I have a Gentoo Linux server. Server is connected to two networks: internal and external.

Internal network ip:
External network ip:

If I'm trying to make request from server to itself, it uses external network IP. Connecting to nginx using Wget gives me this log record:

server ~ # tail -n 1 /var/log/nginx/error_log - - [27/Aug/2014:19:04:42 +0300] "GET / HTTP/1.1" 200 5 "-" "Wget/1.14 (linux-gnu)"

Despite that I connecting directly to

server ~ # wget

Routing table (metric is higher on external network, but seems ignored): ip route show

server ~ # ip route dev wan  scope link  metric 20 dev lan  scope link  metric 10 

ip route get:

server ~ # ip route get
local dev lo  src 
    cache <local> 

How can I get this machine to connect using to itself, instead of

  • 4
    Do you have any iptables rules? iptables -t nat -nvL. If you've got a MASQUERADE or SNAT rule that is too broad, that can cause this. – Patrick Aug 27 '14 at 16:19
  • 1
    You saved my day! Thank you vm. I completely forgot that I'm behind NAT'ed network. Sorted this out! – GeekMagus Aug 27 '14 at 16:57

If you have this problem with every program you run, you should check your server firewall rule. Make sure that it only use NAT for external destination. Your route table make no sense if you have a wide NAT rule.

After fixing firewall rule, for wget, you can use --bind-address option to chose what interface you want to use:

wget --bind-address=

From wget documentation:


When making client TCP/IP connections, bind to ADDRESS on the local machine. ADDRESS may be specified as a hostname or IP address. This option can be useful if your machine is bound to multiple IPs.

You can use a .wgetrc file to make this permanent.

| improve this answer | |
  • 1
    Good point, thanks. But I have problems with EVERY program I use, not only wget. – GeekMagus Aug 27 '14 at 16:53
  • 1
    @Greshnik: I update answer with a more details. If you can give use your firewall rule, we can make it clearly. – cuonglm Aug 27 '14 at 17:41

As was mentioned by @Patrick in one of the comments to my question, I was encountering an issue with my iptables NAT rules.

  • eth0: Internal network,
  • eth1: External network,

My NAT rule was:

$ iptables -t nat -A POSTROUTING ! -o eth0 -j MASQUERADE

That means, that all traffic whose output destination device is not interface eth0 will be masqueraded. The same thing happens with local traffic too, as it comes out from the lo interface.

After fixing iptables NAT rule to:

$ iptables -t nat -A POSTROUTING ! -d -j MASQUERADE

My problem was solved!

| improve this answer | |
  • 2
    Local traffic can also have (or in general, as its destination. It may be easier to masquerade based on where your packet is going, rather than where it isn't. – Jander Aug 27 '14 at 18:54
  • @Jander, you are definitely right! I need to send all traffic whose destination is not an internal or local network through NAT. Can you, please, give me a right advice on that? – GeekMagus Aug 27 '14 at 20:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.