HairPIN NAT with Destination NAT is used when Internal private hosts who are themselves NAT'd with a traditional NAT translation type like NATP-44 need to access an Internal private server (same LAN subnet or in the same corporate network) using the server’s public NATd IP address from inside the network.
Here ,169.254.10.100/32 Public IP has been assigned to Internal server (10.1.0.100) and DNAT is configured on NAT device which will translate any connection initiated from Public Network with the Destination IP address 169.254.10.100/32 to internal server IP address 10.1.0.100
set services service-set HairPIN-test nat-rules HairpinNAT set services service-set HairPIN-test nat-rules DNAT set services service-set HairPIN-test next-hop-service inside-service-interface ms-5/0/0.1 set services service-set HairPIN-test next-hop-service outside-service-interface ms-5/0/0.2 set services nat pool HairPIN_pool address 169.254.10.0/24 set services nat pool HairPIN_pool port automatic set services nat rule HairpinNAT match-direction input set services nat rule HairpinNAT term 1 from source-address 10.1.0.0/24 set services nat rule HairpinNAT term 1 then translated source-pool HairPIN_pool set services nat rule HairpinNAT term 1 then translated translation-type napt-44 set services nat rule DNAT match-direction output set services nat rule DNAT term 1 from destination-address 169.254.10.100/32 set services nat rule DNAT term 1 then translated destination-prefix 10.1.0.100/32 set services nat rule DNAT term 1 then translated translation-type dnat-44 set interfaces xe-0/0/0 unit 0 family inet address 172.16.0.1/30 set interfaces ms-5/0/0 unit 1 family inet set interfaces ms-5/0/0 unit 1 service-domain inside set interfaces ms-5/0/0 unit 2 family inet set interfaces ms-5/0/0 unit 2 service-domain outside set interfaces ge-0/3/1 unit 0 family inet address 172.168.100.1/24 set routing-instances inside instance-type virtual-router set routing-instances inside interface ge-0/3/1.0 set routing-instances inside interface ms-5/0/0.1 set routing-instances inside routing-options static route 10.1.0.0/24 next-hop 172.168.100.2 set routing-instances inside routing-options static route 0.0.0.0/0 next-hop ms-5/0/0.1 set routing-instances outside instance-type virtual-router set routing-instances outside interface ms-5/0/0.2 set routing-instances outside interface xe-0/0/0.0 set routing-instances outside routing-options static route 169.254.100.0/24 next-hop 172.16.0.2
root@Public-Host# run ssh [email protected] source 169.254.100.100 Password: Password: Last login: Wed Jul 26 08:47:28 2017 from 169.254.100.100 --- JUNOS 15.1X54-D10.5 built 2015-06-17 17:20:27 UTC root@Host10-1-0-100> root@NAT-Device# run show services sessions ms-5/0/0 Service Set: HairPIN-test, Session: 167772162, ALG: none, Flags: 0x0000, IP Action: no, Offload: no, Asymmetric: no TCP 169.254.100.100:50728 -> 169.254.10.100:22 Forward O 24 TCP 10.1.0.100:22 -> 169.254.100.100:50728 Forward I 21 root@Host10-1-0-10> ssh [email protected] source 10.1.0.10 The authenticity of host '169.254.10.100 (169.254.10.100)' can't be established. ECDSA key fingerprint is 8d:56:d8:2a:bd:24:ac:66:5d:56:a2:7f:c8:b4:8e:ed. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '169.254.10.100' (ECDSA) to the list of known hosts. Password: Last login: Wed Jul 26 08:58:17 2017 from 169.254.100.100 --- JUNOS 15.1X54-D10.5 built 2015-06-17 17:20:27 UTC root@Host10-1-0-100> root@NAT-Device# run show services sessions ms-5/0/0 Service Set: HairPIN-test, Session: 33554435, ALG: none, Flags: 0x0000, IP Action: no, Offload: no, Asymmetric: no TCP 169.254.10.7:1024 -> 169.254.10.100:22 Forward O 22 TCP 10.1.0.100:22 -> 169.254.10.7:1024 Forward I 19 Service Set: HairPIN-test, Session: 134217729, ALG: none, Flags: 0x0000, IP Action: no, Offload: no, Asymmetric: no TCP 10.1.0.10:63904 -> 169.254.10.100:22 Forward I 22 TCP 169.254.10.100:22 -> 169.254.10.7:1024 Forward O 19
When the internal host tried to ssh internal server with public IP. the request reaches to NAT device and NAT device perform both Source and Destination NAT for the session. The internal host’s source IP (10.1.0.10) was translated to 169.254.10.7 and the server’s public IP was translated to 10.1.0.100 as per DNAT rule.