---
title: "Hairpin NAT vs Split-DNS: Which to Use for Internal Access"
description: "How hairpin NAT and split-DNS let internal devices reach port-forwarded services, why split-DNS is safer, and how to set it up in adam:ONE."
url: https://adamnet.works/blog/hairpin-nat-vs-split-dns/
index: https://adamnet.works/llms.txt
---

[All Articles](https://adamnet.works/blog/articles.md)

Articles · Split-DNS · NAT · adam:ONE

# Hairpin NAT vs Split-DNS

How hairpin NAT and split-DNS each let internal devices reach a port-forwarded service by its public name, why split-DNS is the safer and faster choice, and how to set it up with an adam:ONE authoritative rule.

David Redekop | ADAMnetworks • March 19, 2025

![Diagram comparing internet access, hairpin NAT and split-DNS to an internal web server](https://adamnet.works/uploads/hairpin-nat-vs-split-dns-1.webp)

From time to time this discussion comes up in support and in various forums over the years. I wanted to have a simple article for this to be easily understood.

## What problem does hairpin NAT and/or split-DNS solve?

Whenever we host content on our internal network that is publicly accessible via a port-forward, we face the issue that a public DNS entry points to the public IP address of our internet connection, but the content we’re trying to reach is inside our network on a private IP address.

To illustrate the methods of solving this FQDN-based access from the internal network, consider how internet-sourced traffic works (1), how hairpin NAT works (2) and how split-DNS connections (3) work:

![Diagram comparing internet access, hairpin NAT and split-DNS to an internal web server](https://adamnet.works/uploads/hairpin-nat-vs-split-dns-1.webp)

1. In this first scenario above, neither hairpin NAT nor split-DNS is required for a device anywhere on the internet.

2. Showing hairpin NAT in use - this requires the router to support it (2b), but it is very inefficient, especially if performance is desired; it increases the attack surface, opens doors for potential network exploitation, so it’s common for this to be discouraged for security reasons.

3. Showing split-DNS in use - this requires the ability for the internal caching DNS resolver (usually on the gateway) to be able to host a DNS A record for `www.example.com` to resolve to `10.10.10.20` (and not to the public IP address) - many routers have this capability. Within adam:ONE, a simple Authoritative Rule can be created and enabled on all policies.

Here’s how it is accomplished within the adam:ONE dashboard. First, an Authoritative type rule is created:

![adam:ONE authoritative rule answering www.example.com with an internal IP address](https://adamnet.works/uploads/hairpin-nat-vs-split-dns-2.webp)

Then it is enabled on all relevant policies:

![Authoritative rule enabled on an adam:ONE policy](https://adamnet.works/uploads/hairpin-nat-vs-split-dns-3.webp)

**We have never seen a scenario yet where hairpin NAT is a preferred method over split-DNS.**

## Additional relevant vendor links

[NAT Reflection | pfSense Documentation](https://docs.netgate.com/pfsense/en/latest/nat/reflection.html)

**[NAT44 — VyOS rolling release (current)](https://docs.vyos.io/en/latest/configuration/nat/nat44.html#hairpin-nat-nat-reflection)**

## Related reading

Articles

### [DNS Rebind Protection Revisited](https://adamnet.works/blog/dns-rebind-protection-revisited.md)

June 13, 2025

Articles

### [Benchmarking DNS with adam:ONE®](https://adamnet.works/blog/benchmarking-dns-with-adam-one.md)

September 3, 2021

Articles

### [How to Block Windows Update](https://adamnet.works/blog/how-to-block-windows-update.md)

January 3, 2025

## See it on your own network

Zero Trust Connectivity reduces attack surface 7000:1 by denying egress by default. Talk to us about what that looks like in your environment.

[Request a Demo](https://adamnet.works/contact.md) [How adam:ONE® Works](https://adamnet.works/how-it-works.md)