Member Avatar for hamidrezaa

Dear Experts,
we have a 2851 router which interconnect our local network to public network. we recieve our internet on interface e0/1 and e0/0 restricted to our lan as below configs
int e0/0
ip nat inside

int e0/1 X.X.X.226
ip nat outside
! web server
ip nat inside source static x.x.x.245


! last resort
ip route x.x.x.225

our users from internet can access our web server
but we cant access our web server with public address x.x.x.245 or
equivalent domain name and we can only access it with local address in our lan.
how can we access our web server with public FDQN domain name or public ip address ?

Regards
Harry

  • 5 Contributors
  • 7 Replies
  • 339 Views
  • 2 Weeks Discussion Span
  • Latest Post Latest Post by FullDuplex

Dani AI

Generated

This is the classic NAT “hairpin” / NAT reflection situation: external clients hit the router’s WAN IP and are translated to the internal web host, but LAN-originated connections to the same public IP aren’t being reflected back into the LAN. As described, that feature is often called loopback (hairpin) NAT; as noted, not every platform does it by default; and ’s split‑horizon DNS idea is the most reliable workaround in many environments.

Useful quick checks:

  • From a LAN machine, confirm name resolution with nslookup/dig (does the FQDN resolve to the public address?).
  • From the same LAN machine, try a raw connect (curl -v http://<public-ip> or telnet <public-ip> 80) while running a packet capture on the web server (tcpdump/Wireshark) to see whether packets arrive.
  • On the router, verify which interfaces are marked inside vs outside and whether NAT rules are applied to traffic sourced from the LAN; check the NAT translation table while a test connection is ongoing.
  • Note the OP’s environment change (ATM -> G0/1): when interfaces change, NAT/inside‑outside tagging or ACLs can be lost—confirm the NAT policy followed the interface change.

Fix options (pros/cons):

  • Split‑horizon (internal DNS returns the server’s private IP for the public FQDN) — simplest and clean for browsers/SSL. This is ’s approach and avoids router hacks.
  • Enable NAT hairpin/reflection on the router if supported — keeps a single DNS view but may require a specific IOS feature/policy NAT or firmware change. ’s vendor check advice applies here.
  • Temporary workarounds: host‑file entries, an internal reverse proxy, or port forwarding on a local VM.

Caveats: ensure firewall/ACLs and the server’s gateway are correct so reflected connections can return. Split‑horizon DNS is the least intrusive long‑term fix when router features are limited.

Recommended Answers

All 7 Replies

Member Avatar for JorgeM

This is a typical NAT problem with many types of routers. Not all of them will allow accessing the public ip from within the LAN. Contact the vendor for support.

Member Avatar for hamidrezaa

Two months ago we receive our internet from ATM controller and we can access it
but now with G0/1 interface we cant receive.

Member Avatar for hamidrezaa

This is a typical NAT problem with many types of routers. Not all of them will allow accessing the public ip from within the LAN. Contact the vendor for support.

How can i do this?

Member Avatar for JorgeM

If you are unable to resolve this by accessing the public IP from within the LAN, can you just access it via the private IP until you resolve this with your hardware vendor.

Member Avatar for getnit

You need something called a loop back NAT when you want to access your internal server through public ip.....
This is because here you hit the gateway and get back your network since the server is hosted in your network...Try to find out if there is a way to create a NAT policy on your router...so that when you try to access this server with a public ip it is NAT to the private ip of the server...

Member Avatar for FullDuplex

In regards to "we can only access it with local address 192.168.10.9 in our lan. how can we access our web server with public FDQN domain name or public ip address" if that still holds true. I have seen this issue when I.T. makes thier domain a .com instead of a .local. Anyhow if you have internal DNS server which most companies have, and is mandatory for domains, I would add this domain to DNS create a mirror image of all external DNS records except for the DNS record for the Host A for the website. I would point the Host A for SomeSite.com to my LAN IP.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.