0

As the title suggests. I find it mind breaking to think how network architecture can differ to allow/not allow using public IP address to access a server within internal network from within the internal network.

  • 1
    Perhaps this will help: networkengineering.stackexchange.com/questions/34512/… – jonathanjo Feb 20 at 14:12
  • @jonathanjo ok thank you! Don’t know whether its the one true answer – lpydawa Feb 20 at 14:17
  • It's also possible with routes and alias addresses: server has private 10.0.0.1 and public 1.2.3.4 as a secondary address. Client has route 1.2.3.4/32 -> 10.0.0.1. Server might or might not require symmetric route, depends on OS. This is horrible, of course, but sometimes done. – jonathanjo Feb 20 at 14:22
  • It is usually because there is no internal DNS server to give a different answer to DNS resolution for internal users. There is a serious down side that it will unnecessarily use router and network resources, but some people do not understand what is really happening. – Ron Maupin Feb 20 at 14:24
  • @RonMaupin quite agree, it's much better to use inside/outside DNS. The infrastructure for that is kind of onerous though. – jonathanjo Feb 20 at 22:17
1

So lets assume you have a private network, which is connected via a NAT box to the public internet. On the nat box explicit rules (sometimes referred to as "port forwards") are configured to allow servers on the private network to be reached from the public network.

In this case whether or not the connection is successful comes down to the behavior of the NAT box.

Normally the NAT box modifies the source of outgoing connections* from the private network to the public network. Since explicit rules are configured it also modifies the destinations of incoming connections based on those rules. The NAT maintains a tracking table so that packets for a given connection are treated consistently.

Connections from a client behind a nat** to a public address used for incoming connections by the same NAT are something of a special case. The NAT must modify the destination, despite the fact that the connection came from the inside. Furthermore in most cases the NAT must also modify the source of the connection, despite the fact that the connection is not going to outside.

This is perfectly doable, but it often requires extra rules in the NAT engine, for example https://unix.stackexchange.com/questions/282086/how-does-nat-reflection-nat-loopback-work discusses the rules that are necessary to make "nat reflection" work in iptables NAT.

Whether allowing this is a good idea is also questionable. Traffic from internal hosts to the public IP will unnecessarily go through the NAT box, and logs on the server for such traffic will not show the true source of the traffic. For these reasons some network admins prefer not to allow such connections and instead to use "split DNS" to direct the traffic from internal hosts to the internal IP of the server.

* Connection here refers to a combination of packet metadata that can be used to match-up requests and responses. This is somewhat broader than the usual definition of connection.

** Sometimes machines on the same private network can be behind different NATs, especially if the private network is large, in this case the NATs would not have to do anything special.

| improve this answer | |
1

Routing to WAN with source NAT and immediately routing back with destination NAT is called NAT hairpinning.

Some NAT routers don't support NAT hairpinning at all, some can be configured to do it but suck at performance, and some do OK.

Generally, routing packets through a NAT construct that is completely unnecessary is a bad idea. Also, forcing traffic through a gateway that isn't really required is a general waste of resources and a potential bottleneck. Additionally, hairpinning hides a client's LAN address from a server and may be a security problem.

You should make sure that LAN clients access a LAN service using its LAN address. One easy way to achieve that is to use DNS names and to configure your local DNS server so that it resolves those services to their LAN address (split-brain DNS) instead of relying on DNS resolution from the public domain.

| improve this answer | |
  • Could you explain what is meant by a “NAT construct” and why hairpinning hides the local address?(I assume its because the server only sees the router’s public IP as the source) – lpydawa Feb 20 at 22:41
  • 1
    The NAT has to modify the source address because if it doesn't the response traffic will not pass through the NAT and hence the reverse translations will not be applied and hence the client will reject the response traffic. – Peter Green Feb 21 at 1:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.