What this page covers
Compare local hostname, local address and public-name behavior without changing port rules first.
Step-by-step workflow
- Confirm the service works on its authorised local address.
- Check internal DNS or split-horizon options.
- Test the public name from an external authorised connection if appropriate.
- Use an internal DNS record or documented router feature when hairpin is absent.
Decision table
| Check | What it tells you | Safe next action |
|---|---|---|
| Local address works | Service and LAN path are available | Inspect DNS/hairpin behavior |
| Public name fails only inside | Hairpin may be unsupported | Use split DNS or local name |
| External access fails too | Forwarding or upstream path is separate | Diagnose WAN/CGNAT safely |
Limits and verification
Hairpin failure is not proof that port forwarding is wrong. Keep public services protected and use VPN where appropriate.
Official sources
- IETF RFC 7857 — Updates to NAT terminology (NAT terminology)
- Microsoft — Troubleshoot DNS server issues (DNS diagnosis)
Related Router Portal guides
Router login troubleshooting · Router security guide
Keep in mind: Firmware, operating-system menus, ISP policies and regional radio rules can change. Confirm the current official source and exact device before applying a setting.
Our networking steps are lab-tested against standard RFC 1918 private networking protocols across Windows 11 (24H2), macOS Sequoia (15.1), iOS 18, and Android 15. We verify physical device labels and firmware release documentation before publishing gateway instructions. Router Portal is strictly read-only and never requests, intercepts, or logs router passwords.