Virtual Firewall: Access from Your Internal Network (NAT Loopback)

When a server in your internal network connects to the public IP address of a port forwarding rule (or to a domain name pointing to it), the connection normally fails. The request reaches the internal server, but the reply goes straight back to the client without passing through the firewall, so the connection breaks. For example, a website running on a server behind the firewall does not open by its domain name from another server in the same network.

NAT loopback solves this: these connections from the internal network are also passed through the firewall and reach the internal server.

How is it turned on?

• When you add a new rule, the Also reachable from my internal network (NAT loopback) box is ticked by default.
• For existing rules, the button in the From internal network column of the Port forwarding tab shows the state: On or Off. Click it to change it; you are asked to confirm when turning it off.
• You can also change the box when editing the rule.

Good to know

• For these connections from your internal network, the internal server sees the internal address of the firewall as the visitor address. Visitors from the internet are not affected.
• If the option is on for a rule limited to allowed source addresses, servers in your internal network can also reach that rule.
• The option only affects traffic from your internal network; it does not change access from the internet.
• For rules defined by our team, the state is shown as text only; you can open a support ticket to change it.