cancel
Showing results for 
Search instead for 
Did you mean: 

HairPin Nat/Loop back NAT

SOLVED
Highlighted
Here to help

HairPin Nat/Loop back NAT

Is it possible to put a Hairpin NAT into the MX?

I have a Voice server which has a DNS record externally with which I could put a stub DNS record in for but I would then miss out everything else in that zone.

Appreciate your time.

1 ACCEPTED SOLUTION

Accepted Solutions
Kind of a big deal

Re: HairPin Nat/Loop back NAT

Holy crap! I can't believe that worked!

 

OK, so if you want to do a LAN to LAN hairpin you can leverage the 1:Many NAT feature to make this happen. To test this I have a Raspberry Pi behind an MX on VLAN 10 with an IP of 192.168.100.5. I then created the following 1:Many Nat rule under Security appliance > firewall:

 

image.png

 

So then as a test I then SSH'd to the 1:Many IP, which "hairpins" me back to the same Raspberry PI. 

 

image.png

 

Very cool. I expect this would work the same for a 1:1 NAT as well. So while not quite a true hairpin, it does the exact same thing. 

 

4 REPLIES 4
Kind of a big deal

Re: HairPin Nat/Loop back NAT

I don't think you can... The MX only NAT's between WAN and LAN interfaces... There's no way that I'm aware of to do a LAN to LAN or WAN to WAN NAT on it. 

 

But... Maybe you can sort of do the same thing if you create a 1:1 or 1:Many NAT... Hang on let me try this...

Kind of a big deal

Re: HairPin Nat/Loop back NAT

Holy crap! I can't believe that worked!

 

OK, so if you want to do a LAN to LAN hairpin you can leverage the 1:Many NAT feature to make this happen. To test this I have a Raspberry Pi behind an MX on VLAN 10 with an IP of 192.168.100.5. I then created the following 1:Many Nat rule under Security appliance > firewall:

 

image.png

 

So then as a test I then SSH'd to the 1:Many IP, which "hairpins" me back to the same Raspberry PI. 

 

image.png

 

Very cool. I expect this would work the same for a 1:1 NAT as well. So while not quite a true hairpin, it does the exact same thing. 

 

Here to help

Re: HairPin Nat/Loop back NAT

Thanks for your help.  I'll give that a go.

Meraki Employee

Re: HairPin Nat/Loop back NAT

@jdsilva, I'll let you in on a secret. We don't really care what you NAT from and to... You can use whichever address you want on either end of the NAT Smiley Wink Obviously from a WAN perspective you need to make sure that the IP address is assigned to you otherwise you won't go very far! XD

 

Giacomo

Please keep in mind that what I post here is my personal knowledge and opinion. Don't take anything I say for the Holy Grail, but try and see!
Appreciate who helps and be respectful of every opinion and every solution offered.
Share the love, especially the Meraki one!
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.