In this article I will give an example of setting Hairpin NAT on RouterOS (Mikrotik).
I happen to have a server or a DVR in the local network, the ports to which are forwarded in the firewall, but you can connect only from other networks, and from the local network it is obtained only by the local IP address, but not external, on the WAN interface of the router.
Suppose the router’s WAN IP address is 22.214.171.124, the LAN is 192.168.88.1, the server’s IP address is 192.168.88.254.
Suppose there is a standard NAT rule (let’s leave it):
ip firewall nat add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface=ether1
Now configure “Hairpin NAT” (forward port 22 for SSH):
ip firewall nat add action=dst-nat chain=dstnat dst-address=126.96.36.199 dst-port=22 protocol=tcp to-addresses=192.168.88.254 ip firewall nat add action=masquerade chain=srcnat dst-address=192.168.88.254 dst-port=22 out-interface=bridge protocol=tcp src-address=192.168.88.0/24