In the below network topology a web server behind a router is on private IP address space, and the router performs NAT to forward traffic to its public IP address to the web server behind it.

The NAT configuration would look like below:

/ip firewall natadd chain=dstnat dst-address=1.1.1.1 protocol=tcp dst-port=80 \ action=dst-nat to-address=192.168.1.2add chain=srcnat out-interface=WAN action=masquerade

When a client out on the Internet with IP address 2.2.2.2 establishes a connection to the web server, the router performs NAT as configured.

  1. the client sends a packet with a source IP address of 2.2.2.2 to a destination IP address of 1.1.1.1 on port tcp/80 to request some web resource.
  2. the router destination NATs the packet to 192.168.1.2 and replaces the destination IP address in the packet accordingly. The source IP address stays the same: 2.2.2.2.
  3. the server replies to the client's request and the reply packet has a source IP address of 192.168.1.2 and a destination IP address of 2.2.2.2.
  4. the router determines that the packet is part of a previous connection and undoes the destination NAT, and puts the original destination IP address into the source IP address field. The destination IP address is 2.2.2.2, and the source IP address is 1.1.1.1.

The client receives the reply packet it expects, and the connection is established.

When a client on the same internal network as the web server requests a connection to the web server's public IP address, the connection breaks.

  1. the client sends a packet with a source IP address of 192.168.1.10 to a destination IP address of 1.1.1.1 on port tcp/80 to request some web resource.
  2. the router destination NATs the packet to 192.168.1.2 and replaces the destination IP address in the packet accordingly. The source IP address stays the same: 192.168.1.10.
  3. the server replies to the client's request. However, the source IP address of the request is on the same subnet as the web server. The web server does not send the reply back to the router, but sends it back directly to 192.168.1.10 with a source IP address in the reply of 192.168.1.2.

The client receives the reply packet, but it discards it because it expects a packet back from 1.1.1.1, and not from 192.168.1.2. As far as the client is concerned the packet is invalid and not related to any connection the client previously attempted to establish.

To fix the issue, an additional NAT rule needs to be introduced on the router to enforce that all reply traffic flows through the router, despite the client and server being on the same subnet. The rule below is very specific to only apply to the traffic that the issue could occur with - if there are many servers the issue occurs with, the rule could be made broader to save having one such exception per forwarded service.

/ip firewall natadd chain=srcnat src-address=192.168.1.0/24 \ dst-address=192.168.1.2 protocol=tcp dst-port=80 \ out-interface=LAN action=masquerade

With that additional rule, the flow now changes:

  1. the client sends a packet with a source IP address of 192.168.1.10 to a destination IP address of 1.1.1.1 on port tcp/80 to request some web resource.
  2. the router destination NATs the packet to 192.168.1.2 and replaces the destination IP address in the packet accordingly. It also source NATs the packet and replaces the source IP address in the packet with the IP address on its LAN interface. The destination IP address is 192.168.1.2, and the source IP address is 192.168.1.1.
  3. the web server replies to the request and sends the reply with a source IP address of 192.168.1.2 back to the router's LAN interface IP address of 192.168.1.1.
  4. the router determines that the packet is part of a previous connection and undoes both the source and destination NAT, and puts the original destination IP address of 1.1.1.1 into the source IP address field, and the original source IP address of 192.168.1.10 into the destination IP address field.

The client receives the reply packet it expects, and the connection is established.

However, the web server only ever sees a source IP address of 192.168.1.1 for all requests from internal clients regardless of the internal client's real IP address. There is no way to avoid this without either using a router that can do application level DNS inspection and can rewrite A records accordingly, or a split DNS server that serves the internal clients the internal server IP address and external clients the external server IP address.

This is called - among other terms - hair pin NAT because the traffic flow has clients enter the router through the same interface it leaves through, which when drawn looks like a hair pin.

RouterOS 设定NAT loopback (Hairpin NAT)回流的更多相关文章

  1. Linux 与 CONE NAT 和 Symmetric NAT

    http://alexanderlaw.blog.hexun.com/31883661_d.html 1. NAT 的划分 RFC3489 中将 NAT 的实现分为四大类: 1. Full Cone ...

  2. 静态NAT、动态NAT

    静态NAT.动态NAT 实验拓扑: 实验目的:熟悉网络地址转换协议 掌握静态NAT 和动态NAT的配置 分析静态NAT 和动态NAT的区别 使用show命令来检查NAT的运行情况 实验要求:按拓扑图来 ...

  3. 运营商级NAT(Carrier-grade NAT)

    运营商级NAT(Carrier-grade NAT)   运营商级(Carrier-grade)NAT,是用于缓解是IPV4地址枯竭的一种方法,通过这种方法,原来被分配公网ip的端点.家庭网络等可以被 ...

  4. CONE NAT 和 Symmetric NAT

    CONE NAT 和 Symmetric NAT 1. NAT 的划分 RFC3489 中将 NAT 的实现分为四大类: Full Cone NAT 完全锥形 NAT Restricted Cone ...

  5. 什么叫NAT,设置NAT的两个方法

    NAT是网络地址翻译就是把公网IP翻译成私有地址, 又叫端口映射或端口转发. 采用路由方式是指ADSL拥有一个动态或固定的公网IP,ADSL直接接在HUB或交换机上,所有的电脑共享上网.这时ADSL的 ...

  6. NAT and Traversal NAT(TURN/STUN/ICE)

    http://www.cnblogs.com/whyandinside/archive/2010/12/08/1900492.html -------------------------------- ...

  7. 静态NAT、动态NAT、PAT(端口多路复用)的配置

    静态NAT.动态NAT.PAT(端口多路复用)的配置   NAT的实现方式有三种,即静态转换Static Nat.动态转换Dynamic Nat 和 端口多路复用OverLoad.    静态转换 ( ...

  8. NAT原理与NAT穿越

    最近在看东西的时候发现很多网络程序中都需要NAT穿越,特意在此总结一下. 先做一个约定: 内网A中有:A1(192.168.0.8).A2(192.168.0.9)两用户 网关X1(一个NAT设备)有 ...

  9. NAT与FULL NAT的区别

    LVS 当前应用主要采用 DR 和 NAT 模式,但这 2 种模式要求 RealServer 和 LVS在同一个 vlan中,导致部署成本过高:TUNNEL 模式虽然可以跨 vlan,但RealSer ...

随机推荐

  1. MyEclipse移动开发教程:设置所需配置的iOS应用(四)

    MyEclipse个人授权 折扣低至冰点!立即开抢>> [MyEclipse最新版下载] 三.创建配置文件 Provisioning profiles授权文件应用程序在iOS设备上安装并运 ...

  2. MyEclipse 2017 Stable 2.0发布|附下载

    MyEclipse个人开发者专享6.9折!仅剩最后3天!在线订购>> 2017 Stable 2.0版本带来了新的功能和修复,从Stable 1.0以来,已经发布了几个版本的Angular ...

  3. ESET Smart Security 6 – 免费60天(SG)

    ESS 60天 - 活动消息来自新加坡脸谱https://www.facebook.com/esetsingapore/app_190322544333196IP限制Sg,suiss提供个在线代理ht ...

  4. 关于Behold the Kickmen (球员登场)

    音乐:『Boring,Boring——』作者浑厚的男中音响起,伴随着劲爆的动感音乐 非同正式却又无伤大雅的规则:足球场是圆形的,而且四周有反弹围墙 加强操作的一些设定: 踢踢人射门蓄力时,时间会静止, ...

  5. PostgreSQL误删操作怎么处理

    方式一: PostgreSQL中没有Oracle的闪回机制,只有更加复杂的PITR恢复机制,这要求数据库有全量备份和增量备份,否则无法进行回滚. 方式二: 虽然PostgreSQL有延迟复制的技术,在 ...

  6. Android输入法框架系统(上)

    输入法,就是用来输入字符(包括英文,俄文,中文)的工具.输入法你可以看成是一种字符发生器,它将输入数据触摸事件或者按键事件转化为其他更丰富的字符.在PC时代,输入法的原始输入来自实体键盘,鼠标,然后输 ...

  7. 自定义页签logo

    1.webpack.prod.conf new HtmlWebpackPlugin({ filename: process.env.NODE_ENV === 'testing' ? 'index.ht ...

  8. Java实现哈夫曼编码和解码

    最近无意中想到关于api返回值加密的问题,譬如我们的api需要返回一些比较敏感或者重要不想让截获者得到的信息,像如果是做原创图文的,文章明文返回的话则有可能被抓包者窃取. 关于请求时加密的方式比较多, ...

  9. Linux下XordDos木马的清除

    朋友的阿里云服务器一早上报木马入侵,找我处理,登陆阿里云查看警告信息“恶意进程(云查杀)-XorDDoS木马”, 本文也可以作为服务器处理木马排查的步骤的参考文章 排查原则: 1.一般的木马都有多个守 ...

  10. 在intent-filter中的配置

    1.scheme约束和mimetype的数据类型,这些都可以自己去定义. 2.但是由于在MainActivity却不能直接将这两个参数分开来写,例如setdata和settype,这样会互相删除. 因 ...