NAT Problem

ineti

Hi guys,

i have the following problem; I enabled port forwarding from WAN TCP 443 to an internal server…Works like it should. I can access the internal host from outside via dyndns.
But i wanna access the dyndns account from inside without changing the dyndns name. So if someone from inside the LAN tries to access name.dyndns.org it should forward to the internal IP as well.
I tried different rules but nothing worked. Normal cheap router do this trick by default.
Any hints?
I have multiple subnets from 10.1.2.0 to 10.1.5.0; pfSense is in 10.1.5.0 and the web server that is forwarded to, also.

I'm using owncloud and don't wanna change the dns name if I'm inside the LAN.

johnpoz

Just setup your dns (is your pfsense your dns) to point name.dyndns.org to your internal IP = done!

Or just use nat reflection (not a fan of) – dns is the better way to do it if you ask me.

ineti

Thank you!

Nat reflection did the trick -> for any other users: system -> advanced -> NAT
Why should I use DNS? Is that any superior?

Thanks for the very fast reply.

johnpoz

Why should you use dns? Because not all routers support nat reflection, nat reflection at least on pfsense does not work UDP. Some protocols do not work through nat be it reflected or not. Why send the packets through the router twice, when the box is right there on your network and should not even go through the router.

With reflect of an external name your sending packets to the outside for lookup of the name to that external dns - why, when again your box is right there on your own network.

I could go on and on for quite some time if you wish ;)

ineti

Thanks. That convinced me :-)

Supermule

So you say NAT reflection is good or bad??

@johnpoz:

Why should you use dns? Because not all routers support nat reflection, nat reflection at least on pfsense does not work UDP. Some protocols do not work through nat be it reflected or not. Why send the packets through the router twice, when the box is right there on your network and should not even go through the router.

With reflect of an external name your sending packets to the outside for lookup of the name to that external dns - why, when again your box is right there on your own network.

I could go on and on for quite some time if you wish ;)

johnpoz

@Supermule:

So you say NAT reflection is good or bad??

Really??? Your not serious are you???

Lets look at it this way, do you like your router to do extra work that it does not have to – then sure use nat reflection.

Do you like it when you need UDP to between your box and your client, and it does not work -- then sure use nat reflection.

Do you like to send packets out the internet for to resolve a name that is right there on your own network? Sure then use nat reflection ;)