Destination NAT Onto the Same Network from internal clients

Question

I have a DSL router which acts as NAT (SNAT & DNAT). I have setup a server on internal network (10.0.0.2 at port 43201). DSL router was configured to "port forward" (or DNAT) all incoming connections to 10.0.0.2:43201.

I created a virtual server for port forwarding on DSL router. I also added following iptables rules for port forwarding.

iptables -t nat -A PREROUTING -p tcp -i ppp_0_1_32_1 --dport 43201 -j DNAT --to-destination 10.0.0.2:43201
iptables -I FORWARD 1 -p tcp -m state --state NEW,ESTABLISHED,RELATED -d 10.0.0.2 --dport 43201 -j ACCEPT

# ppp_0_1_32_1 is routers external interface.
# routers internal IP address is 10.0.0.1 and server is setup at 10.0.0.2:43201

Problem is that connections coming from external IP addresses are able to access internal server using External IP address, but internal clients (under NAT) are not able to access server using external IP address.

Example: http://<external_address>:43201 is working from external clients
But, internal clients are not able to access using http://<external_address>:43201

This seems to be similar to the problem described in http://www.netfilter.org/documentation/HOWTO/NAT-HOWTO-10.html (NAT HOW-TO Destination NAT Onto the Same Network).

Firstly, I am not able to understand why is this a problem for internal clients? Secondly, what iptables rule will enable internal clients to access server using external IP address? Please suggest.

Solution

This is because if your internal client tries to communicate with the server (within the same subnet) using the public IP, it has to send the request via the gateway (NAT box). The gateway will then do the DNAT from public IP to server private IP and then forwards it.

In the normal case, the web server will a request coming from the internal client IP address (same subnet). So, it will send back the reply directly without going through the gateway. The client will refuse to process the reply as it is sending to public IP and receiving the response from another (private) IP. It is confusing. Isn't it?

One solution is to talk to the server using private IP from internal clients. This can be hidden by implementing DNS split (internal & external views).

Another option is to force the traffic (from/to server) to go via the gateway (NAT box).