What configuration or concept am I not understanding with web servers and domains

Question

Please bear with me, this might be a little confusing because I'm having a hard time explaining.

I have an IIS web server at home. I registered a domain with DuckDNS to point to that web server.

Xfinity is my internet provider and I configured port fowarding to that web server.

Now I can get to the home page just fine outside my home network. Working good so far.

Here comes the part I don't understand: On the web server, I open up a browser and browse to the website (http://my.duckdns.org) and get unreachable page. Is that expected or do I not have something configured properly?

Answer 1

This is usually an indication that your NAT gateway is not doing what's known as "NAT hairpinning" or "NAT loopback". There's all upside and no downside to supporting this, so most NAT gateways that support it do it by default and don't provide a way to turn it off. So you should go look at the settings of your NAT gateway and make sure, but the odds are that your NAT gateway is just missing this ability and you'll need to replace your NAT implementation either by putting something like OpenWrt on your router, or by replacing your router with one that has a better NAT implementation.

Answer 2

The other answer already mentioned the problem, its NAT Hairpinning.

They don't explain exactly why it happens, so I thought there needs to be an answer that explains NAT Hairpinning.

When you make a request for a DNS translation, eg: you query what my.duckdns.org is, you get an ipaddress. Your browser will broadcast this request to the lanport, and your router will see this and thinks: Hey, this is not a local ip address, I'll direct the traffic to the WAN port instead.

Your request is now sent to the internet, but the next hop sees that the target is your router and immediately sends the traffic back.

Your router however does not expect the traffic because it happens at the same time, and ignores it. Its the same as with a hub, when you send a network packet along the network, that packet is also sent back to your device. By default, this is always ignored, otherwise the network would go down immediately. (also known as a collission)

So your router ignores the incoming request, and as such you get a time-out.

If your router can masquerade the traffic, you can teach it to forward traffic to its own ipaddress back into a different network port (this is nat hairpinning).

Alternatively, if your network has a DNS server, you can place an entry in there and override your WAN IP with the local IP address instead to make it work too.

While NAT Hairpinning can fix the problem, usually doing a DNS entry in the local DNS server is a far easier approach, because misconfiguring NAT hairpinning could cause all outgoing traffic to fail and be redirected internally.