160 lines
4.0 KiB
Markdown
160 lines
4.0 KiB
Markdown
# Hairpin NAT Issue - Internal Access to Public IP
|
|
|
|
**Date**: 2026-01-21
|
|
**Issue**: Connection timeout when accessing public IP (76.53.10.36) from internal network (192.168.11.4)
|
|
|
|
---
|
|
|
|
## Problem
|
|
|
|
Testing from internal network (192.168.11.4) to public IP (76.53.10.36) results in timeout:
|
|
- `curl https://explorer.d-bis.org` → Timeout
|
|
- `curl http://76.53.10.36` → Timeout
|
|
|
|
**This is a "Hairpin NAT" or "NAT Loopback" issue.**
|
|
|
|
---
|
|
|
|
## What is Hairpin NAT?
|
|
|
|
Hairpin NAT allows internal devices to access services using the public IP address. Without it:
|
|
- ✅ External access works (internet → public IP → internal)
|
|
- ❌ Internal access to public IP fails (internal → public IP → internal)
|
|
|
|
---
|
|
|
|
## Current Situation
|
|
|
|
### Testing from Internal Network (192.168.11.4)
|
|
- ❌ `curl http://76.53.10.36` → Timeout
|
|
- ❌ `curl https://explorer.d-bis.org` → Timeout
|
|
|
|
### Expected Behavior
|
|
- ✅ External access should work (from internet)
|
|
- ⚠️ Internal access to public IP may not work (hairpin NAT)
|
|
|
|
---
|
|
|
|
## Solutions
|
|
|
|
### Option 1: Use Internal IP Directly (Recommended for Internal Testing)
|
|
|
|
Instead of using the public IP from internal network, use the internal IP:
|
|
|
|
```bash
|
|
# Use internal IP directly
|
|
curl http://192.168.11.166 -H "Host: explorer.d-bis.org"
|
|
curl https://192.168.11.166 -H "Host: explorer.d-bis.org" -k
|
|
|
|
# Or use the domain with internal DNS
|
|
# (if internal DNS points to 192.168.11.166)
|
|
curl http://explorer.d-bis.org
|
|
```
|
|
|
|
### Option 2: Enable Hairpin NAT in UDM Pro
|
|
|
|
UDM Pro may need hairpin NAT enabled:
|
|
|
|
1. **Check UDM Pro Settings**
|
|
- Look for "Hairpin NAT" or "NAT Loopback" option
|
|
- Enable if available
|
|
|
|
2. **Or Add NAT Reflection Rule**
|
|
- Some routers need explicit NAT reflection rules
|
|
- May require advanced configuration
|
|
|
|
### Option 3: Test from External Network
|
|
|
|
The real test is external access:
|
|
|
|
```bash
|
|
# Test from external network (not 192.168.11.x)
|
|
# Use mobile hotspot, VPN, or different network
|
|
curl -v http://explorer.d-bis.org
|
|
curl -v https://explorer.d-bis.org
|
|
```
|
|
|
|
---
|
|
|
|
## Verification Steps
|
|
|
|
### 1. Check if Port Forwarding Rules Are Active
|
|
|
|
```bash
|
|
ssh OQmQuS@192.168.11.1
|
|
sudo iptables -t nat -L PREROUTING -n -v | grep "76.53.10.36"
|
|
```
|
|
|
|
**Should show:**
|
|
```
|
|
DNAT tcp -- 0.0.0.0/0 76.53.10.36 tcp dpt:80 to:192.168.11.166:80
|
|
DNAT tcp -- 0.0.0.0/0 76.53.10.36 tcp dpt:443 to:192.168.11.166:443
|
|
```
|
|
|
|
### 2. Test Internal Access to NPMplus Directly
|
|
|
|
```bash
|
|
# From internal network (192.168.11.4)
|
|
curl -v http://192.168.11.166 -H "Host: explorer.d-bis.org"
|
|
curl -v https://192.168.11.166 -H "Host: explorer.d-bis.org" -k
|
|
```
|
|
|
|
**If this works**: NPMplus is working, issue is hairpin NAT
|
|
|
|
### 3. Test External Access
|
|
|
|
**This is the real test** - from outside the network:
|
|
- Use mobile hotspot
|
|
- Use VPN
|
|
- Use different network
|
|
- Ask someone external to test
|
|
|
|
```bash
|
|
curl -v http://explorer.d-bis.org
|
|
curl -v https://explorer.d-bis.org
|
|
```
|
|
|
|
---
|
|
|
|
## Current Status
|
|
|
|
Based on your test output:
|
|
- ❌ Internal access to public IP: **NOT WORKING** (hairpin NAT issue)
|
|
- ❓ External access: **UNKNOWN** (needs testing from external network)
|
|
- ✅ Internal access to NPMplus directly: **SHOULD WORK** (needs verification)
|
|
|
|
---
|
|
|
|
## Next Steps
|
|
|
|
1. **Verify Port Forwarding Rules Are Active**
|
|
- Check NAT table via SSH
|
|
- Ensure rules are not paused
|
|
|
|
2. **Test Internal Access to NPMplus Directly**
|
|
```bash
|
|
curl -v http://192.168.11.166 -H "Host: explorer.d-bis.org"
|
|
```
|
|
|
|
3. **Test External Access** (Most Important)
|
|
- Test from external network
|
|
- This is the real test for public access
|
|
|
|
4. **If External Access Works**
|
|
- ✅ Problem solved!
|
|
- Internal access to public IP is a separate issue (hairpin NAT)
|
|
|
|
---
|
|
|
|
## Summary
|
|
|
|
**Internal access to public IP timing out is expected if hairpin NAT is not enabled.**
|
|
|
|
**The real test is external access from the internet.**
|
|
|
|
If external access works, the explorer is functional - internal access to public IP is a separate configuration issue.
|
|
|
|
---
|
|
|
|
**Status**: ⚠️ **TEST EXTERNAL ACCESS - Internal timeout may be expected**
|