Loopback for Firewall in LAN (behind Home Router)

Mostly accessing the external IP from ISP-Router from internal network + forwarding traffic back to firewall didnt't work.

my solution: create a internal DNS-Entry for the internal host ... or if you wish to use FW-WAF, DNS pointing to external FW-IP (10.255.255.253) 

(FW-DNS entries are used before trying external DNS)

Hello Dirk

Thanks for your answer on this. A pitty that you are telling me exactly what I was afraid of.

I'm already resolving to internal DNS entries, but this comes with a few shortcomings. It seems that I will have to live with that or need to get a business contract with the ISP.

Hello,
what shortcomings do you see that a business contract with the ISP could solve?
Perhaps there is a solution or workaround?

I think, if your ISP Router is able to provide hairpin NAT it shouldn´t be the problem.

On other hand you need a DNAT Rule and allow incomming traffic from WAN and Port A.

But I think split DNS is the better solution as dirkotte wrote.

BR Gerd

With the provider I am at the moment I could get a business Router which is able to go in bridge mode and additionally brings the option of a static IP.
Alternatively I could change to a provider which offers the use of "bridgeable" routers.
With this I could eliminate the transit network.

Kilian

Unfortunately my current router is not able to do this. So have to stay with my split DNS setup or change the router/provider.

Kilian