hairpin NAT

Reaching your own public address from inside your own network - the traffic goes out to the NAT and hairpins straight back in.

Without hairpin (loopback) NAT support, an internal client asking for the company's public IP gets nowhere, which is why split-horizon DNS often answers with the internal address instead. The name is the shape the traffic draws: out, U-turn, back.

RFC 4787 defines the case precisely: two hosts sit behind one NAT, X1 sends to the external address and port the NAT allocated to X2, and the NAT must relay the traffic back inside. Its REQ-9 makes hairpinning a MUST for UDP and RFC 5382 does the same for TCP. The behaviour required is that X2 sees the packet arrive from X1's external address and port, not from its private one.

In a worked example with the NAT at 203.0.113.1, a packet from 10.0.0.2:40000 to 203.0.113.1:51234 is delivered to 10.0.0.10:51234 with source 203.0.113.1:40000. RFC 5128 notes that not all deployed NATs support hairpinning, and that even where they do, two peers on the same network do better to reach each other's private endpoints directly, because the detour through the NAT adds latency and load.

Also known as: NAT loopback, hairpinning, NAT hairpinning

Sources

← All glossary entries