NAT Inside to Inside

Posted on 2009-06-28
Medium Priority
Last Modified: 2012-05-07
I have an internal network, with an internal mail server.

When I do an DNS lookup for my mail server, it goes to

203.xxx.xxx.xx which is a public address.

The router is set up to do a port forward back to the internal address if it's an external address.

However, the traffic doesn't seem to reach the mail server when the client is internal.

How do I setup the CISCO 877 router to

1. Do NAT from Inside to outside, then outside to Inside. Meaning a internal client trying to access an internal server with an external address.

I don't want to manage an internal DNS server just for this.

Question by:binele
LVL 79

Expert Comment

ID: 24733249
Your best bet is an internal web server, or even host files if internal clients are few and are desktops. The problem is with the order of packet processing and NAT and this "hairpin" feature is not supported in IOS.

If the client resolves to the public ip address, and receives a packet from the private address of the server, the client drops the packet.
We can fix this with a feature of ASA firewall called 'dns doctoring' which actually intercepts the dns request that comes back from the external dns server and replaces the public ip with the private ip, so as far as the client is concerned, it resolved to the internal IP. No such luck or feature on IOS router.

Accepted Solution

nasirsh earned 2000 total points
ID: 24734350
Why do you want your internal Clients to access your mail server via outside. You can give them access to it via its internal IP. If you want to give them the external access then you have to fo outside-inside NAT and vice versa to your mailserver and make sure that your mailserver has the default gateway of the routers internal Interface.

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Unable to change the program that handles the scan event from a network attached Canon/Brother printer/scanner. This means you'll always have to choose which program handles this action, e.g. ControlCenter4 (in the case of a Brother).
LinkedIn blogging is great for networking, building up an audience, and expanding your influence as well. However, if you want to achieve these results, you need to work really hard to make your post worth liking and sharing. Here are 4 tips that ca…
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

622 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question