When I enable NAT hairpinning, will accessing LAN devices through the public IP go through the public network?

After enabling NAT hairpinning and establishing a TCP connection, if the public IP changes, the TCP connection will not be disconnected. Does this mean that the data only passes through the router and not the gateway? How can I ensure that the data passes through the gateway, and that the TCP connection is properly terminated when my public IP changes?

  • 1
    Hairpinning wastes both inbound and outbound bandwidth on the LAN interface, and it wastes router resources to do NAT. Keep the LAN traffic on the LAN. Use your local DNS to resolve to local addresses.
    – Ron Maupin
    Commented Feb 20 at 13:27

1 Answer 1


When I enable NAT hairpinning, will accessing LAN devices through the public IP go through the public network?

No. NAT hairpinning doesn't change the route packets take. It only enables private LAN devices to use the NAT router's public IP address with according destination NAT to reach publicly exposed servers with a private IP address.

NAT hairpinning is not a good thing because it uses unnecessary address translations and inefficient routing. A much better solution is to use split-brain DNS and talk to the private address of the server directly.

  • If I want to disable NAT hairpinning, what should I do? I noticed that this is a router behavior, and if I only do port forwarding on the firewall, I will encounter port loopback issues. I want it to go through the public network. If you know, please let me know. I would greatly appreciate it.
    – ishunsei
    Commented Feb 20 at 7:20
  • I want it to go through the public network - that's not how routing works. Why would you want that?
    – Zac67
    Commented Feb 20 at 7:24
  • I will connect myself through a public network, and when my public IP address changes, I can respond immediately because I will use TCP to establish a connection with myself. If it doesn't go through a public network, I won't be able to respond when my public IP address changes.
    – ishunsei
    Commented Feb 20 at 7:28
  • I'm not at all sure whether that's a reliable method. Rather you should configure your router to send an SNMP trap on reconnection and poll your public IP every once in a while, just in case.
    – Zac67
    Commented Feb 20 at 7:33
  • Okay, thank you for your answer. Polling is my alternative solution because polling responses are not as immediate. I cannot make too frequent requests to third parties to obtain the public IP, and configuring SNMP trap is a bit challenging for me.
    – ishunsei
    Commented Feb 20 at 7:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.