External network access from an internal pc (internal-->internet-->internal)

[bleijendeckers]

I have a question regarding a connectivity issue. Before I start, everything is working fine. It is just I am studying for network+ at the moment and I just do not understand why it is working as it is working and I hope someone can clear it up for me.

One day a week I work for a company that uses a virtual OS, you first boot your regular PC and then you use a RDP connection (called terminal server) and it opens a virtual Windows from which all work is done. You can login from a local PC on the local network or from any PC outside the local network.

When connecting to the server from outside the local network you use a FQDN and a port number (xxxx.xxxx.xx:xxxx). When I try to connect from the internal network using this address it just won't work (they use another address for this). I fail to see why. In my opinion the following should happen:

1) The FQDN will be resolved by a public DNS server (as far as I am aware no local DNS is running).
2) The public DNS server will return the public IP address of the company's router
<up to here I am 100% confident this is true, as there is no local DNS and probably no configured host file so it cannot be resolved locally --> and if there were a local DNS it should really work as things get forwarded to the right service without ever reaching the router)
3) The computer in the local network will try to connect to that public IP address so it sends a message destined for the default gateway (as it is a public address) and this gateway (the router) should forward the request to the proper service. The router cannot send the message to the public network (internet) as it is addressed to itself, but I do think it should be capable to use NAT to let the computer and server communicate with eachother trough the router (thus sending the request to the service it would normally be forwarded to .

The strange thing is. I can ping the public IP (and the FQDN) of the router and it will return my requests, both from the local and a distant network. But i cannot connect to the FQDN, logins fail.

Now me and a colleague made a bet for a cake. My colleague said it is (usually) impossible for two local machines to communicate trough the public address and that local machines can only communicate trough their own local addresses. This was supposed to be standard with routers. I on the other hand feel somewhere something else must be the cause (a security measure or something similar) as I do feel internal machines on the same network should be able to communicate trough a public IP (although it would ofcourse be a rather inefficiënt use of bandwith).

Please someone tell me why he, or why I, have to get a cake. I just don't understand why it isn't working when I can clearly ping the address. So, is it related to a limitation of routers or is it a local setting / security measure?

Thanks in advance for any answers. If I have posted something to frown upon please enlighten me, I am not taking the exam any time soon but if I made a mistake I would like to know where my thinking went wrong.

 

[bill001g]

Your assumption that Nat should just magically make this work is wrong. Nat work very differently based on the direction the traffic is flowing and the interface the traffic arrives on. There are very specific rules it follows. On consumer grade routers this is all buried because they generally only have 1 path the traffic can flow and only one interface you can apply nat to. So the first thing to go look for is called "nat order of operation" on cisco site. This is about the clearest you will find the rules on nat but it also contains many other things related to filters and encrytion and such.

Now if you really want to win you are going to need to explain to your friend why a very non standard nat configuration call "nat on a stick" can actually do this. The key problem with this is both the inside and the outside interface are the exact same interface on the router. When you can explain this one you can be sure you understand nat very well. And of course you can only implement this on commercial routers..the examples are cisco but it can be done on juniper and a couple others.