up with dedicated DNS servers where you can configure zones... I'm not sure if this could be done with the Cisco router... – RobbeM Nov 8 '18 at 8:01
  • Are you sure you're using the Cisco as DNS server? Likely, the host record is just for the router which won't help. The clients need to resolve the internal IP. – Zac67 Nov 8 '18 at 8:51
  • Split-horizon DNS is the way to go – Ben Personick Nov 8 '18 at 19:29
1

Check once whether domain name is resolving if resolving intiàte traffic by hitting url in browser and check traffic on router whether traffic is. reaching router or not if reaching check for sh ip nat translations .

Ensure destination port is listening on server.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.