Hairpin nat broken not working properly

i changed the router of the provider today, after that router is my router running openwrt and nat... i am also using home-assistant remote connect; everything worked fine until i changed the providers router.

here they says hairpin nat has to be enabled; so i did it by unticking Rebind protection.

Still i cant access my hass using domain name within the local network even it works from hosts outside my network.

means hairpin nat in dnsmasq on openwrt is broken?

Some routers do not support hairpin. In the case of your upstream router (from the ISP), it may not be an option exposed to the user (I know that the Bell Home Hub 3000 doesn't have the capability)

@psherman does it mean both routers must support it?

I thought the providers router doesnt matter; important is the one - mine - where i run openwrt and my dns server.

what is solution then? how can i access these hosts from local network? thanks

in that post [SOLVED] CGN and hairpins (avoid local traffic going to ISP and back) / NAT reflection - #6 by imaginator they said use


but it doesnt work for me either. :frowning:

@imaginator did u set that reflection 1 on main router? or router behin ISP provider router?

Where is the host that is requesting the resource? In other words, which router is that host connected to (the ISP router or the OpenWrt router)?

i have ISP provider router (running NAS) to which i have connected via eth my router (to its wan) ; my router is running openwrt and NAS, dhcp server etc. All the hosts are then connected to my router via eth or wifi.

So basically the host that is trying to access domain which has one port-forward on ISP router, other on My router is connected to My router.


I'm still confused.

Can you draw a network diagram. Please show where the requesting host is located, as well as the target host.


client is trying to access homeassistant via public url

both client and homeassistant have IP addresses of local LAN iface ie 10.0.5.x


You may be able to by setting the addresses in the dns server configuration on your Openwrt router. Specifically, the "addresses" field allows you to set a list of domains to force to an IP address.
the entry would be something like / where x is the IP of the host that is serving the resource.

1 Like

not sure what do u mean ... what option we are talking about? If i go to DHCP and DNS via luci, server settetings i have general/ resolv and hosts files/ tftp settings/ advanced settings/ stratic leases ...
which one you are pointing to? thanks

LuCI > Network > DHCP & DNS > "Addresses" field (below DNS fowrardings)

there is no such a field... \

also i am not sure, as everything worked before i changed isp router;;; so the issue has to be in the isp router not openwrt... as nothing was touched in openwrt settings..

I also tried to untick rebind protection but didnt help.

what version of OpenWrt are you using? And on what device?

maybe i should use Domain whitelist? section


Linksys WRT1900AC


ARMv7 Processor rev 2 (v7l)

Firmware Version

OpenWrt 19.07.3 r11063-85e04e9f46 / LuCI openwrt-19.07 branch git-20.136.49537-fb2f363

I would recommend upgrading to 21.02.1.

1 Like

Actually the correct place to add the hostname is Network/Hostnames
Although, if the homeassistant is getting its settings by dhcp, you could enable the dns option for the static lease entry, so that the hostname will be automatically added when HA is connected.

1 Like

Ummmmm...isn't "Hairpin NAT" an analogous term for the OpenWrt term "NAT Loopback"???

Using this firewall rule as an e.g. - it allows access to an HTTP server using its public IP or global hostname (which should resolve to its Public IP) from LAN:

Rebind protection means someone setup a LAN IP in the global DNS...that may be likely; but usually NOT the case - because this can cause security issues if not really needed.

The most common use case would probably be for routers connected to networks with Private IP address and internal DNS servers giving out Private IPs of Private servers (i.e. no Public Internet).

@trendy that doesnt work...
i set hostname same as public url ... ip of hass but it doesnt work.

dont understand that much ... what u want to achieve with that also whats src_ip and dest_ip in that case
my config is as


also as i mentioned all worked fine, i replaced isp router; added exactly same ip forward rule and now its not working ...

Well..I don't see how the OpenWrt is even involved.

I was confused about the re-add if the OpenWrt was untouched, my apologies.