Editing Linux router with WAN, LAN and DMZ (section)

=== Reaching the servers from the LAN ===
A LAN client resolving the public name gets the WAN address, sends the packet to
the router, and the reply comes back from <code>10.0.0.10</code> directly —
so the connection never completes. Either give the LAN a split-horizon DNS view
that answers with the internal address, or add hairpin NAT:

<syntaxhighlight lang="bash">
iptables -t nat -A POSTROUTING -s 10.0.1.0/24 -d 10.0.0.10 -p tcp -m multiport \
         --dports 25,465,587,993 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 10.0.1.0/24 -d 10.0.0.20 -p tcp -m multiport \
         --dports 80,443 -j MASQUERADE
</syntaxhighlight>

Split-horizon DNS is the tidier of the two — hairpin NAT hides the client's real
address from the server, so its logs show the router for every internal visitor.