# Networking: Server reachable from the internet but not from inside the LAN via its public IP — NAT loopback / hairpin NAT not working

**Code:** `Public IP/domain unreachable from inside the LAN (NAT hairpin)` · **Category:** Networking · **Seen on:** Networking, Linux

Devices on your own network can't use the router's public address to reach a server that is also on that network.

## Meaning

The router doesn't support NAT reflection (hairpin NAT), or replies bypass it. Use split DNS (internal name → private IP), enable NAT loopback/reflection on the router, or add a hairpin SNAT rule. Testing from your phone on mobile data tells you whether external access works at all.

## Common causes

- Router lacks NAT loopback/hairpin
- DNS returns the public IP inside the LAN
- Asymmetric reply path from the server
- Firewall rule only for the WAN interface
- Port forward configured for the wrong interface

## Quick fix

1. Use split-horizon DNS for the internal name
2. Enable NAT reflection on the router
3. Or add a hairpin SNAT/masquerade rule

## Detailed fix by platform

### Linux

1. `sudo iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 192.168.1.50 -p tcp --dport 443 -j MASQUERADE`

## How to diagnose

1. **Internet access** — Works?
2. **LAN via public IP** — Fails?
3. **DNS** — Internal override?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/networking/nat-hairpin-loopback-fails)