Public IP/domain unreachable from inside the LAN (NAT hairpin) Networking Origin: Network OSI layer 3 · Network Last updated 5 Nov 2026

Networking: Server reachable from the internet but not from inside the LAN via its public IP — NAT loopback / hairpin NAT not working

Devices on your own network can't use the router's public address to reach a server that is also on that network.

Exact message you may see NAT loopbackNAT reflection not workingworks from outside but not from inside the networkcan't access my server using its public IP from LAN
Explore the map of this error Full error map →
Seen on: Networking Linux

Meaning

The router doesn't support NAT reflection (hairpin NAT), or replies bypass it. Use split DNS (internal name → private IP), enable NAT loopback/reflection on the router, or add a hairpin SNAT rule. Testing from your phone on mobile data tells you whether external access works at all.

Common causes

  • Router lacks NAT loopback/hairpin
  • DNS returns the public IP inside the LAN
  • Asymmetric reply path from the server
  • Firewall rule only for the WAN interface
  • Port forward configured for the wrong interface

⚡ Quick fix

  1. Use split-horizon DNS for the internal name
  2. Enable NAT reflection on the router
  3. Or add a hairpin SNAT/masquerade rule

Detailed fix by platform

Linux

  1. sudo iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 192.168.1.50 -p tcp --dport 443 -j MASQUERADE

How to diagnose

  1. Internet access — Works?
  2. LAN via public IP — Fails?
  3. DNS — Internal override?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

arp -a shows (incomplete) — Networking: `arp -n` shows (incomplete) / Destination Host Unreachable — no ARP reply from the next hop (Networking)arp -a shows (incompl…Domain still resolves to the old IP (DNS propagation/cache) — Networking: DNS changed but the domain still resolves to the old IP — TTL and resolver caching ("propagation") (Networking)Domain still resolves…Idle connections silently dropped by firewall/NAT — Networking: Connection works, then fails after being idle — firewall/NAT idle timeout dropped the TCP session (use keepalive) (Networking)Idle connections sile…Internal hostnames fail on VPN (split DNS / systemd-resolved) — Networking: VPN connected but internal names like db.corp.local don't resolve — split DNS / 127.0.0.53 stub resolver not using the VPN DNS (Networking)Internal hostnames fa…NAT gateway SNAT port exhaustion (ErrorPortAllocation) — Networking: NAT gateway ErrorPortAllocation / SNAT port exhaustion — intermittent outbound connection timeouts (Networking)NAT gateway SNAT port…Port forwarding not working (CGNAT / double NAT) — Networking: Port forwarding configured but the port stays closed — carrier-grade NAT (CGNAT) or double NAT (Networking)Port forwarding not w…Windows: Default gateway is not available — Networking: Windows: Default gateway is not available / Diagnose Connection Problems: DHCP not enabled (Networking)Windows: Default gate…Public IP…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.