Can’t ping static IP from internal network, only from outside

localhostnetworkingping

I'm running ubuntu and I have apache running, however, I can't ping internally to my static IP nor browse http://207.40.XXX.XX the web server using my static IP. I can only ping/browse localhost, 127.0.0.1, and 192.168.0.120 OR 207.40.XXX.XX only from the outside world.

# cat /etc/hosts
127.0.0.1       localhost
127.0.1.1       my-server.myhost.com my-server

# hostname
my-server

# netstat -tapn
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -                  
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      -               
tcp        0      0 127.0.0.1:29754         0.0.0.0:*               LISTEN      -               
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      -               
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN

Any ideas why this is not working?

Best Answer

Your NAT-gateway is not behaving in such a way as to allow it. This is how it is probably working:

Ping

  1. You send an ICMP Echo request from 192.168.0.5 to 207.40.123.45
  2. This routes by way of your router.
  3. Your NAT gateway inside your router rewrites the request to be from 207.40.123.45 (it's static IP address)
  4. Your router replies to the ICMP Echo request
  5. Since your router does not support ICMP state, it never passes the ECHO Reply back to you.

HTTP

  1. You send a TCP/80 connection request from 192.168.0.5 to 207.40.123.45
  2. This routes by way of your router
  3. Your NAT gateway rewrites the packet as coming from 207.40.123.45:41345 to 207.40.123.45:80
  4. Your NAT gateway notes that there is a port foward in place, so forwards the packet to 192.168.0.120:80
  5. The server at 192.168.0.120 replies to the connection attempt from 207.40.123.45:41345
  6. Your NAT gateway sees the reply and rewrites the To: address on the reply to 192.168.0.5:36311, but leaves the From: untouched (192.168.0.120:80)
  7. Your computer at 192.168.0.5 gets a packet from 192.168.0.120 that it never requested, and drops it on the floor.
  8. Your connection languishes, and never opens.'

Note, it is possible that the reason ping is failing is because of the same reason HTTP is also failing. This is called 'NAT Hairpinning'.

What you need is a NAT gateway smart enough that at step 6 it also rewrites the source address.

Related Topic